The ICO has issued guidelines to help small
companies deal with requests for information under the Data
Protection Act (DPA). Aware that small companies can often feel
overwhelmed by such requests and the complexity of the Act, the ICO
has advised that as many requests as possible be treated
informally.
"Individuals have a right under the Act to
make a request in writing for a copy of the information you hold
about them on computer and in some manual filing systems," explains
the advice. "This is called a subject access request. They are also
entitled to be given a description of the information, what you use
it for, who you might pass it on to, and any information you have
about the source of the information."
"Where you are happy to provide the
information requested it often makes sense to do so as part of your
normal course of business, rather than treating any written request
for personal information as a formal request under the Act," it
says.
That informal process involves simply giving
out the information, such as a guarantee number for a fridge or
simple information related to a service that a company provides to
an individual.
More complicated requests which are made
formal can involve more data and can trigger some fixed rules. If
you charge a fee for processing information, which can only be up
to £10, then you must provide the information within 40 days of
receiving that fee, for example.
The guidance also says that any codes used in
the data held by a company must be fully explained so that the
person receiving the information is able to make full sense of
it.
Companies must also be careful when providing
information that involves a third party. Unless it has the explicit
permission of a third party to pass on data to the requester, the
company must black out that information, while providing as full a
disclosure as it can to the person who made the request.
"The Data Protection Act gives us all
important rights, enabling us to check the personal information
that is held about us and to correct that information where
necessary," said David Smith, the Deputy Information Commissioner.
"This guidance sets out clear advice for small and medium sized
businesses to help them deal with requests from individuals for
access to information an SME might keep about them."
The guidance says that a company which is
confused about exactly what an individual wants from a request
should seek clarification, and that it should ensure that its staff
are trained to recognise a subject access request when they see
one.
