Subject Access Request

[RGG]

Subject Access Request

Does anyone at either end of the process have an understanding or experience of the following -

If a SAR is made and the organisation is understood to have passed on “personal information” to another / other organisations : does that mean that the SAR response should include a list of those “3rd party” organisations and / or the Information that was passed over to them?

Edited by RGG on Sunday 13th October 15:28

[Mrr T]

RGG said:

Subject Access Request

Does anyone at either end of the process have an understanding or experience of the following -

If a SAR is made and the organisation is understood to have passed on “personal information” to another / other organisations : does that mean that the SAR response should include a list of those “3rd party” organisations and / or the Information that was passed over to them?

Edited by RGG on Sunday 13th October 15:28

Not an expert but.

https://ico.org.uk/for-the-public/getting-copies-o...

Suggests you should set out what information you require. Have you requested details of who your data was passed to?

[RGG]

Mrr T said:

RGG said:

Subject Access Request

Does anyone at either end of the process have an understanding or experience of the following -

If a SAR is made and the organisation is understood to have passed on “personal information” to another / other organisations : does that mean that the SAR response should include a list of those “3rd party” organisations and / or the Information that was passed over to them?

Edited by RGG on Sunday 13th October 15:28

Not an expert but.

https://ico.org.uk/for-the-public/getting-copies-o...

Suggests you should set out what information you require. Have you requested details of who your data was passed to?

Yes, thanks for that.

I looked through their site and it all looks so free and easy - the request, the delivery.

It's the NHS I'm trying to engage with and to date they've been trying everything to avoid releasing any information at any level meaning very low level stuff.

So I'm wary of making an application that from my point of view results in further resistance and another delay.

[Simpo Two]

Hire Mr Bates!

[pavarotti1980]

RGG said:

Yes, thanks for that.

I looked through their site and it all looks so free and easy - the request, the delivery.

It's the NHS I'm trying to engage with and to date they've been trying everything to avoid releasing any information at any level meaning very low level stuff.

So I'm wary of making an application that from my point of view results in further resistance and another delay.

Most if not all NHS Trusts will have a small team responsible for disclosures such as SARs. FOI request etc. They should have a web based form or page on the their website dedicated to such matters. They have statutory time limits attached (1 calendar month) to requests whereas adhoc dialogue does not. Some trusts have an online portal whereby you can make the request, which will be verified with ID checks etc and the data is available on the portal.

[mikef]

pavarotti1980 said:

They have statutory time limits attached (1 calendar month) to requests whereas adhoc dialogue does not.

Just to be aware that’s a month to respond, not necessarily to provide any information you request (can can be longer than a month for complex requests)

The response can be to ask you to provide copies of ID, so they are not releasing information to a n other (and from experience, around 90% of SAR requests are dropped at that point)

[ambuletz]

RGG said:

Yes, thanks for that.

I looked through their site and it all looks so free and easy - the request, the delivery.

It's the NHS I'm trying to engage with and to date they've been trying everything to avoid releasing any information at any level meaning very low level stuff.

So I'm wary of making an application that from my point of view results in further resistance and another delay.

Most will try and discourage a SAR in favour of asking what the issue is because

- a SAR costs money and it takes time to compile
- they have up to a month to send you the SAR,
- depending on the issue, it could be resolved sooner.
- ontop of that you might not need EVERY piece of information.

[pavarotti1980]

mikef said:

Just to be aware that’s a month to respond, not necessarily to provide any information you request (can can be longer than a month for complex requests)

The response can be to ask you to provide copies of ID, so they are not releasing information to a n other (and from experience, around 90% of SAR requests are dropped at that point)

I'm well aware of the rules. My team provide data for SARs and FOIs in my NHS Trust

They have a month to respond to the request unless they require further information (such as ID checks) in which case the clock stops and restarts upon receipt of the further information required. If the request is to take longer than a month upon first contact they have to give you the expected time scale within the initial month response period. That is why NHS trusts sometimes have portals so you provide the request and ID at the same time to make the process more efficient. Same for FOIs although that is 20 working days not 1 month.

[RGG]

pavarotti1980 said:

mikef said:

Just to be aware that’s a month to respond, not necessarily to provide any information you request (can can be longer than a month for complex requests)

The response can be to ask you to provide copies of ID, so they are not releasing information to a n other (and from experience, around 90% of SAR requests are dropped at that point)

I'm well aware of the rules. My team provide data for SARs and FOIs in my NHS Trust

They have a month to respond to the request unless they require further information (such as ID checks) in which case the clock stops and restarts upon receipt of the further information required. If the request is to take longer than a month upon first contact they have to give you the expected time scale within the initial month response period. That is why NHS trusts sometimes have portals so you provide the request and ID at the same time to make the process more efficient. Same for FOIs although that is 20 working days not 1 month.

To add a bit more info, I applied way back around 2000: after hearing nothing for around over 150 days (I recall) wrote to the chief executive and even then didn't receive around half of the obvious info. So, had to press more assertively with the associated further delay.

I did set out my request to simply receive "all" information and now wonder if that "freaked" them or maybe not; I don't know.

I hesitated and am now hesitating again to provide a list of requested sources/departments because I think they will have relevant information that ends up not being released because I didn't specifically ask for it.

Another way of trying to explain this is that not being a part of the organisation means that I don't know where "all" of my information will be held.

I hope that dilemma has been explained clearly enough and if anyone can help me out with this more specific I would be very grateful .

[RGG]

ambuletz said:

RGG said:

Yes, thanks for that.

I looked through their site and it all looks so free and easy - the request, the delivery.

It's the NHS I'm trying to engage with and to date they've been trying everything to avoid releasing any information at any level meaning very low level stuff.

So I'm wary of making an application that from my point of view results in further resistance and another delay.

Most will try and discourage a SAR in favour of asking what the issue is because

- a SAR costs money and it takes time to compile
- they have up to a month to send you the SAR,
- depending on the issue, it could be resolved sooner.
- ontop of that you might not need EVERY piece of information.

To add a bit more info, I applied way back around 2000: after hearing nothing for around over 150 days (I recall) wrote to the chief executive and even then didn't receive around half of the obvious info. So, had to press more assertively with the associated further delay.

I did set out my request to simply receive "all" information and now wonder if that "freaked" them or maybe not; I don't know.

I hesitated and am now hesitating again to provide a list of requested sources/departments because I think they will have relevant information that ends up not being released because I didn't specifically ask for it.

Another way of trying to explain this is that not being a part of the organisation means that I don't know where "all" of my information will be held.

I hope that dilemma has been explained clearly enough and if anyone can help me out with this more specific I would be very grateful .

[pavarotti1980]

RGG said:

To add a bit more info, I applied way back around 2000: after hearing nothing for around over 150 days (I recall) wrote to the chief executive and even then didn't receive around half of the obvious info. So, had to press more assertively with the associated further delay.

I did set out my request to simply receive "all" information and now wonder if that "freaked" them or maybe not; I don't know.

I hesitated and am now hesitating again to provide a list of requested sources/departments because I think they will have relevant information that ends up not being released because I didn't specifically ask for it.

Another way of trying to explain this is that not being a part of the organisation means that I don't know where "all" of my information will be held.

I hope that dilemma has been explained clearly enough and if anyone can help me out with this more specific I would be very grateful .

To be honest a huge amount of data will be electronic so just leave it as everything. It may be they cant provide everything but you should get the majority

[RGG]

pavarotti1980 said:

RGG said:

To add a bit more info, I applied way back around 2000: after hearing nothing for around over 150 days (I recall) wrote to the chief executive and even then didn't receive around half of the obvious info. So, had to press more assertively with the associated further delay.

I did set out my request to simply receive "all" information and now wonder if that "freaked" them or maybe not; I don't know.

I hesitated and am now hesitating again to provide a list of requested sources/departments because I think they will have relevant information that ends up not being released because I didn't specifically ask for it.

Another way of trying to explain this is that not being a part of the organisation means that I don't know where "all" of my information will be held.

I hope that dilemma has been explained clearly enough and if anyone can help me out with this more specific I would be very grateful .

To be honest a huge amount of data will be electronic so just leave it as everything. It may be they cant provide everything but you should get the majority

Thanks for taking the time to open up the picture away from my own position.

[BertBert]

pavarotti1980 said:

To be honest a huge amount of data will be electronic so just leave it as everything. It may be they cant provide everything but you should get the majority

Would it not be the case that the more specific you are the better? With many systems some departmental some Trust wide, the less work the Trust has to do to get the required info, the easier it will be? Presumably the info has to be vetted and potentially redacted as well.

[pavarotti1980]

BertBert said:

Would it not be the case that the more specific you are the better? With many systems some departmental some Trust wide, the less work the Trust has to do to get the required info, the easier it will be? Presumably the info has to be vetted and potentially redacted as well.

You can be more specific but a lot of systems have the majority of data in one place. For example biochemistry, notes, letters and drug administration are in one system for us