{"alias":"contentPage","byline":null,"standfirst":null,"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"gridType":"RichTextBlock","content":"\u003Cp\u003E\u003Cstrong\u003EThe following is provided by way of general guidance. For more detailed explanation and guidance please refer directly to the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/\u0022 target=\u0022_blank\u0022 title=\u0022Information Commissioner\u0027s Office website\u0022\u003EInformation Commissioner\u0027s Office (ICO) website\u003C/a\u003E.\u003C/strong\u003E\u003C/p\u003E\n\u003Cp\u003EWhen a person requests a copy of their personal data from either The Scouts UK headquarters or a Scout Group, District, County / Area / Region (Scotland), then they are in effect making a Subject Access Request (SAR) under the UK Data Protection Law, which provides rules as to how an SAR must be complied with.\u00A0\u003C/p\u003E\n\u003Cp\u003ESometimes SARs will be submitted to multiple levels of Scouting. Each Scout Group, District, County / Area / Region (Scotland) is created and operates as an independent charity in its own right and is an independent data controller for much of its data processing. This means that each Unit that receives a SAR must respond to it independently.\u003C/p\u003E\n\u003Cp\u003EWe refer to the person whose data is being requested as the data subject.\u003C/p\u003E\n\u003Cp\u003EA request for a SAR can be made in writing or any other means the data subject chooses as their preferred communication channel, (verbally for example), within reason. The deadline for compliance is one calendar month commencing from receipt of the SAR request. This deadline can be extended if the SAR is complex or numerous to three months but the explanation for why needs to be communicated to the data subject within the first month.\u003C/p\u003E\n\u003Cp\u003EWhen your Scout Group, District, County / Area / Region (Scotland) receives a SAR the following process can be followed:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003EApplication:\u003C/strong\u003E Data subject to provide request scope or complete \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk//media/wchge450/template-subject-access-request-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Template Subject Access Request Form\u0022\u003ESAR Request Form\u003C/a\u003E.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EIdentity Evidence:\u003C/strong\u003E You must be certain you are giving the data to the correct person. The best way to do this is to ask for identification such as current passport or driving licence.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ERequest Logged:\u003C/strong\u003E The date by which the identification checks, and the specification of the data sought should be recorded in a SAR Register.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EDiscovery:\u003C/strong\u003E The Trustee Board discovers all instances where the data subjects\u0027 personal data is present (within the scope of the request). Having a Data Inventory will help guide this.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EResponse:\u003C/strong\u003E Trustee Board to respond to data subject in electronic format and response logged.\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":true,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EA SAR only applies to \u0027personal data\u0027. This is any information held about the data subject whereby the subject can be identified from the information. Names, addresses or specific roles are obvious ways of identifying individuals, but they can also be identified in photos or CCTV images.\u003C/p\u003E\n\u003Cp\u003EA mere passing reference to an individual is not necessarily classed as personal data e.g. the Minutes of a meeting will not be considered personal data about those attending in general. However, if an individual was specifically discussed and is identifiable from the Minutes, then the Minutes will be \u0027personal data\u0027 about that individual.\u003C/p\u003E\n\u003Cp\u003EIt\u0027s important to note that the SARs do not cover individuals collecting information solely for their own domestic and household affairs e.g. a personal address book or images taken for family purposes.\u0026nbsp;\u003C/p\u003E","label":"a) What is personal data?"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EThe rules apply particularly to computer or automated records (including email) but can also apply to manual records which enable information about a particular individual to be easily retrieved e.g. filed by the name or role. Due to the nature of Scouting, deciding what information is relevant can be tricky, however, we would suggest that the rules will apply to data regarding the data subject held by the Scout Group, District, County / Area / Region itself and also shared by the Trustee Board members either between themselves or with others.\u003C/p\u003E\n\u003Cp\u003EExamples of automated records include:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EComputer files - files stored on removable storage devices, cloud storage, CD-ROMs, DVDs, hard disks, back-up files, emails\u003C/li\u003E\n\u003Cli\u003EAudio/Video - CCTV, webcam images\u003C/li\u003E\n\u003Cli\u003EDigitalised images - scanned photos, digital cameras\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EExamples of manual records include:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EPaper files - on volunteers, young people, employees\u003C/li\u003E\n\u003Cli\u003EIndex systems - names, addresses, other details\u003C/li\u003E\n\u003Cli\u003EMicrofiche records - containing personal data\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe rules only apply to information actually held. It may be that certain information has been destroyed/deleted locally as should be normal practice when it is no longer required. However, data must not be deliberately deleted once a SAR has been received, to avoid disclose.\u00A0\u003C/p\u003E","label":"b) What kind of records do SARs cover?"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EYou need to consider all the places that you may hold information about the individual within the scope of the request. If you have a data inventory this will be a useful place to start as it will contain details of the main places where personal data is held. Likely places to start are:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EEmail inboxes\u003C/li\u003E\n\u003Cli\u003EElectronic folders (either locally stored or in the cloud)\u003C/li\u003E\n\u003Cli\u003EFiling cabinets\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EOne topic that can come up is whether there is a need to seek information that is held on personal devices. The key thing is to determine whether the data was processed for Scouting purposes. The ICO say the following:\u003C/p\u003E\n\u003Cp\u003E\u003Cem\u003EWe do not expect you to instruct staff to search their private emails, personal devices or private instant messaging applications in response to a SAR, unless you have a good reason to believe they are holding relevant personal data.\u00A0\u003C/em\u003E\u003C/p\u003E\n\u003Cp\u003EWith regards to the depth your searches should go, the ICO state:\u003C/p\u003E\n\u003Cp\u003E\u003Cem\u003EYou should make reasonable efforts to find and retrieve the requested information. However, you are not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to the information.\u003C/em\u003E\u003C/p\u003E","label":"c) How do I search for data?"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EThere are exemptions to disclosure but, in the main, these are very specific and tend to apply to particular cases e.g. confidentiality of police investigation or certain HR records. It\u0027s quite rare for exemptions to apply more generally and decisions must be made on a carefully considered discretionary basis, which can be justified. Also, when they do apply this may not necessarily mean that a whole document is exempt e.g. the exemption could apply to a part or parts of a document. Please see the ICO website for further explanation and to see whether any exemptions may apply, which can be accessed here, \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/exemptions/a-guide-to-the-data-protection-exemptions/#ex5\u0022 target=\u0022_blank\u0022 title=\u0022Guide to the data protection exemptions\u0022 data-anchor=\u0022#ex5\u0022\u003EA guide to the data protection exemptions\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EThe main reason that data will be redacted from documents / records is because that information could directly or indirectly identify another individual, and they have not given their permission for this to be disclosed.\u003C/p\u003E","label":"d) What data can be withheld or redacted (i.e. deleted) when disclosing the SAR to the data subject and how?"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EIn your response you should also provide the following information to the data subject:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003Ewhat you are using their information for;\u003C/li\u003E\n\u003Cli\u003Ewho you are sharing their information with;\u003C/li\u003E\n\u003Cli\u003Ehow long you store their information for and why;\u003C/li\u003E\n\u003Cli\u003Edetails on how they can ask if the information is correct, ask to have it amended or deleted, object to or restrict your use of it;\u003C/li\u003E\n\u003Cli\u003Edetails on their right to complain to the ICO;\u003C/li\u003E\n\u003Cli\u003Edetails about where you got their information from;\u003C/li\u003E\n\u003Cli\u003Ewhether you use their information for profiling or automated decision-making and how you are doing this; and\u003C/li\u003E\n\u003Cli\u003Ewhat security measures you use if you have or will transfer their information to a country outside the UK or an international organisation.\u003C/li\u003E\n\u003C/ul\u003E","label":"e) What other information should you include in the response to the SAR?"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EFollowing the receipt of the information, a data subject may raise concerns or a formal complaint. This can include dissatisfaction with the accuracy of the information held, or concerns about the practice it highlights. In these instances, you will need to determine which process to refer them to, such exercising another data subject right (i.e. right to rectification) or the complaints process.\u003C/p\u003E\n\u003Cp\u003EOn some occasions data subjects will come back and express dissatisfaction with the response, for example if they believe that the information provided was incomplete or was excessively redacted. If they have not specified what data they believe has been omitted, you should ask them to confirm this and provide details.. You should then undertake further checks, including liaising with those who provided the information for the initial disclosure. This may also widen the scope of the request, meaning different search parameters.\u003C/p\u003E\n\u003Cp\u003EWhen responding to the data subject you should remind them of their right to complain to the Information Commissioner\u2019s Office.\u0026nbsp;\u003C/p\u003E","label":"f) What if the data subject is not happy with what they have been sent?"}]},{"gridType":"RichTextBlock","content":"\u003Ch3\u003E\u003Cbr\u003ERedactions\u003C/h3\u003E\n\u003Cp\u003EIt is really important that you do not disclose information about third parties in the course of responding to a SAR. In many cases documents will contain information about multiple people. To avoid this you need to carefully consider removing or redacting this information.\u0026nbsp;\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":false,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003E\u003Cstrong\u003EThe following is provided by way of general advice. Please also see guidance on Subject Access Requests on this page and in \u003Ca href=\u0022/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/\u0022 title=\u0022Step 4: Understanding data subjects\u0027 rights\u0022\u003EStep 4: Understanding data subjects\u003C/a\u003E.\u003C/strong\u003E\u003C/p\u003E\n\u003Cp\u003EUnder the rules, an individual is entitled only to their own personal data and not to information relating to other people. Therefore, when disclosing personal data to data subjects it is important not to inadvertently disclose personal data about third parties in the process. You have be careful not to breach the data protection rights of those third parties, unless those third parties have expressly consented to their information being disclosed. You should also remember to redact your own personal data.\u003C/p\u003E\n\u003Cp\u003EOnce they received the data the data subject may share it, store it unsecurely or misplace it. Therefore, the documents you send to the subjects will need to be checked very carefully and any personal data relating to third parties \u0027redacted\u0027 i.e. deleted/crossed out - to the extent that it is not visible to the requester.\u003C/p\u003E\n\u003Cp\u003ERedactions can be done electronically, using tools such as Adobe Acrobat Pro or Microsoft Word, or on paper using a pen or tape. The key thing about both methods is to ensure that it is not possible for the data subject to see any trace of what you are removing. Using electronic tools this will mean removing meta data. For paper methods this will mean not being able to see the data beneath the tape or red pen. Photocopying the redacted documents can sometimes help with this.\u0026nbsp;\u003C/p\u003E\n\u003Cp\u003ERemember, to keep a copy of the original documents too, as well as records of the decision taken relating to what to remove or redact.\u003C/p\u003E\n\u003Cp\u003EIt\u0027s important to note that you should not generally withhold whole documents just because they contain the details of third parties. It is usually preferable to redact just the details of those third parties so as to ensure that they cannot be identified, or any information is not revealed about them. However, where even after redaction, the identification of third parties is still possible then you may be able to withhold the whole document but you will need to assess this very carefully.\u0026nbsp;\u003C/p\u003E\n\u003Ch4\u003ESome basic rules to apply when redacting\u003C/h4\u003E\n\u003Col\u003E\n\u003Cli\u003EThe information disclosed should relate to the data subject making the request - do not include irrelevant information.\u003C/li\u003E\n\u003Cli\u003EParticular care should be taken when redacting to ensure that the personal data of other individuals is not released - that is any data which would allow you to identify the people from the data combined with other information held.\u003C/li\u003E\n\u003Cli\u003EThe following general rules should be applied \u2013 although there may be specific incidents when they would not:\n\u003Cul\u003E\n\u003Cli\u003Eredact names other than that of the person making the request\u003C/li\u003E\n\u003Cli\u003Eredact job/role titles\u003C/li\u003E\n\u003Cli\u003Eredact e-mail addresses\u003C/li\u003E\n\u003Cli\u003Eredact addresses\u003C/li\u003E\n\u003Cli\u003Eredact phone numbers\u003C/li\u003E\n\u003Cli\u003Eredact references to an individual\u0027s gender if that would lead to them being identified\u003C/li\u003E\n\u003Cli\u003Eredact personal descriptions which may lead to a person being identified, for example \u2018a red haired man with a beard\u2019\u003C/li\u003E\n\u003Cli\u003Eredact any other narrative data that would lead to an individual being identified\u003C/li\u003E\n\u003Cli\u003Ethink about the combination of information sets that taken together would lead to an individual being identified.\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003ETake extra care when considering young persons data, or data relating to safeguarding cases\u003C/li\u003E\n\u003Cli\u003EWhen taking out personal details from email headers, leave in the date and title line unless the title line conflicts with the above.\u003C/li\u003E\n\u003Cli\u003EIn many cases if you find things that the data subject has already been sent or sent themselves (for examples, emails) you can often leave them unredacted. However this will not be the case for things they received or sent in their Scouting role, particularly if it involved young people, and this information may need to be redacted.\u0026nbsp;\u003C/li\u003E\n\u003C/ol\u003E","label":"Guidance on redacting information"}]}]}],"config":null}]},"searchDescription":"","pageType":null,"location":null,"browserTitle":"","versionDate":"15 July 2023","reviewDate":"29/10/2020","redirectUrl":"","id":47231,"nodeName":"Subject Access Requests","title":"Subject Access Requests","type":"contentPage","image":null,"assets":null,"headerOptions":{"headerTitle":"Subject Access Requests","headerSubTitle":"","headerCta":"","headerCtaText":"","headerCtaLink":"","headerBackgroundColour":"0061ce","showSEOImage":false,"headerBackgroundImage":null,"quickLinks":[]},"subHeader":"","silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIzMSJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/subject-access-requests/"}