Subject Access Requests
Data Protection laws give you the right to have a copy of your personal data. This is generally known as a Subject Access Request (SAR).
How to make an effective subject access request
When making a subject access request what is most important is that we can clearly identify you, and the information you are requesting.
You may want a file from a specific service, like a copy of your benefits file, your housing file, or your social care records. You could ask for information from more than one service, or for just a small amount e.g., a copy of a number of particular documents, documents from a particular date range, or information relating to a particular event. Providing us with a detailed request will allow us to complete your request efficiently, and to achieve this, please only ask for information that you need.
The ICO recommend you give specific details of where to search for the personal data you want, for example:
- your full name, address, and contact telephone number
- any information that we use to identify you, such as a housing application number or any other unique identifiers
- details of the specific information along with relevant dates, for example:
- your housing benefit file
- emails between ‘name’ and ‘name’ between 2/8/2016 and 06/01/2018 about your complaint
- copies of statements (between 2010 and 2016) held in account number xxxxx
Other information may also help us to locate what you’re looking for, if you think that some contextual information would be useful, then please include an explanation of why you’re seeking the information.
Proof of identity needed
It is important that the council is sure of your identity before releasing information.
If you are making a request for someone else, you will need their documentation.
You will need to provide at least one document from each category:
Category 1: Proof of address
Your full address needs to be visible
- council tax bill dated within the last 3 months
- drivers licence
- bank statement dated within the last 3 months
- utility bill dated within the last 3 months
Category 2: Proof of identification
- passport
- drivers licence
- birth certificate
Requests on behalf of children
Subject access requests are often made by parents for information about their children. The Data Protection Act 2018 affords children the same rights as adults regarding access to and protection of their data. A child can request access to their data when they can understand their rights and what it means to make a request. Whilst the law in England does not specify an age at which a child is considered to have the competency to understand and exercise their rights, it does state that a child of 13 can consent to ‘information services’. Bromley uses this age as a guide for considering when a child has competency. We will need to see written and signed evidence of your appointment to act on their behalf which shows they understand the nature of the request, what information is being requested and the consequences of the disclosure. Bromley is committed to upholding the rights and freedoms of those we hold information about. As part of responsible due diligence, Bromley will take into consideration the circumstances of each request, and the level of maturity of the child including any views they may have about the disclosure before determining when disclosure is reasonable.
Requests on behalf of adults
Bromley will need to be satisfied that the person you are requesting information on behalf of has authorised you to do so. You may have the authority as their Power of Attorney, or they may have given you, their consent. Evidence of your authority to act on behalf of the Data Subject should be submitted via the webform. In cases where consent from the Data Subject has been sought, we will need to see written and signed evidence of your appointment to act on their behalf which shows they understand the nature of the request, what information is being requested and the consequences of the disclosure. We may also contact the person to discuss their disclosure with them when appropriate.
Access to deceased records
Where a request is received for access to the records of someone who has died, the person making the application should be asked to explain in writing their relationship to the deceased person, what information is needed and why. The local authority case worker should make a decision in consultation with their manager and advise the applicant in writing of the decision with reasons.
What happens after you submit your request
We will respond to your request within one month of acceptance where we need to be confident of:
-
the scope of your request subject to any clarifications
-
accepted proof of identity
- proof of the lawfulness of your request if the information related to another person or persons
If there's no response to a request after 1 calendar month
Please check your email and post to see if you received communication from us asking for more information. For example, if you did not send the correct ID we will have contacted you to ask for this.
We will contact you and keep you updated via the same method that you have made original contact, unless otherwise requested and agreed. Please note that automatic case updated generated from our case management system may be delivered to your junk mail folder. Please check before contacting us.
The response period does not start running until we have received the required proof of ID.
Please check and see if we have asked you for clarification, for example if what you are asking for was not clear.
If you have checked and we are not waiting for ID or clarification, please check if you have had an acknowledgement email from the council. You will need to reply asking for a progress update.
Information we cannot provide
We will always aim to provide the answer to your request. However, some information may be omitted or redacted (exempt) under the DPA.
Please note that information requests are considered on a case by case basis. If you are unsure, submit your request. If the information is exempt, our team will respond explaining why.
Common exemptions
We can refuse a request if:
- the request is vexatious or designed to waste time
- it repeats a previous request from the same person
Third party information
If documents contain information about another individual (a third party) we may remove or withhold this information. There are cases where we may disclose information, for example if the third party has consented.
Documents written by a third party
Some documents written by another person or organisation may be exempt. Before deciding whether this information is exempt or not, the council will consider if:
- the document contains information the requester already knows
- the requester is already likely to have a copy
- there is anything contentious in the document that is likely to cause concern if disclosed
- the document has been marked to suggest disclosure isn't allowed, for example a 'confidential' label or watermark
Legally privileged information
We cannot disclose personal information if it could be maintained in legal proceedings. This makes it ‘legal professional privilege’ (LPP).
LPP can apply to documents created on instructing a lawyer or are advice for the use in a legal case or in anticipation of a legal case.
A document being legal or a communication with a lawyer, does not make it part of LLP.
Social work, education and serious harm
We cannot provide personal information if it could harm the physical or mental condition of the requestor. This also applies to any other person involved.
In the case of health data, this exemption only applies in the most serious of cases. We will always consult a medical professional first.
Management information
Personal data which is used to for council management or planning may be exempt if releasing this information would harm the conduct of the council.
Adoption records
Adoption records held by the council are exempt from the subject access request right.
This means that individuals (including adopted people, birth relatives, adoptive parents and prospective adoptive parents) cannot request adoption information through a subject access request.
If you would like to gain access to your own adoption records, please contact Coram - www.coramadoption.org.uk/contact-us
Make a request
Via email
Please send details of your request along with copies of your ID to data.protection@bromley.gov.uk
Via post
Please send details of your request along with copies of your ID (do not send original documents) to:
Data Protection Team
London Borough of Bromley
2nd Floor Stockwell Building
Civic Centre
Stockwell Close
BR1 3UH
Contact us
If you haven't heard back from the council in the advised timescales, or you have a query about the response that has been provided, please contact data.protection@bromley.gov.uk providing as much information as possible to assist with your query.