Came to this string late - but though I’d share my thoughts plus edited
highlights of recent correspondence with ICO on this subject:
1. Sections 68 to 70 of FOIA amend DPA as it applies to PUBLIC AUTHORITIES
only, by adding paragraph (e) to the definition of data in Section 1 of
DPA – “recorded information held by a public authority (which) does not
fall within any of the (existing) paragraphs (a) to (d)”.
2. The 'Durant' definitions of personal data & relevant filing system
stand, but any personal data held manually by public authorities that is
not in a relevant filing system will fall into category (e).
3. According to ICO, category (e) data comes in two types:
a.‘relatively structured information’ that is fairly easy to locate, even
though not sufficiently structured to fall into ‘Durant’ definition of
relevant filing system
b.‘relatively unstructured information’ including incidental references to
individuals (the ICO’s example was minutes recording individuals’
contributions to a meeting)
4. Where the information requested is ‘relatively structured’ there is no
maximum limit on the amount of information that must be supplied.
5. Where the information is ‘relatively unstructured’ then “…subject
access will not be given to this information unless the information is
expressly described by the data subject…”
6. “Furthermore, even when this ‘relatively unstructured ‘ information is
described in the request the data controller need not respond where to do
so would cost more than is provided for by the prescribed cost ceiling.”
7. “That is, if the cost of locating and retrieving the information
requested would exceed £450 (or £600 in the case of central government
departments) there is no duty to respond.”
8. “When the data controller does respond to a subject access request then
the maximum fee for responding, whether involving structured or
unstructured information, remains £10.”
Point 4 is the one that really worries me – until clarified by ICO had
assumed that the cost ceiling applied to ALL unstructured data so that we
wouldn’t have to respond to SAR where locating / retrieving / extracting
manual data likely to take more than 18 hours.
It only takes SAR from some of our more prolific complainers &
correspondents for ‘real work’ to grind to a halt!
Whilst I think that the ‘Durant’ opinion narrowed the definitions too much
(and would be interested to see EU letters to government on the subject if
anyone’s made FOIA request???) the potential cost to public authorities of
dealing with SAR under this regime doesn’t seem like best value for
taxpayers!
Kirsty E Gray
Access to Information Advisor
Commission for Social Care Inspection
Note: comments for discussion and debate only and do not necessarily
reflect the corporate position of CSCI nor constitute legal advice.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving message please send to the list owner
[log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
