Do I have a right to access my personal information?
Yes, you have a legal right to access personal information held about you by an organisation.
This right is protected by the Data Protection Act 1998, which deals with the rights of people to look at and have copies of information which is held about them by various organisations and agencies.
What records do I have a right to see?
You have the right to ask an organisation:
- what, if any, personal information it holds about you
- why it holds that information
- who it may be sharing your information with
- where the information came from
- for an explanation of any technical or complicated terms relating to the information
You also have the right to see the information held about you and/or to be given copies of it. This includes both computerised and paper records.
The types of organisations that might hold personal information about you include:
- social services
- the police
- your employer
- the Department for Work and Pensions
Does the organisation have to let me see all of the personal information I ask about?
Organisations must make proper efforts to find the information you have requested, although they do not have to do anything that would be unreasonable or disproportionate to the importance of providing you with the information.
This does not mean that organisations can refuse to provide the information purely because it will require a lot of work to find it or because it will be inconvenient to do so.
|What is a reasonable request?
||What is an unreasonable request?
An organisation cannot refuse your request because the information you have requested has been archived at a facility hundreds of miles away. They should have procedures in place to get this archived information.
On the other hand, if the information you have requested is contained in computerised records that have been deleted from the organisation’s system as part of its normal IT management processes, it would not be fair to expect the organisation to spend huge amounts of money employing a technical expert to try to recover the data.
What form should the information be in?
If you have requested copies of your records, the organisation must provide copies in a permanent form (for example photocopies, on a USB memory stick or on a disk) unless:
- you have agreed to the information being provided in some other way (for example, viewing it at the organisation’s offices), or
- doing so would be impossible or involve disproportionate effort. The 'disproportionate effort' exception can only be relied on in very exceptional circumstances as there will usually be an alternative – for example, inviting you to see the information at the organisation’s offices and arranging to provide photocopies of any specific information that you would like to take away with you.
If you would prefer to receive the information in a particular way (for example on an encrypted USB memory stick), it is worth saying this when asking for a copy of your records.
There are some exceptions to the duty to disclose personal information. However, if an organisation is relying on an exception to withhold your information from you, they should as far as possible explain to you why information has been withheld.
Can I request copies of information held about someone else?
You only have the right to see personal information about you, and not other people. However, if you are an attorney or have been appointed by the Court of Protection to manage the affairs of a person who lacks capacity, you should be able to access that person’s information on their behalf. You will need to provide the organisation with copies of the appropriate paperwork to show that you have the necessary authority.
Parents who have parental responsibility can also access personal information on behalf of their children, but the subject access rights are the child’s. If the child understands what it means to make a subject access request and how to interpret the information they receive as a result, the organisation would expect the subject access request to be made by the child.
What are the exceptions to the duty to disclose personal information?
Exceptions to the duty to disclose personal information include:
Third party information
If the records you have requested include information about someone else (a third party), the organisation will not have to supply the information unless:
- the other person mentioned has given their consent for the information to be disclosed
- it is reasonable for the organisation to disclose the information anyway without the other person’s consent. In these situations, the organisation has to weigh up your right to see information held about you against the other person’s right for information about them to be kept confidential.
One way around this problem may be for the organisation to redact information that would identify the third party.
A health record is any record of information relating to someone’s physical or mental health that has been made by or on behalf of a health professional.
This includes records made by:
- hospital doctors
You have the right to see your health records except where disclosure would be likely to cause serious harm to your mental or physical health or that of another person. An organisation can only use this as a justification for non-disclosure after assessing how likely it is that this information would cause you or another person serious harm. This would usually involve consulting with the health professional responsible for the clinical care of you or the person the organisation is concerned about. There is guidance on how to access medical records on the NHS Choices website.
Social services records
You have the right to see and have copies of the information held about you by social services. However, social services can refuse to disclose information if doing so would prejudice the carrying out of social work by causing serious harm to the mental or physical health of you or any other person.