Subject access requests and GDPR

[MGMidget]

Does anyone have any knowledge or experience of this please? If you want to get information from a public body that might be embarrassing or expose an element of incompetence can they refuse to provide it? I am trying to get some info out of a local authority and despite it being a relatively small amount of information (relating to correspondence on one small matter) they have called it 'complex' and exercised their right to a one month extension. I anticipate this dragging on and on so if anyone has had to overcome similar obstacles I would appreciate any tips you can give me. Thanks.

No, they cannot. If they fail to provide the requested information you should refer the matter to the ICO.

Do an FOI request.

I did an FOI request to get some general info which was fine and uncontroversial. I then did a subject access request for personal data but it looks like they may be able to refuse it when there are other parties mixed up with the data unless they get permission from them to release it. In this case they won’t because it is controversial. We have a legitimate interest in receiving the data as it concerns a statutory process but i have read that local authorities dont have to disclose on the legitimate interest ground. Therefore it seems like we may not be able to get it without issuing court proceedings against them. I am interested to know who has has struggles like this and what could you manage to do about it or did you never get the info?

They can’t refuse it but they can redact it, and you have the right to ask why each item has been redacted.

OK, thanks. The request I made was specifically for their response to an application by a particular person so perhaps I need to reword my request? Because if they supply info they are admitting it is in response to that person even if they redact their name? I am wondering if I reword it to say their response to an application made on such and such a date at such and such a time without naming that person then its specific enough to confine the data to responses to that application but they don't have to identify the person making the application. Is that the way to do it (for anyone who has had to work their way round these rules before?). That would be enough info for me since I already have the record of the person who made the application and can match up my records with anything anonymised that they supply in relation to an application made on that date.

Hang on, a DSAR can only be made to request information about yourself. Is the response your are looking for actually about you, and are you mentioned/identifiable as the data subject? Otherwise OP they won’t provide you with it, and would potentially be in breach of GDPR if they did.

You can’t receive information on another person, as a PP has said. You are the data subject and can have information they hold on you only.

If you’re trying to find our, for example, what was said between the council and somebody applying for their child’s school place, you wouldn’t be allowed such information, even if it is redacted, as this isn’t linked to information they hold on or about you.

Legitimate interest is to do with their reason for processing your data. It’s not a reason to refuse a DSAR.

You can only make a DSAR for info relating to you or a minor child aged under approximately 13.

You can’t make a DSAR for information relating to anyone else, UNLESS they have appointed you as an agent to act on their behalf and have given their explicit consent to this. The authority will not supply you with that. For them to do so would be a breach of GDPR/DPA.

You cannot get information that relates to another identifiable individual. It doesn't matter how you word your request, it is clear that you will be able to identify the individual concerned so they cannot give you that information.

I encountered a similar problem and contacted the ICO. They are allowed to extend the period, with justification, but you are also similarly allowed to refer this to the ICO if you suspect an extension is unjustified.
Also, I found it is worthwhile wording your FOI/GDPR request to specifically highlight you are are requesting any information pertaining to yourself including email as well as files/paperwork. A lot of extra material appeared when we did a second request for this. Also indicate you would like material that may not identify you just by name, but by other identifying data such as date of birth, NI insurance number etc.
Often you find these are included int he subject of an email to allow communication to happen that wouldn't ordinarily happen if they search for your name.