What happens when someone asks to know what data your organisation is holding about them?
In this latest blog our GDPR expert, Karen heaton, looks at what to do if you receive a Subject Access Request.
In our blog today, we look at a data subject’s right to access, a powerful tool for individuals who have concerns about what information organisations hold about them. Unfortunately, it can also be used for litigious purposes and such a request should be taken very seriously within your organisation, so please read on!
A data subject, in other words, you or I, can request a free copy of all personal data relating to us that an organisation holds – in any format – paper files, digital, videos or voice records.
Ok, do I have your attention now? Even for a small organisation, that can amount to a lot of data.
Oh, and you have one calendar month to respond.
So, what must you provide and what is exempt? Well, let’s see…
You must provide the following long list of information in relation to the personal data being processed as well as the data themselves:
I have a question or two:
This is not a simple task and can amount to an operational headache for many organisations.
The most common type of data that should be withheld is data mentioning third parties (unless they have given consent for their data to be shared or it is reasonable not to require such consent – confused?). For example, an email chain where people other than the data subject are mentioned would need to be considered for redacting. How easy can your organisation find, review and redact third party information?
Other examples of exempted information:
Often, my clients have concerns that some law firms may use SARs to obtain medical data for free that was previously chargeable.
Requests from Solicitors acting on behalf of a Patient
The British Medical Association advises that a patient can authorise their solicitor, or another third party, to make a SAR on their behalf. There are very few circumstances when a medical practise will be able to lawfully decline such requests.
In this instance, you should ask the person acting on their behalf, if there is specific data that they require, for example are they requesting data covering a specific time period or illness or operation? This is a valid question for you to ask if the patient data file is substantial.
Tip: Don’t forget to get valid consent from the patient to disclose their personal and sensitive data to the Solicitor or third party.
If, however, the request is asking for a report to be written or it is asking for an interpretation of information within the record this request goes beyond a SAR. It is likely that such requests will fall under the Access to Medical Reports Act 1988, for which a fee may be charged.
Requests from an Insurance company
The British Medical Association, ICO and Association of British Insurers currently advise that Insurance companies should use the provisions of the Access to Medical Reports Act 1988 to seek access to medical records and that the use of SARs to obtain medical information for life assurance purposes is an abuse of subject access rights.
So, that scenario is a bit more clear cut. 😊
Your organisation or medical practise must take the time to consider and plan how to respond to a Subject Access Request from an operational perspective. Don’t wait until you receive one to work out how it should be done. The clock starts ticking from the day you receive the request.
Today’s fact. Access to your data is a basic Right under GDPR and Data Protection Act 2018. A data subject can make a complaint to the ICO if an organisation fails to respond to a Subject Access Request.
Further failures to respond to requests from the ICO and any Enforcement Notice they serve, is a criminal offence.
=> This is worst case scenario and easily avoided. Ensure you have a robust operating procedure to handle Subject Access Requests and train your staff in how to respond, when to respond and what information to provide.
See you next week!
We don’t believe in forms, we believe in talking to people, finding out your needs and tailor-making a solution just for you.
Give us a ring on 020 7125 0270 or email us at info@bluedotconsulting.co.uk
“Michael and the Blue Dot team have been an essential part of our journey from startup through to being an established company, and we look forward to continuing working together long into the future. They have always been on hand to offer support and sound advice whenever it is needed.”
“Blue Dot have been our accountants and bookkeepers since the very beginning of our business, and have been nothing short of outstanding throughout.”
“Blue Dot Consulting went above and beyond in helping us navigate not only the transition to cloud-based accounting but also in leading our accounts team through a broader period of transformation.
Their deep understanding of our unique needs and challenges was evident from the outset. They provided unwavering support to our team, ensuring they felt confident and well-prepared for the changes ahead.”
“Thank you again for your help and training so far – it’s honestly been invaluable.”
“I’m no expert but it has been transformative the help and advice I get from Michael and his team.
Michael was fantastic. He quizzed me on how my business worked financially and was super patient with me. Explaining everything in a non-accountancy manner. He then showed me how to utilise all the less obvious tools in the program, which he continues to do, so that I can see immediately what monies held belonged to my company and what is held for clients. I now do my own VAT returns and payroll because of his help and continued support.”
“I really enjoy working with Blue Dot Consulting — they’ve helped me take control of our financial situation in a practical, no-nonsense way.
They take a common-sense approach and, most importantly, they get things done. For example, we now have weekly planning and forecasting calls, along with monthly cash flow reviews using simple, easy-to-understand spreadsheets.
Their support has made a huge difference in how we manage and plan for the future.”
“As the business owner, it can get lonely making all the decisions. I feel I have a ‘silent FD’ that I can call, challenge and that any idea is OK to discuss, and to arrive at a sensible way forward.”
“Having someone in the room that is happy to (in a structured way) challenge the norm and not simply accept that, because things look good, we should stop looking to improve.”
“Blue Dot are uncompromisingly systematic and thorough so that you can get on with running your business.”
“Outstanding service and support. They get things done, just what you need. Recommended.”
“It was the genuine level of care and interest in what we do as a business.
The regular check-ins and the effort to ensure the systems they’ve implemented are working for everyone stood out.
It felt like more than just a service, it was a partnership.”
“I’ve been delighted with both the service and expert advice I’ve received from Michael and his team. They take the weight off my shoulders when it comes to my business’s financial requirements, allowing me to focus on building and managing the company.”
“We are a small organisation with no in-house financial expertise, so it’s a huge weight off my mind knowing that I can rely on Michael and his team to take care of everything.”
“I can wholeheartedly and highly recommend Michael and his team at Blue Dot as an exceptional accounting firm. They put my mind at rest knowing I am in excellent hands.”
“Michael and the team are my saviours. Always helpful, approachable and reliable. They show an interest in my business and give excellent advice and recommendations. Above all, they are highly likeable and fun to work with.”
“They went above and beyond in helping us navigate not only the transition to cloud-based accounting but also in leading our accounts team through a broader period of transformation.”
“You guys are brilliant. It’s been a challenging few weeks facing up to the issues but I do feel positive towards them now and I feel a weight has lifted from my shoulders. I am honestly so thankful!”
“I was a little apprehensive about working with a new accountant but I didn’t need to worry – I have found their approach to be friendly, genuine and they go above & beyond to help.”
“Michael’s straightforward, practical and tailor-made approach was perfect for me and our business.”
“Blue Dot have been our accountants and bookkeepers since the very beginning of our business, and have been nothing short of outstanding throughout.”
