The Data Protection Act 2018 and the General Data Protection Regulations (GDPR) give individuals the right of access, commonly referred to as subject access, it allows the right to obtain a copy of their personal data, as well as other supplementary information. It helps individuals to understand how and why you are using their data, and check you are doing it lawfully.
· Individuals have the right to access and receive a copy of their personal data, and other supplementary information in either Electronic, written, and verbal format
· This is commonly referred to as a subject access request or SAR
· Individuals can make SARs verbally or in writing, including via social media however if verbal further identification will be needed
· A third party can also make a SAR on your behalf provided you have granted them permission in the form of signed consent or a legal document such as Lasting Power of Attorney
· All information must be provided to the requester within one calendar month from the date the organisation has received your request unless this is deemed a complex SAR to which an organisation can extend your request by a further two months. The individual must be informed within the first month of this decision
· All requesters do have the right to complain to the Information Commissioners Office (ICO) if you are unhappy with the response to your SAR. You can access this via their website or call 0303 123 1113. You also have the right to seek a judicial remedy
The Access to Health Records Act 1990 gives people a right to see the health records of somebody who has died. These people are defined under section 3(1)(f) of that act as ‘the patient’s personal representative and any person who may have a claim arising out of the patient’s death. Next of kin have no automatic right of access to these records. Individuals meeting the criteria above will be required to provide proof, e.g., a copy of the will naming the requestor as the executor, grant of probate or a letter from a solicitor regarding a claim. The Act only allows access to records recorded after 1 November 1991.
East Lancashire Hospitals NHS Trust has a duty as an organisation dealing with highly sensitive and confidential information to keep your personal information secure. We as an organisation will only provide information to you as the Data Subject or a third-party requester if we are satisfied, you’re the correct recipient of this information. Any information you have supplied in making this request will be treated in strict confidence.
Our Trust is only responsible for providing information, which is held by us. If your request indicates the release of information to a third party for example a solicitor or insurance company then a signed consent form or other relevant proof of entitlement will be needed to authorise the release of your personal data.