Subject Access Requests, Privacy and Cookies Statements

The right of access, often referred to as a Subject Access Request, is set out in law and allows you to ask the council to disclose the personal information we hold about you. This is separate from a Freedom of Information request which can be made to seek general, non-personal information the council might hold.

This right exists so that you can understand how your information is being used, check that it is accurate and be aware of who it may have been shared with. When you make a SAR, we will search our systems for any information that identifies you and provide you with a copy of that personal data, unless a legal exemption applies.

It is important to note that this right is specifically about accessing your personal data. General questions about the service you have received, or concerns about how a decision was made, are not covered by a SAR. Those types of enquiries should be raised directly with the service involved, as they will be best placed to address them.

If you need contact details for a particular service, these can be found in our contact us section.

How to make an effective subject access request

Throughout our process, the person whose information is being sought is known as the data subject and the person seeking it is called the requester. If the requester is not the data subject, they will need to provide some further information about themselves once they have completed the first part of the request form about the data subject’s details.

When making a subject access request, what is particularly important is that we can clearly identify the data subject and the information about them being requested. You may want a file from a specific service, like a copy of your benefits file, your housing file or your social care records. You could ask for information from more than one service, or for just a small amount – for example, copies of specific documents, documents within a particular date range or information relating to a particular event. The more detail you can provide, the better able we are to complete your request efficiently. Please therefore only ask for information that you need. 

The Information Commissioner’s Office recommends that you give specific details of where to search for the personal data you want - for example:

• your full name, address, and contact telephone number
• any information that we use to identify you, such as a housing application number or any other unique identifiers
• details of the specific information required along with relevant dates - for example:
  • your housing benefit file
  • emails between ‘name’ and ‘name’ between 2/8/2023 and 06/01/2024 about your complaint
  • copies of statements (e.g. between 2021 and 2022) relating to a specific account number

Other information may also help us to locate what you’re looking for, so if you think that it might be useful, do please include an explanation of why you’re seeking the information.

Proof of identity is needed

It is important that the council is sure of your identity before releasing any information. If you are making a request for someone else’s information, you will need their documentation as well as your own.

You will need to provide at least one document from each category:

Category 1: Proof of address

Your full address must be visible in the evidence you provide.

• council tax bill dated within the last three months
• driver’s licence
• bank statement dated within the last three months
• utility bill dated within the last three months

Category 2: Proof of identification

• passport
• driver’s licence
• birth certificate

Whilst the driver’s licence appears in both lists, it can only be used once and another form of ID will still be required from the other category.

The council will not begin processing your request until all identity requirements have been satisfied. If you do not provide the necessary identity information within two weeks of your request, your file will be closed and you will need to submit a fresh request.

Requests on behalf of children

Subject access requests are often made by parents for information about their children. The Data Protection Act 2018 affords children the same rights as adults regarding access to and protection of their data. A child can request access to their own data when they can understand their rights and what it means to make a request.

Whilst the law in England does not specify an age at which a child is considered to have the competency to understand and exercise their rights, it does state that a child of 13 can consent to ‘information services’. Bromley uses this age as a guide for considering when a child has competency. We will need to see written and signed evidence of your appointment to act on their behalf which shows they understand the nature of the request, what information is being requested and the consequences of the disclosure. Bromley is committed to upholding the rights and freedoms of those we hold information about. As part of responsible due diligence, Bromley will take into consideration the circumstances of each request, and the level of maturity of the child including any views they may have about the disclosure, before determining when disclosure is reasonable.

Requests on behalf of adults

The council will need to be satisfied that the person whose information you are requesting has given their informed consent for you to do so. You may have the authority as their Power of Attorney, or they may have given you their consent in some other way. Evidence of your authority to act on behalf of the data subject should be submitted via the webform. In cases where consent from the data subject has been sought, we will need to see written and signed evidence of your appointment to act on their behalf which shows they understand the nature of the request, what information is being requested and the consequences of the disclosure. We may also contact the person to discuss their disclosure with them when appropriate. 

Access to deceased records

Where a request is received for access to the records of someone who has died, the person making the application should be asked to explain in writing their relationship to the deceased person, what information is needed and why. The relevant case worker should decide in consultation with their manager and advise the applicant in writing of the decision with reasons.

Information required for courts or tribunals

We recognise that people sometimes need information in a hurry, but we cannot change the timescales set out below. The fact that someone may have a court or other legal deadline to meet cannot be considered.

In any event, a subject access request is not usually the best method to obtain information for use in legal proceedings. This is because the documentation disclosed in response to the request will invariably contain at least some redaction (where information the requester is not entitled to see is permanently blacked out) and the court is unlikely to consider that acceptable evidence.

If you believe the council holds information that is relevant to a case a court is having to decide upon, the best approach is usually to ask the court to make an order directing the council to disclose the relevant information directly to the court. This avoids the need for redaction and the court itself can then determine how the information is shared between the parties.

What happens after you submit your request

We will usually aim to respond to your request within one month of acceptance, which happens once we are confident about:

• the scope of your request subject to any clarifications
• proof of identity
• proof of the lawfulness of your request if the information relates to another person or persons

Extensions to the timescale

Some cases, such as those involving large amounts of sensitive information, children’s social care data or necessitating professional involvement, are classed as complex requests. The law allows the council to complete complex requests within three months of acceptance. If we need to apply this extended timescale to your request, we will tell you prior to the original one month deadline.

If there's no response to a request after the relevant timescale has passed

Please bear in mind that the timescale for our response does not start running until we have received the required proof of ID and any required clarification from the requester as to what they require.

Before getting in touch, please review the following suggestions:

• Check your email and/or post to see if you received communication from us asking for more information. For example, if you did not send the correct ID, we will have contacted you to ask for this.
• We will correspond with you and keep you updated via the same method that you made original contact with us, unless otherwise requested and agreed. Some email systems divert the automatic case updates generated by our case management system, OneTrust, to your junk mail folder. Please check before contacting us and, if that has happened, you can set your system to accept them in future.
• Please check and see if we have asked you for further information - for example if what you are asking for was not sufficiently clear.

If you have checked and we are not waiting for ID or clarification, please check if you have had an acknowledgement email from the council. You will need to reply asking for a progress update.

Information we cannot provide

We will always aim to provide the answer to your request, but some information may be omitted or redacted (exempt) due to the requirements of the Data Protection Act.

Please note that information requests are considered on a case by case basis. If you are unsure, submit your request. If the information is exempt, our team will respond explaining why.

SARs are for information the council holds. If you need an explanation, advice or help in interpreting the information, you will need to contact the relevant part of the council or seek other support.

Vexatious or duplicated requests

We can refuse a request if:

• the request is vexatious or designed to waste time
• it repeats a previous request from the same person

Third party information

If documents contain information about another individual (a third party) we may remove or withhold this information. There are cases where we may disclose information - for example if the third party has consented.

Documents written by a third party

Some documents written by another person or organisation may be exempt. Before deciding whether this information is exempt or not, the council will consider if:

• the document contains information the requester already knows
• the requester is already likely to have a copy
• there is anything contentious in the document that is likely to cause concern if disclosed
• there are indications disclosure isn't allowed - for example, a 'confidential' label or watermark, a document having been supplied by the police or information that may have been supplied in confidence

Legally privileged information

We cannot disclose personal information where it is protected by ‘legal professional privilege’. Privilege can apply to documents created when instructing a lawyer or contain advice for use in a legal case, or in anticipation of a legal case.

Just because a document is legal in nature, or a communication with a lawyer, does not automatically make it privileged. It is something to be considered in each case.

Social work, education and serious harm

We cannot provide personal information if its disclosure is considered likely to cause serious harm to the physical or mental health of any person.

In the case of health data, this exemption only applies in the most serious of cases. We will always consult a medical professional first.

Management information

Personal data which is used to for management or planning may be exempt if releasing this information could prejudice the conduct of council business.

Adoption records

Adoption records held by the council are exempt from the subject access request right.

This means that individuals (including adopted people, birth relatives, adoptive parents and prospective adoptive parents) cannot request adoption information through a subject access request.

If you would like to gain access to your own adoption records, please contact Coram - www.coramadoption.org.uk/contact-us

Make a request

Via email

Please send details of your request along with the relevant copies of your ID to sars@bromley.gov.uk.

Via post

Please send details of your request along with copies of your ID (do not send original documents) to:

Customer Relations
London Borough of Bromley
Churchill Court
2 Westmoreland Road
Bromley
BR1 1AS

Contact us

If you haven't heard back from the council within the advised timescales, or you have a query about the response that has been provided, please contact sars@bromley.gov.uk providing as much information as possible to enable us to assist with your query.