05/05/2010 1:51 pm
From: http://www.cfoi.org.uk/persfilesintro.html
Applying under the DPA
The person holding information ('data') about you is called the data controller. To apply, write to the data controller, saying that you are applying under section 7 of the Data Protection Act 1998 for access to any personal data about yourself. Sending your request by recorded delivery will help avoid any later dispute about whether it was received. If the data controller has different offices or branches and you're not sure which to write to, telephone first and ask. Alternatively, contact the Information Commissioner's office or look at the data controller's Register entry, which can be found on the Internet at www.dpr.gov.uk.
Organisations must register under the Act and provide an address for 'subject access' requests in their register entry. The register entry must also specify the purposes for which information is held. A data controller must not hold or use the information for purposes incompatible with those stated in the register entry.
Before supplying information the data controller is entitled to ask you for proof of your identity and for any further details needed to locate data held about you. It may help if you say what your relationship to the organisation is (eg customer, employee, student, patient), give any relevant dates or reference numbers and say which of its offices or branches you have dealt with - but don't volunteer any information which you regard as sensitive. You do not need to say why you want the information. The data controller cannot refuse access because you might use the data to criticise the controller, complain or take legal action.
You may have to pay a fee. At the time of writing the maximum fee is £10, though some organisations charge less or nothing. If information is held about you in both computer form and in structured paper files, a single £10 fee covers both.
Different rules apply to health and educational records, where you could be charged up to £50 (including the cost of all photocopies) and credit reference agency records where the maximum fee is £2. These fees are explained in more detail later.
The data controller must normally give access within 40 days of receiving your request and any supplementary details needed. It must supply the information in "permanent form". This normally means a print-out or a photocopy, but could also include copies of microfiches, x-rays, or audio/video cassettes. Any unintelligible terms, such as computer codes, must be explained.
The data controller can refuse to supply a permanent copy of the data if this is not possible or would involve 'disproportionate effort'. You would still be entitled to inspect the information.
