DSAR Request Information not disclosed

paraza

I've recently requested a DSAR from a legal regulatory body. The response I have had is that they can only partially disclose as they don't have the permission of someone who is in the correspondence. I thought they had to release all information requested concerning me? They say it is exempt from disclosure. Should I go back and contest this? They say if I'm not happy with their response to refer this to the ICO. Thank you

user1977

If it includes somebody else's personal data then it's exempt from disclosure (indeed it may be an offence for them to disclose it).

Brie

If the information may be immaterial to you (i.e. not related to what you are asking about) then you could ask for a redacted copy.  

So if it's a document saying "we won't be paying anything to the following individuals" and then lists your name and address along with somebody else's they could black out that person's name and address so you could see that you were on the document.

If the document is about how you and somebody got drunk and you talked them into getting tattoos across their face then that is material because you would know who it is about.   and they wouldn't have to give you a copy.  (sorry trying to think of something ludicrously obvious)

eskbanker

Just to amplify on the above, https://ico.org.uk/your-data-matters/your-right-to-get-copies-of-your-data/what-to-expect-after-making-a-subject-access-request/#g is where it's highlighted that in some circumstances redaction can be used to preserve all parties' rights:

An organisation may also refuse to give you your information if it also includes personal information about someone else, except where:

• the other individual has agreed to the disclosure; or

• it is reasonable to give you this information without the other individual’s consent.

In their decision-making, an organisation has to balance your right of access against the other individual’s rights over their own information.

This may lead the organisation to refuse your subject access request.

Alternatively, the organisation may attempt to remove (or edit out) the other individual’s information before sending your information to you. This is commonly known as ‘redaction’.

This could mean you only receive partial information – such as copies of documents showing blanked-out text or missing sections.

In any case, an organisation normally needs to:

• tell you why they are not taking action;
• justify their decision; and
• explain how you can challenge this outcome.

See our guidance on exemptions for organisations for more detail on this topic.

paraza said:

I've recently requested a DSAR from a legal regulatory body. The response I have had is that they can only partially disclose as they don't have the permission of someone who is in the correspondence. I thought they had to release all information requested concerning me? They say it is exempt from disclosure. Should I go back and contest this? They say if I'm not happy with their response to refer this to the ICO. Thank you

To what extent do you believe it would be reasonable and/or relevant for the body to provide redacted data?