Data Protection advise, really needed, please

[Sore Thumb]

If this is in the wrong section please move, thanks.

Just need a bit of information regarding data protection, ta.

I sent a letter to a organisation in July requesting my personal information and health records. I received no reply to this request, I again made a request in May 2016 and had no reply. I have again asked for my information at the end of May and have only just received an acknowledgement from the organisation of my personal information request, this has been a total of 65 days!! of no response at all.
I have proof of postage and delivery for all my requests.

They are now asking me for £10 to access my information and the 40 days response only starts when they receive my money. Is this correct?

I believe the 40days starts when they receive my first request. Is this correct?

Is it within the law to ignore my requests for personal information for 65 days? and then to only start the 40 days when this organisation feels like it?

I am considering making a official complaint regarding this deliberate ignoring and delaying of my requests to the Information commissionairs office, would this be reasonable?

Any advise on the above would be most helpful thanks.

 

[HF2300]

Best thing to do is have a look at the information commissioner's website, https://ico.org.uk, but the information on there seems to suggest their initial response should be within 20 days and the further response should be within 40 days of your request.

There is information on the ICO website about complaints as well.

 

[midlife]

You are using the Access to Medical Records Act (1990) ....... I think that's the one.....and not the data protection act. And yes, there is a fee to pay

You will have to check the rules as I can't remember them off the top of my head, sorry.

Shaun

 

[classic33]

40 days to respond to the initial request. Letter template on the ICO website.

They have to detail any reason for the delay in answering.

 

[Sore Thumb]

You are using the Access to Medical Records Act (1990) ....... I think that's the one.....and not the data protection act. And yes, there is a fee to pay

You will have to check the rules as I can't remember them off the top of my head, sorry.

Shaun

No its not access to medical records.

 

[Sore Thumb]

40 days to respond to the initial request. Letter template on the ICO website.

They have to detail any reason for the delay in answering.

They have said nothing about the delay. Just to say that the 40 days ONLY starts when they get my money.

If this is the case then any company can ignore you for however long they feel like it. When they do decide to answer they can say. well the 40 days required by law only applies when we say it starts, and not until we get your money.

I think they know they have not applied the law by no responding/ignoring me for over 60 days. They did respond to other points in my letters but ignored my request for personal information, so I know they have seen my letters.

 

[gavgav]

https://ico.org.uk/for-the-public/personal-information/

This should give you what you need. They can and will charge you a fee, up to £10 and it is 40 days to respond from when they receive the fee.

 

[Sore Thumb]

https://ico.org.uk/for-the-public/personal-information/

This should give you what you need. They can and will charge you a fee, up to £10 and it is 40 days to respond from when they receive the fee.

The thing is i'm interested in the situation regarding ignoring and not replying to my repeated requests for 65 days. There should be a time limit, if not then a company can ignore you for years and then when they feel like replying, then say "well the 40 days only starts when we get your money".

But thanks for the link.

 

[gavgav]

The thing is i'm interested in the situation regarding ignoring and not replying to my repeated requests for 65 days. There should be a time limit, if not then a company can ignore you for years and then when they feel like replying, then say "well the 40 days only starts when we get your money".

But thanks for the link.

I agree, and i think you are within your rights to complain to the ICO. It was one of my first jobs in the NHS, to deal with these requests, but have changed roles a few times since then. Also be aware that there are separate charging arrangements for records that are stored in paper format, up to, I believe £50!

 

[midlife]

No its not access to medical records.

It's just that you said you wanted copies of your health records........

Shaun

 

[Sore Thumb]

It's just that you said you wanted copies of your health records........

Shaun

I am after health records as well, but I dont think they come under medical records as meaning a hospital or GP etc.. But maybe im wrong.

 

[gavgav]

Medical and health records are the same thing as I understand it. Your GP surgery will hold your GP records, if you are registered with one.

 

[classic33]

Medical and health records are the same thing as I understand it. Your GP surgery will hold your GP records, if you are registered with one.

Hospital gets one request & GP/Surgery gets a similar, but seperate request.

 

[srw]

https://ico.org.uk/for-the-public/personal-information/

This should give you what you need. They can and will charge you a fee, up to £10 and it is 40 days to respond from when they receive the fee.

This is a very helpful page - including template letters to use.

From the same website, but from the bit aimed at organisations....

Although you need not comply with a request until you have received a fee, you cannot ignore a request simply because the individual has not sent a fee. If a fee is payable but has not been sent with the request, you should contact the individual promptly and inform them that they need to pay.

Some organisations choose not to charge a fee. However, once you have started dealing with an individual’s request without asking for a fee, it would be unfair to then demand a fee as a way of extending the period of time you have to respond to the request.

If you haven't received any reply then I'd raise it with the ICO. The worst that can happen is that they'll tell you to go away.

 

[classic33]

[Your full address]

[Phone number]

[The date]


[Name and address of the organisation]


Dear Sir or Madam


Non response to a subject access request


I am writing further to my letter of [date] in which I made a subject access request because I have not received any response from your organisation.


As the statutory time limit for responding to my subject access request (40 days) has now expired, I would be grateful if you could provide a response as soon as possible.


If I do not receive a response from your organisation within 14 days, I will submit a ‘request for assessment’ to the Information Commissioner’s Office (ICO).


You can find advice on the ICO’s website on how to deal with a subject access request [ico.org.uk/sar] and information on their powers and the action they can take [ico.org.uk/action] or call them on 0303 123 1113.


*If there is anything you would like to discuss, please contact me on the following [telephone number].


Yours faithfully

[Signature]


*optional