Subject Access Request
Written by Michael Coyle on 30 August 2015« Return to Reading Room
How do you obtain documents that you feel identify you (personal information) via the Data Protection Act 1998? You would be considered a data subject under the Data Protection Act 1988 ('DPA')
The core of a data subject's entitlement to access to his personal data is to be found in ss 7(1) and 8(2), which provides:
"7(1) …an individual is entitled –
(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,
(b) if that is the case, to be given by the data controller a description of -
(i) the personal data of which that individual is the data subject,
(ii) the purposes for which they are being or are to be processed, and
(iii) the recipients or classes of recipients to whom they are or may be disclosed,
(c) to have communicated to him in an intelligible form –
(i) the information constituting any personal data of which that individual is the data subject, and
(ii) any information available to the data controller as to the source of those data, and
(d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.".
"8(2) The obligation imposed by section 7(1)(c)(i) must be complied with by supplying the data subject with a copy of the information in permanent form unless-
(a) the supply of such a copy is not possible or would involve disproportionate effort, or
(b) the data subject agrees otherwise."
The general rule is write to the Data Controller under the DPA enclosing a cheque in the sum of £10.00 and allow them 40 days to provide the information. If you don't receive it within 40 days then you will need to report the Data Controller to the Information Commissioner.
Want to speak
Complete the form below and we’ll call you back free of charge.