boomer

Does anyone know how (or has pointers to web-sites that tell ya properly) to send a Subject Access Request under the DPA??

I have already been to the dpa.gov.uk and dataprotection.gov.uk web-sites, but they are somewhat "chocolate kettle"

Basically, i want to know what data a company has on me!

I believe that i am supposed to write to the Data Controller, but how do i know who he or she is (or is the job title alone sufficient)?

The company can charge up to GBP10, but do i send this up front, or wait for them to send an invoice?

Are there any standard template letters to use?

Are there any tricks that i need to watch out for (either ones to my advantage, or ones that the company might use)??

Thanks in advance,

mb

speedking

Get the correct company details from companies house website and then go to the data protection register website and click on "search register".
You can then search by company name and part address.
My employer just states Data Controller: Company name
so there is no named individual.

HTH

DemonDave

iTrader: (13)

Subject access request

If you want to know whether personal data are held about you and, if so, what personal data are held, you can write to the person or organisation that you believe is processing the data.

This is called a subject access request.

Your request must be made in writing and must be accompanied by the appropriate fee. In the majority of cases, the maximum fee will be £10, but this will vary, particularly if the information requested is for health or educational records. If a subject access request is made to a credit reference agency, then the fee is £2, and the information must be provided within 7 working days.

In your written request, you should ask for a copy of all the information held about you to which the Data Protection Act applies, giving as much information as you can about yourself to enable the person or organisation to whom you are writing to satisfy itself as to your identity and to locate the information. You are entitled to a prompt reply (within 40 days) as long as you have paid any necessary fee. A data controller should act promptly in requesting the fee or any further information necessary to fulfil the request.

You are entitled to be told whether personal data about you are being processed and, if that is the case, to be given a description of the personal data, the purposes for which the data are being processed and the people to whom the data may have been disclosed. You are also entitled to be provided, in an intelligible form, with all the information that forms any such personal data. This information must be supplied in permanent form by way of a copy except in certain circumstances specified in the Data Protection Act.

If the data is factually incorrect, you can ask to have it corrected.

Even if a data controller does not hold information about you, it should reply to say so.
Further information on this is available in the leaflet: "Using the Law to protect Your Information". You can ring the publications line on: 0870 442 1211 or find it on the web site: www.dataprotection.gov.uk

boomer

speedking,

thanks for pointing out the "search register" button on the DPR web-site. The rest of the site is sooooo bland, i completely missed it As with your company, the nice folks that i need to contact are also "Data Controller: Company name", but the fact that they are registered means that they must respond.

DemonDave,

Thanks for the info. I don't know where you got the text from - the same stuff appears all over the Internet, but it doesn't answer the real question. For example, "Your request must be made in writing and must be accompanied by the appropriate fee. In the majority of cases, the maximum fee will be £10" suggests that i must include the fee within the request, but as i don't know what the fee will be, how can i pay it? I am after practical advise, such as you do get at Experian and Equifax (for CRA info).

Cheers,

mb

DemonDave

iTrader: (13)

http://www.lcd.gov.uk/ccpd/saguide.htm

section 3.7

DemonDave

iTrader: (13)

http://www.show.scot.nhs.uk/dataprot...sar_010222.ppt is a good summary