Request information we have about you or someone you care for
Under the Data Protection Act 2018, you have the right to find out what information about you or someone you care for is stored or used by Buckinghamshire Council.
You can also ask us for copies of your personal information, including electronic surveillance information, for example, CCTV footage.
This is called your right of access and is known as making a Subject Access Request or SAR.
You can find out more by visiting the Information Commissioner’s Office: your right of access webpage.
Making a Subject Access Request
What details to provide, what your entitled to and when you can expect a response.
We ask that you give as much detail as possible to identify your records, such as:
- your full name and current address including any other names by which you have been known and previous addresses from the last five years if applicable
- date of birth
- contact email and/or phone number
- a detailed description of the information you are requesting, including what service this is in relation to and any names and contact details you may have. The more information you give will help us provide your information more quickly and efficiently
- proof of identity
- any relevant time periods- make sure to give a date range or specific timings, for example, the time of a phone call or CCTV footage
Be very specific about what you are requesting such as:
- 'my employee file'
- 'emails containing my name between person A and person B'
- 'my social care record'
You are only entitled to the actual information and not necessarily to a copy of the documents containing that information.
We will always try to supply the information in its original format. However, it may be that we will either have to extract your information from documents or remove other people’s personal information from documents in order to supply your own to you. This is known as ‘redaction’.
Proof of identity must be two official documents, one of which shows your date of birth, name and current address. Proof of identity can include copies of the following:
- valid UK photographic drivers licence or a valid passport
- recent utility bill (within 3 months) or current Council Tax bill
If you have any issues or concerns around providing suitable proof of identity contact us at [email protected].
The timescale for responding to your request does not begin until we have received the requested information.
We have one calendar month to provide access to the information you request, starting from the day we receive your request. For example, if we receive your request on 10 October, we have until 10 November.
If your request is complex or you make more than one at the same time, we may take a maximum of 3 calendar months, starting from the day we receive your request. We will contact you to let you know if we need extra time.
The time only starts once we receive a clear enough request with the right proof of identity. We will contact you to let you know that the time period has started.
You can find out more by visiting the Information Commissioner’s Office: time limits for responding to Subject Access Requests webpage.
In most circumstances, we will supply a copy of your personal information free of charge.
However, we can charge a ’reasonable fee’ for the administrative costs of complying with a request if:
- it is manifestly unfounded or excessive; or
- you request further copies of your data following a request
If we decide that your request is within the criteria for charging a fee, we will let you know as soon as possible and at the latest within one month of receiving your request.
Administrative costs cover:
- photocopying, printing, postage and any other costs involved in sending the information to you
- equipment and supplies
- staff time
The time limit will not begin until we have received the fee.
Manifestly unfounded requests
A request may be manifestly unfounded if:
- you clearly have no intention to exercise your right of access; or
- the request is malicious in intent and is being used to harass the organisation with no real purpose other than to cause disruption
Manifestly excessive requests
To determine whether a request is manifestly excessive we need to consider whether it is clearly or obviously unreasonable. We will base this on whether the request is proportionate when balanced with the burden or costs involved in dealing with the request.
This will mean taking into account all the circumstances of the request, including:
- the nature of the requested information;
- the context of the request, and the relationship between you and the organisation;
- whether a refusal to provide the information or even acknowledge if we hold it may cause you substantive damage;
- our available resources;
- whether the request largely repeats previous requests and a reasonable interval hasn’t elapsed; or
- whether it overlaps with other requests
In the case of some requests that we consider manifestly excessive and also particularly where we hold a substantial amount of your personal data, we may ask for further clarification from you in relation to the information you have requested.
The time limit for responding to your request is paused until we receive further clarification. This is referred to as ‘stopping the clock’.
If we receive no response to our request for further clarification or you are unable to provide the clarification that we need then we are able to either undertake what we consider to be a ‘reasonable search’ or refuse the request completely.
You have the right to request access to CCTV footage of yourself under data protection legislation but not to access that of any third parties.
Council CCTV footage is held only for a maximum of 28 days from the time of recording (for some systems this time limit is 14 days), so you must make your request promptly following any incident.
If your request relates to damage to your motor vehicle while it was parked and unattended, you should ask your insurance provider/solicitor/accident assessor to make an access request on your behalf.
If your request cannot be complied with, without identifying another individual or individuals, and in the absence of permission from them, your request will need to be considered within the context of the degree of privacy they could reasonably anticipate from being in that location at that time, in accordance with the legislation.
Due to the time and resources needed to view and extract information, speculative requests for CCTV footage which cannot give precise details of the location, date and time of the incident cannot be processed.
We will make the footage available to either by inviting you to arrange a mutually convenient appointment in the council offices for you to view it or by providing you with a copy of the footage instead. If we provide a copy a charge may be made for any materials, plus the cost of postage and packing required to fulfil your request.
If you wish to access CCTV footage of only yourself (no third parties included) that you believe may have been captured by cameras owned by the Council complete the request form below, and in addition to the proof of ID detailed in the ‘Proof of ID’ section above supply the following information to [email protected] :
- what you look like (provide a recent photograph)
- the date and time of the incident – requests for footage are limited to a search of 15 minutes in duration, so be as precise as you can for example ‘Friday 25 May 2020 at 1.24am’
- the exact location of the incident
- a description of what happened
- a description of what you were wearing at the time
- if the request is in relation to a crime
- if you were the only person present
- have you contacted any other agency regarding the incident, and if so who have contacted (for example police, insurance provider, council staff, other)
Council CCTV footage is held only for a maximum of 28 days from time of recording (for some systems this time limit is 14 days), so you must make your request promptly following any incident.
If your request relates to damage to your motor vehicle while it was parked and unattended, you should ask your insurance provider/solicitor/accident assessor to make an access request on your behalf.
Requests on behalf of others
What information to provide when making a request on behalf of someone else.
You can authorise someone else to make a subject access request for you. However, you should consider whether you want the other person to have access to some or all of your personal information.
Depending on the nature of your request, the other person could gain access to information that you may not want to share with them.
We will need to be satisfied that the other individual is allowed to represent you and therefore they will need to supply us with either:
- written authorisation from you; or
- a more general power of attorney
If you are a child, we may need to establish that you understand your rights and you will need to provide us with proof of your identity. If you are making a request on behalf of a child we need to be satisfied that you are entitled to act on their behalf and you will need to provide us with proof of this.
Proof of a child’s identity can be:
- proof of parental responsibility - for example the child’s full birth certificate and/or the relevant court order
Proof of acting on behalf of a child’s can be:
- proof of parental responsibility - for example the child’s full birth certificate and/or the relevant court order
Requests on behalf of older children
For any child aged 13 and above, the legislation of the Data Protection Act applies to them in the same way it applies to adults. As such we must obtain their consent to share any information which we hold about them, in addition to the documents required above to confirm their identity.
However, where they do not have sufficient understanding of their rights or the implications of exercising them, a parent or person with parental responsibility may usually exercise their rights on their behalf.
Sometimes there may be information relating to other people contained in the information that you have requested about yourself. Alternatively, there may be information about you contained in records relating to other people.
You are only legally entitled to your own personal information and not that of other people unless they have given their written consent for us to disclose their information to you.
In addition, you are only entitled to the actual information and not necessarily to a copy of the documents containing that information.
We will always try to supply the information in its original format. However, it may be that we will either have to extract your information from documents and/or remove other people’s personal information from documents in order to supply your own to you. This is commonly known as ‘redaction’.
If you wish to access information about a deceased person who has been under the care of the Council, put your request in writing.
To help us find and retrieve information for you, state exactly what information you require, and provide the following details of the deceased:
- name
- date of birth
- date of death
- last known address of deceased
This information is necessary to help us confirm if we hold records relating to the deceased and locate them for you.
Before we are able to release records about a deceased person, we will need confirmation that the individual is in fact deceased, such as
- grant of probate
- death certificate.
Access to information will only be given to those who are the Executor or the Administrator of the deceased person’s estate. You will need to provide us with evidence of this which is one of the following:
- grant of probate and certified copy of the last will & testament or
- letters of administration – if the deceased died intestate
Also supply us with proof of ID for yourself, showing your name and current address.
If your request is through a solicitor who is acting for you then we will require a signed authority from them.
Make a Subject Access Request online
Make a Subject Access RequestIf you need help or cannot do this online
If you need help, contact [email protected].
If you cannot do this online, you can make a request by post to:
Data Protection Officer
Buckinghamshire Council
The Gateway
Gatehouse Road
Aylesbury
HP19 8FF
How to raise a complaint
If you are dissatisfied with the handling or outcome of your request, you have the right to ask for an Internal Review.
Submit your Internal Review request within two months of the receiving our response to your original request to: [email protected], or by post to:
Information Management
Buckinghamshire Council
The Gateway
Gatehouse Road
Aylesbury
HP19 8FF
If you are not content with the outcome of your Internal Review, you may contact the Information Commissioner (ICO). You can contact the ICO online or by post to:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF