Subject access request

A subject access request (SAR) is a request under the Data Protection Act 2018 (DPA) from a person for a copy of the personal information that is held about them.

Personal information can take a number of forms such as paper, electronic, CCTV footage, a picture or even an audio recording. It can include facts and information about an individual and also include views or opinion of others about the individual.

The act entitles the individual to receive:

  • a description of the data
  • an explanation of why the data is being held
  • an explanation of who the data may be given to
  • a copy of the data with any technical terms explained
  • an explanation as to the source of the data,
  • an explanation as to how (if any) automated decisions taken about them have been made.

How to make a subject access request (SAR) for someone else

You can make a subject access request (SAR) on someone else's behalf only if:

  • You have their written permission to do so, or
  • They are your child and are too young to make the request themselves, (please bear in mind that a child is, in theory, entitled to a make their own subject access request. Where it is felt that the child is of a sufficient age and maturity to understand the nature of the request, we may need to contact the child to discuss the request and ensure they are happy for the request to proceed) or
  • You have a power of attorney for the person concerned, or
  • You have a court order authorising you to make the request

If none of the above apply you are unlikely to be able to make a SAR on their behalf.

How to make a subject access request (SAR)

You don't have to mention the Data Protection Act or a subject access request (SAR) for it to be a valid request.

Any request for personal information held by the council about that person is a SAR and we will deal with straightforward requests as business as usual as long as we are sure of your identity.

So if you're dealing with a council officer over an issue you can usually ask them for your personal information about that issue, for example: by email or letter.

If you're not currently dealing with the council or want to ask for wider information (such as: all my council tax records, anything the planning team hold about me, the social work files about my youngest son) then we recommend that you

Apply using our subject access request pack

You will need to provide proof of your identify. Acceptable types of identification are detailed in the Request Form

Proof of ID

It is important that the council is sure of your identity before releasing information. The ID that you will need to provide is set out in the SAR request form.

You will need a photocopy of one of these:

  • passport
  • driving licence
  • birth certificate

And a copy of one of these:

  • a recent bank statement (with full address) dated within the last 3 months or
  • a recent utility statement (with full address) dated within the last 3 months or
  • Barnet council tax number

If you're acting on behalf of the Data Subject you are still required to provide the above documentation on their behalf.

Requests are free of charge

There is no charge for making a request.

How you will get the information

We will send the information in the most appropriate way, depending on how much there is and how sensitive it is. If possible we will send by email (encrypted if necessary). Otherwise we will send by recorded or special delivery. You may be able to arrange to come to the council offices at Colindale to collect the information.

If there's no response to a request after 1 calendar month

Please check your email and post to see if you received a letter from us asking for more information. For example if you did not send the correct ID we will have contacted you to ask for this. The time to comply does not start running until we have received the required proof of ID fee. Please check and see if we have asked you for clarification, for example if what you are asking for was not clear.

If you have checked and we are not waiting to hear from you with ID or to clarify then:

  • If you have had an acknowledgement email from the council contact the person who sent it to ask them for a progress update.
  • If you haven't heard back from the council at all, please contact data.protection@barnet.gov.uk with as much information as possible and we will look into it for you.

Exemptions that might apply to the information you can get

The council will send you information within the scope of your request. However the council is allowed under the Data Protection Act 2018 to withhold (redact) certain information in some circumstances. The council will only do this where an exemption applies. We have summarised the common exemptions below.

Common exemptions

Exemption

Brief outline

Documents containing information about another person (third party)

Where information relates to another individual (a third party) as well as the person making the request, the information about the person requesting will not be released if doing so will mean that information relating to the third party would be disclosed. The exceptions to this are where:

  • the third party has consented to the disclosure, or

  • it is reasonable in all the circumstances to disclose the information without that individuals consent.

In deciding whether it may be reasonable to disclose the following will be considered:

a) any duty of confidentiality owed to the third party
b) whether the council feels it is necessary to seek consent of the third party
c) whether the third party is capable of giving consent
d) any express refusal of consent by the third party.

The council will also consider whether the information in question is already known to the individual, or whether it is possible to undertake a partial redaction allowing us to disclose the information without identifying the third party.

Documents written by another person (third party)

Where a document is written by another person or organisation these are not automatically exempt.

Whilst the council is allowed to seek a view from the author of the document, it is the Councils decision whether to disclose or not. Before applying this exemption the council will take the following into account:

  • Does the document contain information already known to the requester?
  • Is it likely the requester would have already received a copy?
  • Is there anything contentious in the document that is likely to cause concern if disclosed?
  • Has that document been marked in any way to indicate that disclosure is not allowed?

Legally privileged information

Personal data is exempt if it consists of information for which legal professional privilege (LPP) could be maintained in legal proceedings. The LPP exemption is fairly narrow and cannot be applied to all legal documentation.

The actual content of the information is important when considering whether LPP applies as just the mere fact that it is a communication with a lawyer / solicitor does not make the document legally privileged.

LPP can be applied to documents created on instructing a lawyer or as a result of advice being given for the use in a legal case or in anticipation of a legal case.

Social work

Social work data is exempt where granting a subject access request would be likely to prejudice the carrying out of social work by virtue of resultant serious harm to the physical or mental condition of the data subject or any other person.

Serious harm to physical or mental health or condition

Health data is exempt where granting a subject access request would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person.


This exemption only applies in the most serious cases and can only be used in consultation with an appropriate medical professional.

Management information

Personal data processed for the purposes of management forecasting or planning is exempt where disclosure would be likely to prejudice the conduct of that business or other activity of the council.

Educational records

Certain educational data is exempt where:

  • disclosure would cause serious harm to the physical or mental health of the data subject or another person, or

  • a parent (or someone with parental responsibility) or court appointee makes a request on behalf of a data subject, and the data consist of information as to actual or potential child abuse and such compliance would not be in the interests of the data subject.

Adoption records

Adoption records held by the council are exempt from the subject access provisions.
This exemption means that individuals (including adopted people, birth relatives, adoptive parents and prospective adoptive parents) are not able to use the route of subject access to obtain information of this nature. It would be a breach of the DPA to allow such access under a SAR.

There are special procedures for individuals to gain access to their adoption records. Due to the nature of the information it will involve appropriate counselling of the individual and more considered approach to obtaining the data, ensuring the individual is helped through the process.

Make a SAR when your information is held by a service that the council has outsourced

Although some services are being delivered in other ways such as by a commercial partner such as council tax or in a joint venture for example planning and environmental health, or by a shared service (e.g. legal services) the council remains the 'data controller' for the personal information. The council has ensured that this is covered fully in the contracts we have with the delivery units.

You can make the SAR to the outsourced or partner organisation (such as council tax or planning) and they will pass it to the council to be logged and processed. However, it is better to make the SAR directly to the council.

If you're not happy with how your SAR was handled

If you'd like to ask for a review of how your SAR was handled please email the Data Protection Officer at data.protection@barnet.gov.uk explaining clearly and concisely why you are unhappy. We will review the SAR and your concerns and then write to you with our findings.

If you have already had a review and are still dissatisfied, you can complain to the Information Commissioners Office:

casework@ico.org.uk
Information Commissioner's Office
Wycliffe House
Water Lane Wilmslow Cheshire SK9 5AF
Tel: 0303 123 1113 (local rate)