Data Subject Access Request (DSAR) Policy

You have a right to request a copy of information that the Council holds about you. This is known as a Data Subject Access Request (or DSAR).

The Data Protection Act 2018 gives you a right to see a copy of the information an organisation holds about you. However, the right of access goes further than this and an individual who makes a request is entitled to be:

• told whether any personal data is being processed (whether the Council is using or holding information)
• told what personal information we hold about you, why we hold it, how we use it and who, if anyone, we may share it with
• given a copy of the information and details of where the information came from (where this is available)

This policy provides you with the information you need to make a request for your personal information. If you need any further information, please contact the Information Governance Team.

While you do not have to submit a request in writing, it is helpful if you do so that we receive all the information we need to be able to respond. All requests should be directed to the Information Governance Team.

You will be asked to provide the following information:

• any names by which you have been known, your address and date of birth
• a description of the information required - the more information you provide the better so that the information you require can be easily located and extracted
• if you were at some point a child in the care of the Council, please provide as much information as possible,including any dates this relates to and names and addresses of foster carers or placements if you have them
• evidence of identity - preferably a current form of photographic identification such as a driving licence or passport. If you do not have photographic ID, a recent proof of address or utility bill (within three months) will be acceptable
• if the request is on behalf of another person, any names by which the subject has been known, their address and date of birth
• if the request is on behalf of another person, their consent for the information to be shared or evidence of why consent is not required (capacity assessment, proof of parental responsibility, Power of Attorney etc.)

• if the request relates to someone else's information who has passed away, evidence that you have the authority to request the information (proof that you are executor of their estate, Power of Attorney etc.)

Please tell us any additional support you will need to access the records so this can be discussed at the earliest opportunity.

To support your request you can submit an online DSAR form, however we do not insist on its use.

Requests will be acknowledged and you will be given a reference number which should be used for any future contact. If we require further information from you (e.g. photographic ID), we will contact you within three working days to request this.

The timescale for responding to a request is one calendar month which will only begin once all the relevant information (as outlined above) has been received. If a request is received on 3 September, the time limit will start from the next day (4 September) and the information should be made available no later than 4 October. This deadline can be extended by a further two calendar months if your request is complex or you have made more than one request. We will tell you as soon as possible if we are applying the extension. The more specific you are about the information you want to access, the more focused our searches for information can be. This helps us to respond to requests in a timely way.

The following will be considered to identify if the extension to timescale will be applied:

• the scope of the request is for information held across more than one service area or information is held in more than one location
• the request includes information which is held by a third party who the Council commission to provide a service
• the timeframe covered is greater than one year
• information is held in a variety of formats
• information has been provided by a third party in confidence
• the number of documents is greater than 100

The criteria listed above will not be considered in isolation of each other and it may be that a number of these aspects lead to an extension being applied.

Information will be provided to you securely via a secure data transfer software. If you would like to receive a paper copy of your information, please inform us of this upon request. We will post your information out to your residential address via recorded delivery once you have provided documentation confirming proof of address such as a recent (last three months) utility bill.

Support will be offered in circumstances where it is considered that the information held has the potential to cause distress or harm to its recipient. This will be offered to you, if appropriate, when your file is ready to be sent or collected.

Please inform us if you require such support when you make your request so this can be considered at the earliest opportunity.

In most circumstances, you will not be charged for making a DSAR. However, where the request is manifestly unfounded or excessive you may be charged a fee for the administrative costs of complying with the request. An example of a request that may be considered excessive is one that merely repeats the substance of previous requests. In addition, if you request further copies of your data following a request, you may be charged for administrative costs of providing further copies. You will be informed if a charge applies.

Requests for access to personal data can be made by the subject themselves, irrespective of their age, or through an agent such as a Solicitor or advocate. Requests may also be made by someone who has parental responsibility for a child or person with legal responsibility in cases where the subject is incapable of understanding or exercising their own rights, such as for a young child, or an adult who has been assessed as lacking the capacity to make the request themselves. For more information, see the specified sections of this policy.

Some types of personal data are exempt from the right of subject access and so cannot be obtained by making a DSAR. These exemptions include but are not limited to the following:

• information relating to third parties or individuals, for example other people's information such as date of births
• GP report or sibling information
• confidential references, for example confidential references for job applications
• research, history and statistics, for example information used as part of an ongoing study, if it is not presently being used to make decisions about an individual
• publicly available information, for example information already in the public domain that can be sourced elsewhere
• crime and taxation, for example during a live investigation
• management information, for example during restructuring or redundancy process
• negotiations, for example during the negotiation process and the information may change the outcome
• legal advice, for example if someone had sought legal advice about the individual
• health, social care and education records, for example if they may cause harm or create risk
• there are different rules when asking for access to adoption records and information about this can be found on the Adoption Tees Valley access to birth records webpage

Before information is released to you, it will be reviewed by an Officer and redacted in accordance with the exemptions outlined above. If you require any information regarding the reasons for redaction in the information you have been provided with please contact the Information Governance Team.

Redaction is the term used to describe the editing process whereby information is removed from a record. This is done by blocking out individual words, sentences or paragraphs.

Whatever the age of the child, data about them is still their personal data and does not belong to anyone else such as a parent or guardian. It is the child who has a right of access to the information held about them and the Council will assess if the child is able to understand (in broad terms) what it means to make a DSAR, how to interpret the information they receive as a result of doing this, and the potential impact on them from having access to the records.

When responding to requests made by or on behalf of children the following is taken into consideration:

• where possible, the child's level of maturity and their ability to make a DSAR, the complexities involved in that decision and the possible consequences of their decision
• the nature of the personal data
• any court orders relating to parental access or responsibility that may apply
• any duty of confidence owed to the child or young person
• any consequences of allowing those with parental responsibility access to the child's or young person's information. This is particularly important if there have been allegations of abuse or ill treatment
• any detriment to the child or young person if individuals with parental responsibility cannot access this information
• any views the child or young person has on whether their parents should have access to information about them

When it is determined that a child or young person's views should be sought regarding a request made on their behalf, we will notify you of our intention to do so and our subsequent decision in writing.

A child, or someone acting on their behalf, may make a DSAR in respect of personal data held by a school, about the child. Such DSARs will be dealt with by the school involved in line with their own policy and procedure. If you would like to access a child's school record, please contact the school directly.

Over the course of their life time, people who have spent all or part of their childhood and adolescence in local authority care may want to access information about this period in their lives. There can be a range of reasons why people who have left care want to do this including curiosity about why they came into care, what happened and when, a need to make sense of difficult memories and life events, to clarify disparate explanations, a desire to trace family members, seeking clarification on family ancestry to inform hereditary illness or disease, and also to obtain photos or certificates.

It is important that people who have spent time in care receive comprehensive information about their family background and time in care to enable them to make informed decisions about their lives. Statutory guidance underlines the principles and processes that should be in place in response to requests for access to care records.

Under the Care Leaver Regulations, Care Leaver support extends to age 25. Legislation requires that a child's case record must be kept until the 75th anniversary of his or her date of birth. It is expected that the principles of good practice as outlined in 'The Children Act 1989 guidance and regulations - Volume 3: Planning transition to adulthood for care leavers' to apply to any Care Leaver regardless of their age.

The Council will reflect on these principles and good practice when responding to data subject access requests from care leavers.

Data protection legislation no longer applies to the records of a deceased person, it only applies to living individuals. There is however a common law duty of confidentiality and in considering requests for information relating to someone who is deceased, consideration will be given to whether the information had been provided in the expectation that it would remain confidential.

Any request for the personal information held by the Council where the subject is deceased should be made by their 'personal representative', defined as the person who is entitled to administer the estate of the deceased person under the law relating to wills and probate. Evidence of this will be required in the form of either a grant of probate or a letter of administration.

No information will be shared unless this evidence is provided. Such requests will not be classified as a DSAR but as an information request. The requester would however be able entitled to a response to a DSAR for information about themselves contained in the deceased person's files, unless to do so could cause serious harm.

Requests may be made by a representative of an individual, for instance this may be a solicitor, advocate, friend or trade union. In all circumstances, the Council will seek confirmation that the representative has the appropriate authority to act upon the individual's behalf. Usually this would be a signed letter from the individual or documentation stating that they have power of attorney over the individual's affairs. In addition to this, the representative will be asked to provide evidence and confirm that they have seen proof of the individual's identity as outlined earlier in this policy.

The Council can refuse to comply with a DSAR if we consider it to be manifestly unreasonable or if insufficient time has passed since a previous request was made. You will be notified in writing if this is the case and may be asked to submit your request once a reasonable amount of time has passed. Requesters are expected to behave and use appropriate language and tone when communicating with Council Officers. Should you not follow this expected behaviour, the Council may take steps to manage your communication. Again, should this be the case you will be notified in writing.

If you are unhappy with the way in which your request has been handled, please contact the Information Governance Team in the first instance.

Any challenge to information held or complaints can be made by emailing foiandcomplaints@stockton.gov.uk, by using our online customer feedback or complaints form, telephoning 01642 527521 or writing to:

Information Governance Team

Information and Improvement Services

Stockton-on-Tees Borough Council

Municipal Buildings

Church Road

Stockton-on-Tees

TS18 1LD

Often such matters can be addressed by undertaking a review of the information provided. We will provide you with an outcome of such a review within one calender month of you raising your concerns. Once the Council is satisfied we have supplied all the information you have a right to access, should you remain unhappy you can ask for it to be considered within the Council's Customer Feedback and Complaints Policy.

If after contacting us you still remain dissatisfied, you can contact the Information Commissioner's Office (ICO) to make a complaint. The ICO is the UK's independent body to uphold individual rights, such as access to your information which the Council holds about you. The ICO can be contacted by telephoning 0303 123 1113 or by writing to:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

SK9 5AF

More information about how to raise a concern with the ICO can be accessed via the ICO website.

For more information about Data Subject Access Requests, please contact the Information Governance Team by emailing foiandcomplaints@stockton.gov.uk, phoning 01642 527521 with lines open 9am to 4pm, Monday to Friday, or writing to:

Information Governance

Stockton-on-Tees Borough Council

Municipal Buildings

Church Road

Stockton-on-Tees

TS18 1LD