Subject Access Request

[hanratty]

Hi

Could a subject access request be made to an individual?

Any advice would be most appreciated.

Many thanks

hanratty

[labman]

Re: Subject Access Request

Who is the individual?

[bluebottle]

Re: Subject Access Request

Hi Hanratty,

Go to Data Protection and Freedom of Information advice - ICO
which is the Information Commissioner's website.

[Bill-K]

Re: Subject Access Request

Hi Hanratty. My understanding is that if the person or firm is registered with the ICO as a Data Controller, then they are bound by law to comply with properly issued DSAR. If not registered, then they are under no such obligation.

I believe FoI requests can only be made to certain listed government or public bodies, and not to any individual.

But as BB says, check it out for sure by following the links he posted.

[labman]

Re: Subject Access Request

I think you're right Bill. I know a couple of times I've been surprised by some of the exemptions from being registered, and from some of the public bodies who can avoid FOI requests.

I was very surprised, when I phoned to register for my charity, to discover I didn't have to. It doesn't mean I don't have to abide by the Act, just that I don't have to be registered as a Data Controller.

[Bill-K]

Re: Subject Access Request

Interesting, though, Labman. Although you are not required to register as a Data Controller, you are still subject to the DPA ? This puts my posted assumptions into question - and I think this may need further investigation.

Basically - the question raised here, I think, is, "If a person or firm is NOT required to register with the ICO as a Data Controller, are they then required to comply with a DSAR ?"

Or - for that matter - are they required to comply with the DPA in general ?

[charitynjw]

Re: Subject Access Request

Even 'individuals' are subject to the DPA

s36 allows for

36 Domestic purposes.Personal data processed by an individual only for the purposes of that individual’s personal, family or household affairs (including recreational purposes) are exempt from the data protection principles and the provisions of Parts II and III.

Schedule 7 lists other exemptions
http://www.legislation.gov.uk/ukpga/1998/29/schedule/7

s38 gives the Secretary of State further discretionary powers

[labman]

Re: Subject Access Request

I guess my charity is seen as a small business, but there are exemptions for not for profit organisations. As I undoubtedly process data, I've always assumed any client could SAR us. I may be wrong.

At the end of the day for us, good practice dictates we want to exceed the requirements of the DPA anyway.

I need to investigate too as it will bug me now. :-)

[TUTTSI]

Re: Subject Access Request

If this is the case do you have to register with the ICO as a data controller?

I guess my charity is seen as a small business, but there are exemptions for not for profit organisations. As I undoubtedly process data, I've always assumed any client could SAR us. I may be wrong.

At the end of the day for us, good practice dictates we want to exceed the requirements of the DPA anyway.

I need to investigate too as it will bug me now. :-)

[ahoogah]

Re: Subject Access Request

...currently £35 a year

[labman]

Re: Subject Access Request

If this is the case do you have to register with the ICO as a data controller?

Amazingly not. I actually phoned them twice as I didn't believe the person I spoke to first time. I could register voluntarily, but when I said I'd like to do this, they advised me not to as it was a waste of money that would be better pumped into the charity.