Skip to main content
Hafan

How can we supply Part 3 information to the requester?

Contents

In detail

What information do we need to supply under part 3?

You must make it easy for people to exercise their right of access. You must take reasonable steps to provide the information in a concise, accessible form, using clear and plain language.

You must make a reasonable and proportionate search to respond to a SAR. This means that you must make reasonable efforts to find and retrieve the requested information. However, you are not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to the information. (See our UK GDPR right of access guidance for more details – What efforts do we need to make to find information.)

Once you locate and retrieve the relevant personal information for the request, you should provide the requester with a copy, where possible. You must respond to the request in writing. However, you must also ensure that you provide the information in a clear and accessible format. This means that there may be circumstances where it's reasonable to provide the information in another format – if providing it in writing does not convey the true context or content of the information. For example, instead of a transcript of a video recording, you could provide the information in its existing format.

If you cannot provide a copy of the information, you must ensure that the person is able to access it. For example, you could make arrangements with them to view the information you hold.

Example

A person was captured on CCTV footage and, as a result, was arrested for a public order offence. They were then interviewed under caution and released without charge. The person writes to the police to request a copy of the CCTV footage. 

As the information does not exist in written form, the police provide them with a copy of the recording, after redacting the personal information of other people. 

If someone attends your premises in person to access the information you hold about them, you should provide them with a reasonable amount of time to review and assess it. 

If you process information electronically, you must ensure that your software has been built with accountability and security measures in mind. As controller, you must comply with all of your data protection obligations, including the right of access. For example, you may find that you need to redact the personal information of a third party before responding to a SAR. This is particularly important if the information concerns: 

  • children or young people;
  • people who need extra help to support themselves;
  • witnesses or those with information about offences; or
  • victims of crime. 

Therefore, it’s important that your software can perform this function.

In what format does the information need to be provided?

How you provide the information, and the format you use, depends on how the requester submits their request (ie electronically or otherwise).

If the requester submits the SAR electronically (eg by email or social media), you must provide a copy in a commonly used electronic format. You can choose the format, unless the requester makes a reasonable request for you to provide it in another commonly used format (electronic or otherwise). (See our UK GDPR right of access guidance What is a commonly used electronic format? for further information.)

If the requester submits a SAR by other means (eg by letter or verbally), you must respond using the same method, where practicable. If possible, you should comply with a person's reasonable request to provide the information in a commonly used format, even if they've made the request using a different method.

Example

A prisoner writes a letter to the police, asking for copies of their personal information. The police would normally send the information by electronic means. However, since the person has made the request by letter, the police must print out the requested information and either hand deliver it to the prison or ensure that it is delivered securely by post.

You must, where possible, help people exercise their right of access. Many people within the criminal justice system may not be able to access information in certain formats. For example, prisoners may not be able to access electronic systems or have only limited access to electronic systems. On the other hand, they may not have a secure method of storing paper copies of their information. Therefore, it's important to discuss this with them and determine their preferred format.

It may not always be possible to provide the information in the same format as the request or in the person’s preferred format. If not, you should contact the person and give reasons (eg where you have security concerns). If the information is sensitive, you should transfer it to the requester using an appropriately secure method. (See our UK GDPR right of access guidance How do we provide the information securely? for further details.)

Remember that it is your responsibility to provide the information to the person (or their appointed representative). They do not have to take action to receive the information (eg by collecting it from your premises), unless they agree to do so. 

You must take reasonable steps to provide information in a way that is accessible and easy to understand. However, you are not required to create new information to respond (eg transcripts). You should document the efforts you make to ensure the information you provide is accessible, including contacting the person, where appropriate. You must be able to provide evidence of your efforts to us if we ask you to.

What do we need to do if the information exists in different forms?

You must:

  • respond to requests in writing; and
  • provide the information in a concise, intelligible and easily accessible format, using clear and plain language.

If information is clear and accessible in its written form, you should provide the information in writing. However, you are not required to create transcripts if you would not normally do so.

Depending on the circumstances, you could provide the information in its original form. For example, you could do this if:

  • the person specifically requests the information in its original form (eg CCTV footage or audio recordings); or
  • providing the information in writing is unlikely to fully comply with the SAR (eg if it's unlikely to communicate the full content and meaning of their personal information).

Audio or visual recordings are likely to contain further context and meaning that a transcript cannot convey. For example, a person's tone of voice may display sarcasm, anger or fear.

In these circumstances, it's good practice to discuss with the person their preferred format before responding to the request.

Example

A person is interviewed under caution on suspicion of committing an offence. They are offered the assistance of a duty solicitor but refuse.

After the interview, the police decide not to arrest or charge the person. However, the person makes a SAR for the audio recording of the interview. The police ask them whether they would accept a copy of the transcript instead. The person refuses and asks for the audio recording. They explain that they were extremely anxious during the interview and experienced a panic attack. The person wants to keep a record that accurately reflects their condition at the time. They believe that a transcript would not capture their state of mind during the interview.

The person is entitled to make a SAR for their personal information. This includes information about their emotions, state of mind and mental health.

Once you have responded to a request in writing, the person may contact you if they believe that your written response is incomplete. They may ask you to provide the information in its original format. You should deal with the matter as part of their original request. This means you should respond as soon as possible and:

  • provide a copy of the information in an alternative format (eg an audio recording); or
  • allow the person an opportunity to access their information in an alternative format (eg by inviting them to your premises to listen to or view the information).

In deciding what response is appropriate, you should carefully consider the circumstances of the request. For example, you could consider the following factors:

  • Is it reasonable to ask the person to attend your premises to view or listen to the recording rather than provide a copy? This may depend on how far they would have to travel.
  • Is there a disparity between the transcript and the alternative format? If the transcript is vague or lacks some crucial detail, you should provide a copy of the recording, where possible. The transcript may be generally comprehensive, but does not include some contextual information (eg tone of voice or facial expressions). In this case, you could allow the person to view or listen to the recording to check the accuracy of the transcript.
  • Would providing a copy of the recording be manifestly unfounded or excessive?

You cannot deem a request as unfounded or excessive just because you have already provided the information in writing. If the response is incomplete, it may be reasonable for the person to ask you to provide it in an alternative format as part of their original request. (See When can we consider a part 3 request to be manifestly unfounded or excessive?.)

Example

A person is interviewed under caution. The police decide not to charge them. The person later makes a SAR for a copy of the audio recording. The police respond to the request by providing a transcript of the interview.

The person asks for a copy of the recording because they think the transcript is inaccurate. The police believe that any inconsistencies are likely to be minor. Therefore, they invite the person to attend the police station to listen to the recording and check the accuracy of the transcript.

Can we provide remote access?

You could provide someone with remote access to their personal information through a secure system if they agree. If doing this, you should consider whether you need to redact any third-party information.

However, providing remote access does not necessarily mean that you have provided someone with a copy of their information. This depends on whether they are able to download a copy of the information they requested in a format that is accessible to them. If they are able to download it from the remote access system, you have provided them with a copy. (See the UK GDPR right of access guidance – Can we provide remote access?.)

In what circumstances can we provide someone with access to their information but not a copy?

In most cases, you should provide someone with a copy of their personal information in response to a SAR. However, in certain circumstances, you could provide them with access to their information rather than a copy. For example, if:

  • the person agrees;
  • one of the part 3 restrictions applies to the provision of a copy of the information; or
  • you consider the cost of providing a copy of the information manifestly unfounded or excessive.

This is not an exhaustive list, and there may be other reasons you may be unable to provide a copy. You should keep a record of your reasons and be able to justify your decision. If necessary, you should redact information about other people before giving someone access to the information.

Do we need to make reasonable adjustments for disabled people?

You may need to make reasonable adjustments to ensure a disabled person is able to make a request.

What is a reasonable adjustment will depend on the specific needs of the person. If you are aware that a person may require reasonable adjustments (eg they have told you or they have explained that they are disabled), you should communicate with them about this (for example by speaking to them) to find out how best to meet their needs before you respond to their SAR. This may be by providing the response in a particular format that is accessible to the person, such as large print, audio formats, email or Braille.

You must ensure that your use of personal information is lawful. As well as data protection requirements, you also need to consider whether you have obligations under other legislation.

Further information about how to make effective, reasonable adjustments is available from the Equality and Human Rights Commission or from the Equality Commission for Northern Ireland.

Further reading – ICO guidance