Accessing Information

Information is everywhere. Types of information include personal information, public information, confidential information, environmental information, commercially sensitive information, and many others. For our purposes, the most important types are:

• personal information

• information held by public authorities

Personal information is information that relates to an identifiable person. Sometimes one piece of information alone might not identify someone, but if they were collected alongside other pieces of information then they could, and therefore could still be personal information. 

Personal information can be information that includes names, ID numbers, locations, or special characteristics of a person e.g. the way they look. Phone numbers, credit cards, car number plates, and addresses can all be personal data. If in doubt, treat it as personal information - if the person you are asking for the information from doesn’t think it is, they can tell you.  

The General Data Protection Regulation, more commonly referred to as “GDPR”, is a piece of European law that governs the use (and misuse) or personal information. 

The Data Protection Act 2018 is the UK legislation that made the principles of GDPR part of our law. The terms “GDPR” and “Data Protection Act” are often used interchangeably. You can use either term and people should know what you mean. It is sometimes easier to just write “data protection legislation”, and that covers all bases. 

The Information Commissioner regulates compliance with GDPR (www.ico.org.uk) 

The Data Protection Act 2018 allows you to make what is called a subject access request (often referred to as a “SAR”). You can make a SAR to find out:

• what personal information an organisation holds about you;

• how they are using it;

• who they are sharing it with; and

• where they got your data from.

How do you make a SAR?

Making a SAR is straightforward. You simply ask for the information that you need. It is better to ask in a basic way, than not ask at all. They will come back to you if they need more information, such as proof of ID.

However, if you want to write more formally, you can find a style request here - (www.ico.org.uk/for-the-public/your-right-to-get-copies-of-your-data/preparing-and-submitting-your-subject-access-request/).  

Technically a SAR can be made verbally, but follow up in an email to protect yourself in case they dispute the fact that you made it. Remember, even if you do follow up in an email, the clock will start ticking for them to reply on the day that you made the request verbally. Sometimes, the organisation will try and say it starts when they receive a follow up - if they do that, refer them to the guidance on making a SAR to show that you can make it verbally. 

Some organisations try and suggest that they don’t accept the SAR unless it is done in a certain way. For example, some people are redirected to a particular form to complete. Of course, if you are happy to do that then that is fine - it is sometimes easier for you. However, you do not have to do this. If you have already made the SAR in another way (e.g. verbally or by email), and you’ve provided any ID requested to prove your identity if they request it (they don’t always), then you have made the SAR already. They have to accept it, even if you don’t fill out the other form. 

If you have trouble with an organisation insisting that you fill out a form, refer them to the following guidance - 

www.ico.org.uk/for-the-public/your-right-to-get-copies-of-your-data/preparing-and-submitting-your-subject-access-request.

This guidance states that standard forms can sometimes make it easier for an organisation to deal with the requests. Organisations are allowed to ask you to use a particular form, but you can still choose to make your request another way. If your subject access request is not complied with simply because you didn't fill out the correct form, and the organisation refuses to change their mind when you share this guidance, then contact the Information Commissioner for advice (see Useful Links and Contacts).

How long do they have to reply?

Normally, the organisation must reply within one calendar month. For example, if you make the request on 17 February, they must reply by 17 March. 

They can decide to give themselves a 2 month extension, but they must tell you within one month that they need more time and why. If you think their reason isn’t good enough, contact the Information Commissioner for advice.

Remember, this timescale starts the day you make the SAR - if you make it verbally and then follow up in writing, or follow up with a form they ask to fill you in, then ensure they  understand that the clock starts ticking on the date of the original verbal request.