View Derbyshire Children's Homes Procedures manual
View Derbyshire Children's Homes Procedures manual View Derbyshire Children's Homes Procedures manual
View Derbyshire Safeguarding Procedures manual
View Derbyshire Safeguarding Procedures manual View Derbyshire Safeguarding Procedures manual

2.3 Access to Records


Contents

1. Rights and Responsibilities
2. Information; Exemptions and Inclusions
3. Our Pledge
4. How Requests Are Made
5. Applications by Children
6. Applications by Parents, Family Members, Carers, Friends and Advocates
7. Applications by Care Leavers
8. Applications by Agents and Third Parties
9. Applications on Behalf of Deceased Persons.
10. Redacting, Correcting, Summarising, Editing and Erasing Records
  10.1 Reasons for Redacting / Removing Information for Records
  10.2 Third Party Information - Immediate Family, Relatives and Guardians
  10.3 Third Party Information -Staff Members and Staff Members from Partner Agencies
  10.4 Third Party Opinion
  10.5 Health and Medical Records
  10.6 Legal Records
  10.7 Summarising
  10.8 Errors and Amendments
11. Refusing Requests and How to Appeal
  Appendix 1: Glossary


1. Rights and Responsibilities

The policies, procedures and guidance contained within this chapter are intended to provide guidance to staff in Children’s Services when preparing files following a request for access under the Data Protection Act 1998.

Everyone has the right, under section 7 of the Data Protection Act 1998, to be told whether Derbyshire County Council holds any personal information about them and the right to receive a copy of that information, subject to checks and some exemptions. We refer to personal information as ‘Records’ and the process of asking for records, as a ‘Subject Access Request’ or ‘Access to Personal Information’. The Data Protection Act also allows an individual to inspect their records for accuracy of recording and, where permitted, request corrections and amendments.

By ‘data’, we refer to all aspects of manually created records, whether they are held on electronic files, microfiche records or hard copy paper documents. They will include statements of fact and personal opinion, from a number of sources including third parties.

Derbyshire County Council has a legal obligation to act upon a ‘Subject Access Request’ within a maximum of 40 consecutive calendar days (including weekends and bank holidays), upon receipt of the necessary forms of identification, a completed request form and any supporting information needed to locate the records. 

These policies and procedures are governed by the following legislation:

  • The Data Protection Act 1998;
  • The Freedom of Information Act 2000;
  • The Caldicott Principles;
  • The Human Rights Act 2004;
  • The Mental Capacity Act 2005.

It may be that enquiries are received that state explicitly, infer or suggest that the local authority may be liable for litigation on account of information revealed during a Subject Access Request. For example; the applicant may reveal they have suffered abuse whilst in the care of the authority or the authority had been negligent or acted in a way that has harmed the applicant or caused them hardship or negatively affected their physical or mental health and well-being.

It is advised that the officer processing any request, where there is a possibility of litigation apparent from the enquiry or following correspondence, should acknowledge the request and forward it immediately to Legal Services. If, during the course of a Subject Access Request, evidence is found that similarly implicates the authority, the officer is to inform Legal Services without delay.


2. Information - Exemptions and Inclusions

In the vast majority of cases, all personal information held by the authority, in whatever form (electronic or paper files), can be accessed by the individual that the information relates to as this information is ‘accessible public records’. Any individual requesting to access their records does not need to give a reason why they wish to view them and even if they refuse Children's Services staff support or counselling during the process, they are still entitled to view any and all files relating them, where applicable.

There are exceptions to the right of access:

  • Where access to information would be likely to result in serious harm to the person requesting the information or some other person;
  • Where the person requesting the information was of an age or ability where they are not capable of independently managing their affairs (for example, if the applicant was a child) and the information was given to them, under the expectation that they would not reveal or disclose any part of that information, which they were told not to disclose;
  • Where accessing records would cause information about someone else to be disclosed, without their consent;
  • Where disclosing information may prevent the detection or investigation of a crime;
  • Where the applicant has recently made a Subject Access Request which the authority has fulfilled and a reasonable period of time has not yet elapsed;
  • Legal advice is confidential and should not be disclosed;
  • Adoption Case Records are exempt from the Data Protection Act and are dealt with separately under the Adoption Act 1976. This exemption only applies to data compiled for adoption purposes e.g. information gathered for the Adoption panel, rather than all social care data that has been held with the records for convenience. Please refer to Access to Birth Records and Adoption Case Records Procedure.

These exceptions do not apply to all the material relating to the applicants personal information and they do not permit a total and complete withholding of information, but only those parts that are immediately relevant. All other parts should be made available to the service user.

With regards to right of access and the courts:

  • The exceptions do not apply where disclosure is required by a court order or is necessary when in connection with any legal proceedings; and
  • A court may prevent disclosure of information where there are concerns that such a disclosure could cause serious harm to their physical or mental health and well-being.


3. Our Pledge

For any care leaver or service user, accessing records from their time in care has the potential to be a very challenging experience. In many cases, there may be a sense of disappointment and frustration where records are no longer accessible or have perhaps been destroyed – in other cases, the applicant may have feelings of hurt or confusion, by what is revealed. As a Local Authority, and keeper of these records, we have a duty of care to provide the best possible service for anyone requesting access to their personal information. This duty of care requires us to:

  • Ensure that the need to safeguard all children and young people remains paramount;
  • Fulfil time scales and deliver information in a timely fashion;
  • Be clear to the applicant as to what information may or may not be available;
  • Provide additional support where appropriate or where requested.

A request for copies of information disclosed must be met and no charges should be made for the service. Any and all information presented to clients must be readily understandable and any specialist terminology, acronyms or abbreviations highlighted and explained. All documents presented must be presented as ‘hard copy’, on paper.

Where the person making the request has specific needs in relation to language or disability, arrangements must be made to present the information in a suitable manner and to involve approved interpreters as needed. Interpretative and supportive counselling may be advisable in certain cases using a number of interviews to disclose the information, if the person concerned is willing to proceed in this manner.

Staff members dealing with a Subject Access Request will treat all enquirers with respect and politeness and should be encouraged to promote an ongoing and open way of working, with regards sharing information and providing copies of key documents.

Derbyshire County Council is committed to providing equality and fairness in all aspects of its service. Clients will not get less favourable treatment than others because of their gender, ability, age, ethnic or national origin, religious creed, marital status or sexuality.


4. How Requests Are Made

Derbyshire County Council holds records on the people it works with and the people it offers services to for a number of reasons; it makes us accountable for what we do and ensures we comply with the laws that govern social care. Our records provide us with the information we need to make our service work efficiently, let us know what we are doing well and where we need to improve, and create statistics to plan ahead and inform central government.

The majority of records are kept for six years from the date the authority ceased to provide a service for the individual or for three years following a person’s death. However, some records will be kept for longer, for details please refer to the Children's Services Retention Schedule in the Records Retention Section of our website.

Anyone can submit a Subject Access Request (SAR) for information held about them, about people they have responsibility for (e.g. Parental Responsibility) or where consent has been given by a third party to make a request on the applicant’s behalf.

The criteria for submitting a Subject Access Request are:

  • That they must be made in writing (either by completion of the SAR request form, letter or email);
  • The applicant must make clear the information they wish to view;
  • The applicant must provide proof of identification to confirm they are entitled to the information.

The applicant must contact Call Derbyshire to register their interest – a covering letter, information guide and SAR form will be posted to them that day. A referral will be recorded by the call centre and their Subject Access Request episode forwarded onto a SARS Officer. If the client is already involved with Children's services, they may not need to confirm their identity and the Subject Access Request procedure can commence upon receipt of the completed SAR form.

Please note – the applicant must complete and return the SAR form to initiate a Subject Access Request, as only a written request will be accepted.

Identification

The applicant must provide identification.

If the applicant is asking to view their own records, they must provide proof of name, current address and date of birth. All documents must be originals. Photocopies will only be accepted if stamped and signed by a public notary (Solicitor or Justice of the Peace).

The applicant must provide:

  • Photographic ID (a recent passport or driving licence (Photocard only);
  • Birth Certificate;
  • A recent utility bill or bank statement ( within the last three months).

If the applicant is asking to view someone else’s records they must provide proof of identity (as given above) AND proof that the applicant is legally authorised to access this person’s records e.g. birth certificates, court orders, letters of authority. Contact the SARs team for further advice.

The SAR process can only commence upon receipt of the completed SAR form and, where applicable, if the client is required to provide appropriate identification – photocopies cannot be accepted. If no identification is made available within 28 days of the written SARS form being received, then the SARS referral will be closed. Identification can be presented:

  • By post – to the Children's Services DP/FOI Officer, County Hall, Smedley Street, Matlock, DE4 3AG;
  • By hand – to the Children's Services DP/FOI Officer, County Hall, Smedley Street, Matlock, DE4 3AG;
  • By hand – to the applicant’s local Children's Services area office (To be scanned and emailed immediately to the Children's Services DP/FOI Officer upon receipt of the documents).

The Children's Services DP/FOI Officer will delegate the Subject Access Request task to the SARS Officer – they will ensure that all relevant personal data is gathered and, where necessary, liaise with area Business Services staff to obtain records from area offices, off-site storage or through access to files held on microfiche. Please note; as a result of records degradation, the SARS Officer will scan and upload to the service user’s Frameworki file any files scanned from microfiche or currently held only as a paper copy.

Where necessary, letters requesting consent from third parties will be sent out upon receipt of relevant files and records. The third party has ten days to respond to the request, which falls within the 40 days of the SARS process (for further information on obtaining consent, see Section 10, Redacting, Correcting, Summarising, Editing and Erasing Records).

The authority has an obligation to fulfil all legitimate Subject Access Requests. However, Derbyshire County Council may reasonably ask for clarification around the nature of the request – for example, if a service user asks for all the records held by the authority on them and their time in care, and whilst such a request can be undertaken, the authority is within its rights to ask for clarification and to contact the applicant for further information, through the SARS Officers – such contact would enable the request to be made without any unnecessary delays. There are provisions under Statutory Instrument 2000/415 of the Data Protection Act, whereby data held for social work purposes may be withheld if disclosure would be likely to cause serious harm to the physical or mental health or condition of the subject of the record or another person. This may not apply to adults seeking access to their childhood information.

It is the responsibility of the SARS Officers to compile such information as will be necessary to fully meet the demands of the applicants Subject Access Request, in all relevant formats (electronic, paper or microfiche – referred to as a ‘relevant filing system’); the officers will not be expected to obtain such information, which although relevant to the applicant, as falls outside the remit of the enquiry. Additional information can be located through what is referred to as ‘unstructured data’ – information that is not held within the constraints of a formal filing system, where the client can be readily identified; an example of this would be email correspondence between the applicant and staff members and, as such, the applicant would be expected to assist in providing additional information so as to locate this information (contact names, date ranges, subject headings and topics addressed).

It is the further responsibility of the SARS Officers to prepare the relevant information prior to handover to the Subject Access Request applicant. In many cases, documents will require redaction (see Section 10, Redacting, Correcting, Summarising, Editing and Erasing Records) where third party consent has not been given and/or to remove any information that is either not relevant or where disclosure may be harmful or counter-productive. In all cases, the authority must maintain copies of the client’s records in both redacted and original form – where redaction has taken place, the authority must make clear what changes have taken place with clear reasons why information has been withheld.

Upon completion of the SARS episode, the record(s) may, upon the guidance of the client, be either posted by Special Delivery or held at an area office for collection. The authority will retain the services of a SARS Officer to discuss any aspects of the request that require clarification or possible expansion – if requested, counselling can be made available through the additional support of a qualified Children's Services staff member from either the post Adoption Service or closest area Children's Services district office, where appropriate and applicable.


5. Applications by Children

Derbyshire County Council will consider what is in the best interests of the child or young person before releasing information to a child’s parent or representative. The Children's Services DP/FOI Officer will refer to the Head of Information (Children's Services), should the SARS Officers reveal anything that may have the potential to cause harm or distress to the child or young person, whether cases are open or closed. Any decisions and referrals to Heads of Service will be recorded on the child’s file.

Children and young people under the age of 18 are entitled to request access to their personal information. Upon a request being received by the Children's Services DP/FOI Officer, the SARS Officers will contact the applicant to discuss their enquiry, ensure that they are fully aware of the procedures and timescales relating to SARS and ascertain the full nature of their request. The authority considers that a young person possesses the necessary awareness and skills to make an informed decision, from the age of 12, although this will depend upon the child’s ability - where appropriate, a qualified Children's Services staff member may be called upon to judge whether the child understands the nature of their request and (if applicable) the child’s parent to provide written confirmation. With regards a Subject Access Request by or on behalf of a young person aged 16 or older and whose abilities are deemed as such that they lack the capability to make an informed decision, the legal obligations and rulings are defined in Section 16 of the Mental Capacity Code of Practice.

Click here to view the Mental Capacity Act: making decisions (GOV.UK).

A Subject Access Request by or on behalf of a child or young person requires, if they are not currently involved with Children's Services:

  • Proof of the child’s identity;
  • Where the request has been made on behalf of a child, the child must provide written consent for the requestor to access information on their behalf – this must be signed by the child and co-signed by the professional or staff member, where the child’s competence has been assessed;
  • Two forms of identification for the requestor (as defined in Section 4, How Requests Are Made).

A Subject Access Request by or on behalf of a child or young person, who is assessed as lacking the necessary competence to make an informed decision requires, if they are not currently involved with Children's Services:

Please note that parents do not have an automatic right to their child’s information. Where a child does not possess the necessary competency to request their records or provide consent to access those records, a parent or guardian holding Parental Responsibility, is required to provide proof of Parental Responsibility before the request can commence.

Parental Responsibility is given as follows:

Married Parents

  • Where both parents are married at the time of birth or have jointly adopted;
  • Where the child’s birth father is not married to the child’s birth mother at the time of birth, but later marries the birth mother.

Proof is shown through the birth certificate of the child and the parent’s marriage certificate.

Unmarried Parents and Married Step Parents, wishing to obtain Parental Responsibility for a step child

  • The unmarried mother always holds Parental Responsibility unless rescinded by the courts;
  • The unmarried father can gain Parental Responsibility through a Parental Responsibility agreement with the mother, registered in the High Court (Principal Registry of the Family Division) shown through a copy of the registered agreement; by a Parental Responsibility order made by the courts, shown through a copy of the sealed court agreement; jointly registering the birth of the child with the mother (post 1st December 2003), shown through a copy of the birth certificate.

Adoptive Parents

Proof is shown through the adoption certificate.

Please note – where a Subject Access Request is made by a care leaver, who may not possess the necessary photographic identification (passport or driver’s licence), the Children's Services DP/FOI Officer may verify their identification through contact with staff members who have supported them whilst in care or through Aftercare Services.


6. Applications by Parents, Family Members, Carers, Friends and Advocates

Even if a child is unable to understand the implications of a request, the data Derbyshire County Council hold about them is still their personal data and does not belong to anyone else, including a parent. It is the child who has the right of access to information held about them, this is true even in the case of young children whose rights are likely to be exercised for them by people with Parental Responsibility.

Before responding to a request for access to information held about a child, it should be considered whether the child is mature enough to understand their rights. If they are they should be responded to rather than the parent. If a worker is unsure about whether a child is able to understand what it means to make a request and how to interpret the information they receive as a result the worker should consider

  • The child’s level of maturity and ability to make decisions like this;
  • The nature of the personal data;
  • Any court orders relating to parental responsibility that may apply;
  • Any consequences of allowing those with parental responsibility access to the child’s information. This is particularly important if there have been allegations of abuse;
  • Any detriment to the child if people with parental responsibility cannot access this information;
  • Any views the child has on whether their parents should have access to information about them.

Where the Children's Services DP / FOI Officer assesses that the child might actually be able to request access to the records for themselves, they should check that it is the child's choice for the parent to see the records on their behalf. If it is, the child will be asked to confirm this in writing and access to the parent can then be agreed (see Section 5, Applications by Children).

Regardless of whether or not a child is capable of understanding the request or has consented to their parent making the request, it is important that a parent should only be given access to information about the child if the worker, in consultation with his or her manager, is satisfied that the request is made in the child's and not the parent's interest.


7. Applications by Care Leavers

Case records can be an important source of information for care leavers who are seeking to understand their family background and make sense of decisions which the local authority made in relation to their care.

When an application has been received from a care leaver, it is important that the request is acknowledged promptly in writing, or other by using another appropriate form of communication if required. The care leaver should be informed about the process and procedure for responding to their application including timescales for dealing with such requests and the services that the authority is able to provide.

Within 10 working days an acknowledgement should be sent to the care leaver confirming that their records exist. If the authority knows that the care records do not exist, there should be no delay informing the care leaver of this fact. The letter should indicate when they are likely to receive information from the care records and confirm that:

  • The local authority will locate all existing records relating to the care leaver, including registers from children’s homes. Legislation requires that a child’s case record must be kept until the 75th anniversary of the child’s date of birth;
  • There is a statutory duty to respond to a Subject Access Request within 40 calendar days. If it is not possible to meet this requirement, this should be explained to the care leaver with reasons and confirmation of the timescales within which the information will be made available should be given;
  • The care leaver will need to produce proof of their identity before the organisation can disclose any personal information however, if the person is already known the proof of formal ID is not required;
  • If the records cannot be located, the care leaver needs to be informed as soon as possible with information about the steps that will be taken to try to locate them. If records have been transferred to another local authority, the individual should be put in touch with the relevant department if this can be done. When records have been destroyed or mislaid, the care leaver must be informed as soon as possible and assistance given to assist the care leaver to locate other information and registers that may be available, such as, health and education records. 

It is important that the case worker has telephone or direct contact with the care leaver to introduce themselves and explain the process. It provides an opportunity for the care leaver to discuss what they are hoping to obtain from their records, how s/he would like these to be shared and what they already know about their family and history. The case worker should also seek to gain an understanding of what the care leaver already knows about their case and the circumstances in which they became looked after. This will help to avoid making unnecessary redactions which can fragment documents and histories. Where there are redactions in the records, clear explanations given as to the reasons for these.

The case worker can also offer and identify what support the care leaver would like to receive. The care leaver should be assured that s/he will receive comprehensive information about their family background and time in care including information already known to them. It is important to offer to telephone the care leaver after they have received and read their records and to inform them that the case worker is available to try and answer any questions or concerns they may have.

Local authorities should respond to requests from a direct descendant of a care leaver if information about family history is being sought.

For further information see Children Act 1989 Guidance and Regulations Volume 3: Planning Transition to Adulthood for Care Leavers (revised January 2015) paragraphs 4.21 - 4.37 Access to Records.


8. Applications by Agents and Third Parties

A request for access to records may be made through an agent (for example, a solicitor). Where an agent has been appointed by an applicant, the agent can then make a request to access their client personal records – the request must be treated as if it had been made by the applicant directly.

It is the agent's responsibility to produce satisfactory evidence that he or she has authority to have access to the records. The Subject Access Request can only commence upon receipt of the following:

  • A letter on company headed paper, which clearly states the agent is acting on behalf of the applicant;
  • Written consent for the agent to access information on behalf of the applicant and signed by the requestor.

It is the duty of the Children's Services DP/FOI Officer to consult with the Head of Information (Children's Services), where there are any areas of doubt, concern or ambiguity, to decide whether the agent will be allowed access, having sought legal advice if necessary.


9. Applications on Behalf of Deceased Persons

Where a request is received for access to the records of someone who has died, the person making the application should be asked to explain in writing:

  • Their relationship to the deceased person;
  • What information is needed;
  • Why they need the information and what purpose it will serve.

It is the duty of the Children's Services DP/FOI Officer to consult with the Head of Information (Children's Services), where there are any areas of doubt, concern or ambiguity, to decide whether the requestor will be allowed access, having sought legal advice if necessary. Any decision made is to be communicated to the requestor in writing and, if it is confirmed that the Subject Access Record can proceed, the applicant must provide identification with two forms of identification (as defined in Section 4, How Requests Are Made).


10. Redacting, Correcting, Summarising, Editing and Erasing Records

A Subject Access Request is an application made by an individual for information held by the authority them. This will include any opinions and statements of intent given about that person, by members of staff and partner agencies within Derbyshire County Council.

In line with best practice raised by the Data Protection Act, the authority has a moral obligation to be as open and transparent with the needs of our service users as is possible. However, we have a similar duty of care, to ensure that we only provide information about the applicant and not release information or data about other individuals without their consent. The Act does not give a definition of what constitutes consent, but the EU Directive that led to the 1998 Act describes it as:

“…any freely given specific and informed indication of their wishes by which the data subject signifies his agreement to personal data relating to him to be processed”. If the data subject has to signify agreement, then some active communication must take place and a failure by the data subject to respond to a request for consent should not be taken as an indication of consent.

Once a Subject Access Request has been made, the majority of documents presented to the applicant will have been ‘redacted’; this is where information that is not directly relevant to them or concerns people who have not given their consent to be included, has been removed.

10.1 Reasons for Redacting/Removing Information from Records

Information Relating To Another Person

Part II Section 7/4 – Where the data controller (Derbyshire County Council) cannot comply with the requests without disclosing information relating to another individual who can be identified from that information.

Information Which Would Lead To The Identifying of Another Person

Part II Section 8/7 – Where another individual can be identified from the information being disclosed if they can be identified from that information, or from that and any other information which, in the reasonable belief of the data controller, is likely to be in, or to come into, the possession of the data subject making the request.

Third Party Information Where Consent to Release Has Been Requested

Third party information which relates to, or has been supplied by a Third party. Consent to release the information has been requested. Third party means any person or organisation other than;

  • The data subject (the person requesting the information);
  • The data controller (Derbyshire County Council);
  • Any data processor or other person authorised to process data for the data controller or processor (external or partnership agencies). This does not include personnel working for Derbyshire County Council.

Legal Privilege

Information between a client (in this case, Derbyshire County Council) and their professional legal advisor will remain confidential. This information is exempt from disclosure unless the data subject agrees to waive the privilege under advice from their legal professional.

Court Documents

Social work documents processed by a court and consisting of information supplied in a report or other evidence given to the court by a local authority are exempt from disclosure in accordance with regulation 4 Data Protection (Subject Access Modification) (Social Work) Order 2000. This will cover documents submitted to the court in relation to child care proceedings.

Adoption records and reports, parental order records and reports are exempt from disclosure in accordance with Data Protection (Miscellaneous Subject Access Exemptions) Order 2000.

Information Which Is Not Personal Data

Documents such as policies, school brochures and information leaflets and any other information which is not classed as personal data.

Duplicate of information already provided. 

Such as documents that have been uploaded duplicate times in error and case noting showing full email thread where such emails have already been recorded.

Illegible

Such as documents stored on microfiche where this has deteriorated to such an extent as to be unreadable.

Result in serious harm

Where access to information would be likely to result in serious harm to the person requesting the information or some other person.

Not capable of independently managing their affairs

Where the person requesting the information was of an age or ability where they are not capable of independently managing their affairs (for example, if the applicant was a child) and the information was given to them, under the expectation that they would not reveal or disclose any part of that information, which they were told not to disclose.

Prevent detection or investigation of a crime

Where disclosing information may prevent the detection or investigation of a crime.

Already provided information

Where the applicant has recently made a Subject Access Request which the authority has fulfilled and a reasonable period of time has not yet elapsed.

Adoption Case Records

Adoption Case Records are exempt from the Data Protection Act and are dealt with separately under the Adoption Act 1976. This exemption only applies to data compiled for adoption purposes e.g. information gathered for the Adoption panel, rather than all social care data that has been held with the records for convenience.

Notes

These exceptions do not apply to all the material relating to the applicants personal information and they do not permit a total and complete withholding of information, but only those parts that are immediately relevant. All other parts should be made available to the service user.

With regards to right of access and the courts.

The exceptions do not apply where disclosure is required by a court order or is necessary when in connection with any legal proceedings.

A court may prevent disclosure of information where there are concerns that such a disclosure could cause serious harm to their physical or mental health and well-being.

10.2 Third Party Information - Immediate Family, Relatives and Guardians

A SARS applicant’s personal records will contain information about other people, known as ‘third parties’, including immediate family, relatives and guardians. Some of this information may have been given to Derbyshire County Council in confidence and some as a result of an open disclosure.

Any information from or relating to the third party that was given in confidence, it will be redacted. Any other information from or relating to a third party cannot be released to the SARS applicant, without first securing the consent of the third party. The authority will need to get the consent of any third party before releasing information about them to the applicant. This is done in writing with details specifically explaining the nature of the information requested. If the consent is granted, the information can be included –where consent is not given, the information will be redacted before being given to the applicant. Should the third party not respond, it is the duty of the SARS Officer to decide what information can be disclosed based upon:

  • If they have taken and can evidence they have taken, all reasonable steps to contact the third party;
  • Any duty of confidentiality owed to the third party, living or deceased;
  • Whether the third party is capable of giving consent;
  • Whether there any legal reasons to withhold information.

Please note – consent will only be sought when the information is solely about the third party and not the third party and the applicant (here referred to as Paul) e.g.:

‘Paul’s father was working in France’, refers solely to the third party and consent would be needed.

‘The Paul’s father and the Data Subject were on holiday in France’, refers to the third party and the applicant and the SARS Officer would have to decide between including a relative’s personal information and information that covers both the relative and the applicant.

It is the role of the SARS Officer to use their discretion in both fulfilling the applicant’s request whilst preserving the confidentiality of the third party e.g.:

‘Paul was brought into care in 1987, because of his mother’s illness, which had led to her being sectioned’.

This sentence could be redacted to read either:

‘Paul was brought into care in 1987’;

or,

‘Paul was brought into care in 1987, because of his mother’s illness’.

Depending upon circumstances and the judgement of the SARS Officer, a balance has been struck to meet the moral obligation the authority holds in meeting the needs of Subject Access Request applicant whilst maintaining the integrity of the third parties past history. In the second sentence, again depending upon circumstances (e.g. the knowledge that previous Life Story work has been undertaken) and the judgement of the SARS Officer, further information can be given without revealing the nature of the mother’s illness.

Derbyshire County Council considers it reasonable to disclose information to the Data Subject, without the consent of the third party:

  • If the authority does not have a duty of confidence to the third party;
  • If the authority has taken, and can evidence, that it has taken all necessary steps to gain their consent;
  • If the authority considers the information to be of extreme importance and immediate and direct relevance to the Data Subject.

Derbyshire County Council will not disclose information to the Data Subject;

  • If the third party expressly refuses to consent;
  • If the third party is unable to give consent and consent is not forthcoming from agents acting on behalf of the third party.

10.3 Third Party Information -Staff Members and Staff Members from Partner Agencies

All records will contain information about and given by staff members and co-workers from partner agencies (Action for Children, the Police, NHS) – their direct involvement with the Data Subject, attending meetings, minutes taken, reports, records of discussions made and correspondence between colleagues, emails and memos. In some cases, and pending on the judgement of the SARS Officer and following consultation with Children's Services QA, information recorded for the purposes of social work may not be disclosed because it could adversely affect ongoing work with the applicant or third parties linked to the Data Subject or have the potential to cause serious harm to the applicant or others.

Derbyshire County Council will retain the names of all professionals within an applicant’s records and details of staff members will only be removed:

  • Where identifying a staff member may put them at risk of harm;
  • Where personal details (home address, personal email address, contact telephone numbers) are shown.

Where records show information from an organisation other than Derbyshire County Council, the authority must first get consent from the organisation to release the information. However, where a staff member of another organisation has been working directly for authority, no prior consent is necessary although information will be removed:

  • Where identifying a staff member may put them at risk of harm;
  • Where personal details (home address, personal email address, contact telephone numbers) are shown.

Although not staff members, the role of foster carers is such that much of the information they hold will come under the same guidelines as those we use for employees of Derbyshire County and/or partnership agencies. It is considered best practice, unless explicitly stated otherwise, that all carers are referred to by their first names only.

It is the role of the SARS Officer to use their discretion in both fulfilling the applicant’s request whilst preserving the confidentiality of the foster carer. The authority must also bring that discretion to bear with regards foster carers, when considering the difference between fact and opinion, in that carers will fulfil a role similar to that of a relative e.g.:

‘Paul had gone missing and was found 5 hours later, drunk. We (the carers) felt that he had gone too far this time and felt stupid for trusting him’.

This sentence could be redacted to read either:

‘Paul had gone missing and was found 5 hours later, drunk’ and we remove the personal views and opinions of the carers;

or

‘Paul had gone missing and was found 5 hours later, drunk. We (the carers) felt that he had gone too far this time and felt stupid for trusting him’ if we know that the carers had made their personal views and opinions clear to the young person.

10.4 Third Party Opinion

If records show the opinions of a third party that the applicant is already aware of (e.g. attending meetings where the third party was present and hearing those opinions first hand) they can be freely disclosed.

If records show the opinions of a third party that the applicant would not have been made aware of at the time, these opinions can only be disclosed with third party consent. Where no consent has been given or it is not possible to get consent, the SARS Officer must decide whether it would be reasonable to pass on the information to the applicant, where it has had a bearing upon their time with the authority.

Where there is any doubt, it is advisable that any statement which is ambiguous or has the potential to adversely affect either the applicant or the third party, is removed.

10.5 Health and Medical Records

Health and medical records will not be released unless consent has been received following consultation with the relevant health care professional or organisation – this could be either the professional who treated the person, who drafted documents relating to the person or a current practitioner. It is not necessary to contact the applicant in order to seek third party consent from a medical professional.

If the records show information that the applicant has previously seen or has been made aware of, it can be released, pending approval from the source organisation or professional – if it is unclear that the applicant is aware of the information or approval from the originating organisation cannot be obtained, then the information will not be released.

Derbyshire County Council may commission health and medical professionals to undertake work on their behalf (e.g. Occupational Therapy referral) – it may be difficult to contact the relevant professional, especially with regards a closed case or there may be a number of associated individuals where seeking consent may be difficult or time consuming. The SARS Officers can, at their discretion, disclose the information in line with the guidance above.

10.6 Legal Records

All records containing communications between the authority and its legal representatives are confidential and will not be disclosed. This status is referred to as ‘legal privilege’ – no correspondence (letter, fax, email or other) from Derbyshire County Council’s legal advisor can be passed on to the applicant. Similarly, no court documents, including court ordered statements, can be passed on to the applicant, as these are the property of the Courts.

10.7 Summarising

In some cases, the number of records and files available for an applicant’s time in care may number many hundreds of pages. While some of this information may be important to the client, much of it may be superfluous (e.g. records of receipts) or repetitious (e.g. duty logs), which may obstruct more relevant data. There will be other occasions when an applicant will request their interactions with a third party, who has not given consent to release information relating to them (e.g. records of conversations at contact or within meetings). When redacted, this can create an unnatural, stilted document that is difficult to read and interpret.

Where appropriate and applicable and, with the consent of the client, the authority can summarise their records – the SARS Officer can discuss how best to summarise a request but it may be that:

  • Some relevant records are processed and redacted as necessary, with an appendix summary, to contain a chronology highlighting and explaining any and all significant events;
  • All records will be condensed into a summary document, to act as a chronology highlighting and explaining any and all significant events, with an additional appendix to index all relevant documents.

10.8 Errors and Amendments

If the applicant considers that the information they have received is inaccurate then they have the right to apply, in writing, with proof, for it to be corrected or erased - if the objection is justified, there is a duty to correct or erase the appropriate information. The term 'inaccuracy' relates to not only incorrect or misleading facts but also to any statement of opinion given by a member of Derbyshire County Children's Services or partnership agency (allowing for third party consent prior to release) that is based on an inaccuracy. Where a client disagrees with the opinion presented, on behalf of Derbyshire County Council, and the objection is justified, the client’s view will be added to their file. The authority has 21 days to amend any records.

The applicant can approach the Information Commissioner or the courts if the correction is not made.


11. Refusing Requests and How to Appeal

If the Children's Services DP/FOI Officer considers there are reasons to refuse a request for access to all or any part of the records (see Section 2, Information - Exemptions and Inclusions) this should be discussed with his or her manager and legal advice should be obtained. Legal advice must always be sought prior to refusal of disclosure.

If refused, the date of the request and reason for refusal must be recorded in the applicants file, as a case note on Frameworki. The decision and the reasons for it should be confirmed in writing to the person requesting access, or in a format appropriate to the needs of the person concerned and be sent within the 40 calendar day Subject Access Request time frame – if there are delays, the Children's Services DP/ FOI should contact the applicant as soon as possible. The reasons for refusal should be explained to the applicant unless there is good reason not to.

If an applicant is dissatisfied with the authorities' refusal to comply with their Subject Access Request, or any part of a completed request or request in process and have exhausted Derbyshire County Council’s complaints procedure (see Complaints Procedure (Derbyshire County Council) and Complaints and Representations Procedure) they can contact the Data Protection Commissioner, with a right to appeal:

Information Commissioner’s Office (England)
Click here to view the Information Commissioner’s Office website
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 01625 545 745 or 0303 123 1113
Fax: 01625 524 510
Email: casework@ico.org.uk

The Information Commissioner’s Office will serve a notice on the local authority either confirming the decision made, or directing it to disclose the information within a certain time - if the local authority do not comply with this it constitutes contempt of court, and they are in breach of the law. If the applicant disagrees with the ICO’s decision they have 28 days in which to take the matter to an Independent Information Tribunal:

First–tier Tribunal (Information Rights)
General Regulatory Chamber
PO BOX 9300
Leicester
LE1 8DJ

Tel: 0300 123 4504
Email: grc@hmcts.gov.uk

For more information on appealing against the Information Commissioner’s Decisions, please see the GOV.UK website.


Appendices

Appendix 1: Glossary

End