0370 270 6000

Complaints, investigations and reviews: data protection issues

6 September 2018

Data protection legislation changed on 25 May 2018, with the consequence that the bases on which personal data could be lawfully processed, and the grounds on which personal data could be withheld from the data subject, have been narrowed.

The new legislation, consistent with its renewed focus on the rights and freedoms of data subjects generally, allows subject access requests to be made verbally (although provides that steps can be taken to verify the identity of the requestor), provides that a £10 fee may no longer be charged, and requires a response to be provided within one month (two months if the request is deemed by the controller to be complex). The Data Protection Act 2018 retains many of the exemptions to the right of subject access that were available under the previous legislation, but introduces some important changes in relation to information produced in connection with social work.

Generally, where person A makes a subject access request, and information held about A includes information about person B, the information about B cannot be disclosed unless B has consented to the disclosure or it would be reasonable to disclose the information without B’s consent. These provisions were applied to opinions expressed by B (even in a professional capacity) and used as a reason not to disclose those opinions to the data subject. DPA 2018 removes this protection in relation to health, education and social workers. It imposes an assumption of reasonableness in respect of the personal data of such workers that relates to those persons acting in their official capacity – namely that the disclosure of such data (including expressions of opinion by social workers acting in their official capacity) will be reasonable without consent.

Part 3 of Schedule 3 to DPA 2018 provides a range of exemptions to the right of access that apply in relation to data processed for a variety of specified social work purposes by a variety of individuals/organisation, including where disclosure of the data to the data subject would be likely to prejudice carrying out social work because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual, or where the data subject is under 18, the requestor has parental responsibility for the data subject and the data subject would not have expected it to be disclosed to the requestor or has expressly indicated it should not be so disclosed.

The general trend is therefore an expansion of the right of subject access – the requirement to demonstrate a risk of serious harm is a high hurdle, and the provisions about children emphasise the need to discuss disclosure at the time of assessment/intervention. Care should always be taken when recording information about identifiable individuals and pseudonymised data should be used wherever possible. Such data is still personal data in the hands of the controller but gives rise to a far lower level of risk if lost or otherwise falls into the wrong hands.

Focus on...

Legal updates

Reinstatement for property damage losses – when does it apply?

The Court of Appeal has recently considered the correct test for measuring the indemnity for property damage losses and has provided useful guidance on whether an insured needs to intend to reinstate the property to its pre-loss condition.


Legal updates

Coronavirus (COVID-19) insurance considerations

With instances of COVID-19 rapidly increasing throughout the UK, many businesses are considering the options available to limit staff and customer exposure to Coronavirus.


Legal updates

Good insurance business # 1 - Insurance Product Value and the duty to act in the best interests of customers: risks from intermediary remuneration

On 19 November 2019, the Financial Conduct Authority (“FCA”) published “Finalised guidance” (FG19/5) for “insurance product manufacturers and distributors”.


Legal updates

Financial Services – ‘Duty of Care’ Bill: consumer protection or damp squib?

The Financial Services Duty of Care Bill (the “Bill”) was introduced into the House of Lords in October 2019 and had its second reading on 9 January 2020.


The content on this page is provided for the purposes of general interest and information. It contains only brief summaries of aspects of the subject matter and does not provide comprehensive statements of the law. It does not constitute legal advice and does not provide a substitute for it.

Mailing list sign up

Select which mailings you would like to receive from us.

Sign up