In detail
- What information must we supply under Part 3?
- In what format should we provide the information?
- What should we do if the information exists in different forms?
- Can we provide remote access?
- In what circumstances can we provide someone with access to their information but not a copy?
- Do we need to make reasonable adjustments for disabled people?
What information must we supply under Part 3?
You must make it easy for people to exercise their right of access. You must take reasonable steps to provide the information in a concise, accessible form, using clear and plain language.
Once you locate and retrieve the relevant personal information for the request, you should provide people with a copy of their information, where possible. Although you must respond to the request in writing, you must also ensure that you provide the information in a clear and accessible format. It may not be reasonable to provide the information in writing if it does not convey the true context or content of the information. For example, a transcript of a video recording. In these circumstances, you may provide the information in its existing format.
If you are unable to provide a copy of the information, you must still ensure that the person is able to access their data. For example, you could make arrangements with them to view the information you hold.
Example
A person was captured on CCTV footage and, as a result, was arrested for a public order offence. They were then interviewed under caution and released without charge. The person writes to the police to request a copy of the CCTV footage.
As the information does not exist in written form, the police provide them with a copy of the recording, having redacted the personal information of others. Alternatively, the police could have made arrangements to allow the person to view the footage at a mutually convenient time (eg if it was not possible to provide a copy, or the person agreed to view the footage instead). Depending on the circumstances, it may be necessary to redact the personal information of other people, before providing the person with access to the footage.
People need a reasonable amount of time to review and assess the information you hold about them. So, if they attend your premises in person, you should, where possible, provide them with enough time to consider this information.
If you process information electronically, you must ensure that your software has been built with accountability and security measures in mind. As controller, you must comply with all of your data protection obligations. This includes the right of access, and any of the other individual’s rights. For example, you may need to redact the personal information of a third party before responding to a SAR. This is particularly important if the information concerns children or vulnerable people, including witnesses or victims. Therefore, it is important that your software can perform this function.
In what format should we provide the information?
How you provide the information, and the format you use, depends on how the request was submitted (ie electronically or otherwise):
- If the person submitted the SAR electronically (eg by email or social media), you must provide a copy in a commonly used electronic format. You could choose the format, unless the requester makes a reasonable request for you to provide it in another commonly used format (electronic or otherwise). (See What is a commonly used electronic format?)
- If the person submitted the SAR by another means (eg by letter or verbally), you must respond using the same method, where practicable. If possible, you should comply with a person’s reasonable request to provide the information in a commonly used format, even if they’ve made the request using a different method.
Example
A prisoner writes a letter to the police, asking for copies of their personal information.
The police would normally send the information by electronic means. However, since the person has made the request by letter, they must print out the requested information and either hand deliver it to the prison or ensure that it is delivered securely by post.
Many people within the criminal justice system may not be able to access information in certain formats. For example, prisoners may not be able to access electronic systems, or have only limited access to electronic systems. On the other hand, they may not have a secure method of storing paper copies of their information. Under section 52(6) of the DPA 2018 you must, where possible, help people exercise their right of access.
It may not always be possible to provide the information in the same format as the request or in the person’s preferred format. If not, you should contact the person, and give reasons. For example, where you have concerns about security. If the information is sensitive, you should transfer it to the requester using an appropriately secure method. See our UK GDPR right of access guidance How do we provide the information securely? for further details.
Remember that the onus is on you to provide the information to the person (or their appointed representative). They should not have to take action to receive the information (eg by collecting it from your premises), unless they agree to do so. However, you are not required to create new information (eg transcripts) in order to respond to a SAR. If it’s not possible to provide a copy of the data, you must still ensure that they are able to access their information.
You must take reasonable steps to provide information in an accessible and easy to understand way. You should document the efforts you make to ensure the information you provide is accessible, including contacting the person, where appropriate. You must be able to provide evidence of your efforts to the ICO, if asked to.
What should we do if the information exists in different forms?
You must respond to requests in writing, and provide the information in a concise, intelligible, and easily accessible format using clear and plain language. If information is clear and accessible in its written form, it will usually be appropriate to provide the information in writing. However, you are not required to create transcripts if you would not normally do so.
Depending on the circumstances, you may provide the information in its original form. For example, this may be the case if:
- the person specifically requests the information in its original form (eg CCTV footage or audio recordings); or
- providing the information in writing is unlikely to fully comply with the SAR (eg if it is unlikely to communicate the full content and meaning of the personal information).
Audio or visual recordings are likely to contain further context and meaning that cannot be communicated in a transcript. For example, a person’s tone of voice may display sarcasm, anger or fear.
In these circumstances, it is good practice to discuss with the person their preferred format, before responding to the request.
Example
A person is interviewed under caution on suspicion of having aided and abetted a murder. They are offered the assistance of a duty solicitor but refuse.
After the interview, the police arrest the person, who then makes a SAR for the audio recording of the interview. The police ask them if they would be happy to receive a copy of the transcript. The person refuses, and specifically asks for a copy of the audio recording. They explain that they were extremely anxious during the course of the interview and experienced a panic attack. They believe that their symptoms led to them wrongly implicating themselves in the crime.
The person believes that the recording will help demonstrate their state of mind and mental health during the police interview. They want this information in order to obtain legal advice.
While this information is likely to be disclosed in the course of legal proceedings, the person is also entitled to make a SAR for their personal data, which includes information about their emotions, state of mind, and mental health.
Once you have responded to a request, the person may contact you and state that they believe that the response you have provided in writing is incomplete. They may ask you to provide the information in its original format. You should deal with the matter as part of their original request. This means you should respond as soon as possible to:
- provide a copy of the information in the alternative format (eg audio recording); or
- allow the person an opportunity to access their information in the alternative format, by inviting them to your premises to listen to or view the information.
In deciding what response is appropriate, you should carefully consider the circumstances of the request. For example, you may consider the following factors:
- Is it reasonable to ask the person to attend your premises to view or listen to the recording rather than provide them with a copy? For example, this may depend on how far they would have to travel.
- Is there a disparity between the transcript and the alternative format? If the transcript is vague, or lacks some crucial detail, you should provide a copy of the recording, where possible. However, the transcript may be generally comprehensive but does not include some contextual information (eg tone of voice or facial expressions). In this case, it may be reasonable to provide the person with an opportunity to view or listen to the recording in order to check the accuracy of the transcript.
- Would providing a copy of the recording be manifestly unfounded or excessive?
You should not deem a request as excessive just because you have already provided the information in writing. If the response is incomplete, it may be reasonable for the person to ask you to provide it in an alternative format, as part of their original request. See our guidance on manifestly unfounded and excessive requests.
Example
A person was interviewed under caution. The police decide not to charge them. The person later makes a SAR for a copy of the audio recording. The police respond to the request by providing a transcript of the interview.
The person asks for a copy of the recording because they think the transcript is inaccurate. As the police believe that any inconsistencies are likely to be minor, they invite the person to attend the police station so they can listen to the recording to check the accuracy of the transcript.
Can we provide remote access?
You could provide someone with remote access to their personal information through a secure system, if they agree (although you should consider whether you need to redact any third party data).
However, providing remote access does not necessarily mean that you have provided someone with a copy of their information. This depends on whether they are able to download a copy of the information they requested. If they are able to download it from the remote access system, then you have provided them with a copy.
In what circumstances can we provide someone with access to their information but not a copy?
In most cases, you should provide someone with a copy of their personal information in response to a SAR. However, in certain circumstances, you could provide them with access to their information rather than a copy. For example, if:
- one of the Part 3 restrictions applies to the provision of a copy of the information;
- the cost of providing a copy of the information may be deemed as manifestly excessive; or
- the person agrees.
This is not an exhaustive list, and there may be other reasons why you may be unable to provide a copy of the information. You should keep a record of your reasons, and be able to justify your decision, if required. If necessary, you should redact information about other people before giving someone access to the information.
Do we need to make reasonable adjustments for disabled people?
Yes. Some disabled people may experience communication difficulties if your processes aren’t fully accessible, and therefore have difficulty making a SAR. You must make reasonable adjustments, if a disabled person wishes to make a request. If you are not clear about what information a person is asking for, or what reasonable adjustments they need you to make, you should request clarification in an accessible format and send it to the disabled person to confirm the details of the request.
What is a reasonable adjustment will depend on someone’s specific needs, and you must be clear about exactly what reasonable adjustments are required. If you are unsure about what reasonable adjustments may be necessary, you should communicate with the person (eg by speaking to them) before responding to the SAR to find out how best to meet their needs. This may be by providing the response in a particular format that is accessible to the person, such as large print, audio formats, email or Braille. If someone thinks you have failed to make a reasonable adjustment, they can make a claim under the Equality Act 2010 or the Disability Discrimination Act 1995 (NI). Further information about your legal obligations and how to make effective reasonable adjustments is available from the Equality and Human Rights Commission or from the Equality Commission for Northern Ireland.