1.6.2 Access to Records |
Contents
1. General
1.1 Introduction
The Data Protection Act 1998 allows individuals (“subjects”) a general right of access to find out what information the London Borough of Lewisham holds about them in either electronic or manual form. This is commonly known as the right of subject access and is provided by s.7, DPA 1998.
It is acknowledged that persons, now of adult age and who had previously been receiving a service, or had been in care, may request access to their files in order to help their understanding of their childhood.
The following document outlines the procedures to be followed by those staff employed by the London Borough of Lewisham when dealing with subject access requests concerning children’s social care records.
This document should be read in conjunction with the following documents:
- London Borough of Lewisham Data Protection Policy
- Access to Care Records Policy
- The Data Protection Act 1998
1.2 Basic Legislative Requirements
A subject has the right to be given by the data controller a description of –
- the personal data of which that individual is the data subject,
- the purposes for which the data are being or are to be processed, and
- the recipients or classes of recipients to whom the data are or may be disclosed
A subject also has the right to have communicated to him in an intelligible form:
- the information constituting any personal data (of that individual), and
- any information as to the source of the data
The subject access request should be completed not more than 40 calendar days from the date the data controller has receipt of all the information necessary to complete the request.
The request must be submitted in writing and must be accompanied by the requisite fee.
The data controller must be satisfied as to the identity of the subject (or the subjects agent) before processing the request.
1.3 Capacity
Requests made on behalf of an adult
Subject access requests may be made on behalf of an adult (e.g. by a solicitor or agent). In such cases, the data controller must satisfy themselves that the subject has authorised the application and that both the agents identity and that of the subject is verified in the normal way.
Note: Where the information was provided by the data subject in the expectation that it would not be disclosed to the person making the request on their behalf such data should not be disclosed.
Children and mentally incapacitated adults
- Children
Where requests are received from children the data controller must be satisfied that the child understands the nature and purpose of any application. If so, the child may exercise the right on the same basis as an adult. In addition, a parent or legal guardian may also make the request on behalf of the child and receive any response accordingly.
Note: Where the information was provided by the data subject in the expectation that it would not be disclosed to the person making the request on their behalf such data should not be disclosed. - Adults without capacity
here an adult is incapable of making a request due to mental incapacity, an agent acting pursuant to an enduring power of attorney or otherwise appointed by the Court of Protection may make the request on their behalf.
Note: Where the information was provided by the data subject in the expectation that it would not be disclosed to the person making the request on their behalf such data should not be disclosed.
Advice and assistance
In all cases, where a person may need additional assistance to make their request (e.g. where a person is dyslexic or have some other disability) necessary and proportionate assistance should be offered. (The standard rules remain in so far as the fee must be taken and the data controller must be satisfied as to the applicants identity.)
2. Administrative Requirements
2.1 Fees
Charges
A fee of £10 is charged for all subject access requests.
The fee is payable to the London Borough of Lewisham and may be paid by either cheque, postal order or in person at council offices. The fee cannot, at present, be collected on-line.
Fee waiver
The fee may only be waived where the request has not been dealt with under the terms of the Act (e.g. outside the time limit for compliance) and, where, in the opinion of the manager of the service, waiving the fee is a proportionate and necessary measure. Waiver of the fee is discretionary.
Where a fee is waived the payment, if not yet processed, should either be returned to the applicant or destroyed accompanied by an explanatory letter. In the event that the fee has been processed, please refer to Appendix D for details about processing refunds.
2.2 Scope and clarity of the request
All formal requests for information should be submitted on form AR1.
Where an initial request is received by the council (at any location or via the website), in the first instance, a AR1 form together with an acknowledgement letter should be sent to the applicant for completion.
A completed form should state the nature and extent of the subject access request. The data controller is not obliged to comply with any request unless they are reasonably satisfied that they can locate the information requested and that the scope and extent of the request is clear. In the event that the request is not sufficiently clear or the data controller cannot, for whatever reason, process the request due the nature of the completed form, an attempt should be made by the data controller to notify the applicant at the earliest opportunity.
If, having notified the applicant of any aspect preventing the processing of the request, no response is received within one calendar month, the request will lapse and any fee should be destroyed.
2.3 Open (live) files
Where a file is open or “live” a subjects rights remain the same.
However, greater care is required and the social worker responsible for the individual concerned should liaise with the records officer.
The files should be prepared by the social worker in concert with the records officer. Files are considered open for up to six months from the date after which an individual no longer receives a service.
2.4 Adoption Records
A separate right of access exists in respect of adoption records.
Where a request is received for adoption records the request should be passed to the adoption team.
Where it is evident a clients file is made up of both care records and adoption records the adoption team deal with the whole request.
2.5 Multi-aspect or cross-directorate requests
It is possible that a person may request files from a number of sources or directorates and which may include files of a different nature and type to those dealt with by Registry.
Where a request is received that affects more than one service unit or business area the records officer should inform the directorate concerned. (The AR1 form should be sufficiently clear enough to enable the records officer to forward the request or parts of the request to the relevant business area(s), as required.)
3. Communication of the Information
3.1 General
An applicant has the right to have personal data of which he is the data subject communicated to him in an intelligible form.
3.2 Viewing files
Unless a person has expressly stated that they do not wish to do so, all applicants will be invited to view their files with the records officer or a social worker. A suitable time should be arranged in writing within the 40 calendar days permitted under the Act. If an applicant is unable to view files at the time offered an alternative time may be suggested. If the alternative date/time is outside the 40 day limit, the request will be taken as complied with.
A copy of the data should be provided in the preferred medium stated.
3.3 Applicants who have relocated
Where applicants are no longer resident in the Borough, usually having moved sufficiently far away so that they are unable to view files in person, a copy of their subject access file processed for the purposes of their request should be sent to their home address, unless requested otherwise, or circumstances dictate otherwise.
3.4 Applicants who do not wish to view files
There may be occasions where an applicant is either unable to view their files personally or, for whatever reason, does not wish to view their files at council offices or in concert with a council officer.
In such cases a copy of the files subject to the request should be sent to the applicant in the preferred medium stated. We reserve the right to make appropriate charges for disbursements in this case.
3.5 Posting of files
Copies of files that are sent to either other receiving authorities or applicants should be done so via courier, recorded delivery or other secure means.
4. Closure of the Request
4.1 Date of close
For the purposes of final closure, the date of close will be taken as the date on which the files are viewed by the applicant or, if not viewed, the date of posting to the applicant.
4.2 Retention and disposal of records
Stage 1
Both full and redacted files will be retained with the records team for 2 months from the date of close.
Stage 2
At 2 months - completion of form AR10
Return original hard copy files to registry
Stage 3
Any copies of files that were subject to the request including the redacted version (paper and electronic) should be retained by the records team for 2 years after which ALL copies of files should be disposed of in an appropriate secure way.
5. Repeated or Similar Requests
5.1 Closed records
Applicants applying for closed records may not submit a further subject access request of the same until a period of 2 years has elapsed from the date of the release of information that comprised the first request. This includes any request where the substantive data is similar or virtually identical as a previous request.
After 2 years has elapsed an applicant may submit another request notwithstanding whether the request is identical in terms of the information received.
5.2 Open records
Applicants who have applied for open records may submit further requests of the same where a reasonable time has elapsed and the data has changed. In this type of case the 2 year rule does not apply.
6. Information Lost or Misplaced by the Applicant within 2 years
If a client loses information which has been the subject of a request within 2 years of receipt they may apply to the records team for an identical copy of that previously provided. Provision of this information may be subject to disbursements.
Appendix A - Assessment of the Data - Confidentiality and Third-Party Data
General
In accordance with the Data Protection principles information about a third party should not usually be disclosed to the applicant without the prior consent of the third party.
Third-party personal data may, however, be disclosed where “it is reasonable in all the circumstances to comply with the request without the consent of the other individual” (see s.7 (4)(b), DPA 1998).
In determining whether to release third-party personal data regard must be had to the following factors:
- any duty of confidentiality owed to the other individual
- any steps taken by the data controller with a view to seeking the consent of the other individual
- whether the other individual is capable of giving consent
- whether there has been any express refusal of consent by the other individual.
Seeking consent from third-parties
Third-party data that is identified as either not relevant or not related to the applicants care history should be removed.
Where there is third-party personal data related to the applicants care history this should be identified and the third-party should be contacted with a view to seeking consent. The applicant should be contacted in order to seek their consent before contacting the third party.
Where consent cannot be sought despite attempts being made to do so the supervisor or manager should decide whether or not to make the disclosure based on the factors outlined above (at point 1).
Third Party information that may be disclosed may inform the care adult of family members they previously had no knowledge of and they may wish to trace. Information which may help in this process may also be made available.
Confidentiality
In the case of open (live) files, persons providing information, opinions (whether subjectively or objectively considered) or other data should be aware that such information may, at some future point, become the subject of a subject access request. Where a person wishes that information remains confidential they should state this from the outset.
It should be noted, however, that information regarded as confidential at the time of writing or submission may not in fact be considered as confidential at the time a request is received to view it. In all cases an assessment of both the information and any duty of confidentiality owed will take place at the time the request is received.
Children and Parents
The interests of parents and children may well conflict. A child may not therefore wish their parents to see the records and under the Child Care Act 1980 (Section 18), the local authority has a legal duty to ascertain the wishes of the child in matters which may have an impact on his/her life.
Protecting the Subject
Risk of serious harm
The Data Protection (Subject Access Modification) (Social Work) Order 2000 states the following:
“ 5. - (1) Personal data to which this Order applies by virtue of paragraph 1 of the Schedule are exempt from the obligations in section 7(1)(b) to (d) of the Act in any case to the extent to which the application of those provisions would be likely to prejudice the carrying out of social work by reason of the fact that serious harm to the physical or mental health or condition of the data subject or any other person would be likely to be caused.”
General
There may be some circumstances where a person would be harmed by known facts about him/herself, even when such facts are presented in the most sensitive manner. It will, of course, be the aim of the worker to enable people to come to terms with these facts, but timing will often be a crucial factor and prolonged counselling may be necessary to delay access or in very rare instances permanently to deny this. Such a decision should be made by the relevant service unit manager in consultation with the worker and their supervisor.
Open Files
It is suggested that the section has greater applicability to open files as it is stated that the disclosure must not only be likely to cause serious harm to a person but ALSO must prejudice the carrying out of social work. Thus, it is probable (although not certain) that in the case of open (live) files where there is harm likely to be caused to an individual there would also be prejudice to the carrying out of social work. Each case should be assessed on its own merits.
Closed Files
In the case of closed files, there is a greater presumption that disclosure, where the risk of causing serious harm is likely, would nevertheless be less likely to prejudice the carrying out of social work by virtue of the fact that the data subject is no longer receiving a service or has left care and no longer relies on the support of social services. Each case should be assessed on its own merits.
Emotional sensitivity
Where it is felt that to share information with the care adult in it's original, unannotated form would result in anxiety and/or deep emotional instability and upset then a summary of any relevant information will be prepared so that full access to information may be shared. However, when doing so, care must be taken not to alter any of the personal data contained in the original document. Only that information which supports or adds to the personal data in order to add context, circumstances or narrative may be summarised.
In all cases, where a summary is considered desirable the service manager (and/or social worker where the file is open) should be consulted.
Other exemptions contained within the Data protection Act 1998
Staff processing subject access requests should familiarise themselves with all the exemptions contained in the Data Protection Act 1998.
Appendix B - Complaints and Appeals
If the individual considers that all or part of the information is inaccurate or missing the individual should first discuss it with the records officer or social worker who arranged the access, who will make all efforts to address this issue satisfactorily.
If the applicant remains dissatisfied they may contact the complaints department in writing outlining the reasons why.
If the applicant is dissatisfied with the access to records process in any way, they should raise this with the access to records officer, social worker, and/or line manager in the first instance. If they remain dissatisfied they may contact the complaints department. Pursuant to s.42 DPA, a person who believes himself to be directly affected by any processing of personal data also has the right to make a request to the Information Commissioner for an assessment as to whether it is likely or unlikely that the processing has been or is being carried out in compliance with the Act.
In this instance requests should be made in writing to:
The Information Commissioners Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
End