You have the right to get a copy of the information that an organisation holds about you. But at the moment, under the Data Protection Act, this usually costs £10.
On 25 May 2018, the General Data Protection Regulation (GDPR) comes into force and this £10 charge will end.
The Information Commissioner’s Office (ICO), which regulates this area, tells organisations that after 25 May they:
must provide a copy of the information free of charge. However, you can charge a ‘reasonable fee’ when a request is manifestly unfounded or excessive, particularly if it is repetitive.
As a debt adviser, I often see people saying “I am not sure what I will get or how much use it will be, and I don’t want to waste £10.” Being able to check for free will be a big improvement for consumers.
The access will also have to be faster. Now organisations have 40 days to reply – after GDPR comes in, they will have to reply within a month.
How to ask for your data – a Subject Access Request (SAR)
Asking for information a firm holds about you is often described as making a Subject Access Request (SAR) – it’s called that because you are the subject and you are requesting access to your data.
The ICO has a detailed page with a template letter: Find out how to request your personal information.
That page describes how to do this now – including probably having to pay a fee and putting a reference in your email/letter to the Data Protection Act. When the new rules come in on 25 May, the ICO will update this page to have a new template letter referring to your right under the GDPR to have free access to your data.
As the ICO says, it’s worth doing a bit of research to get your letter or email to the right place. Because firms are expecting more data access requests after GDPR, they are currently getting ready for them. Some firms that have never had a data access or privacy page on their websites are getting these set up. And some larger firms may be trying to automate some or all of the process. So do look at the firm’s website to see if they explain how to ask for your data and who to send the request to. If there is a form, it will usually be quicker to use that, rather than write a general letter.
Also if you know what you want, ask for it specifically, rather than be sent a lot of information you don’t need. This may make it quicker to deal with your request.
Some practical examples
Here are some situations in which you may want to use a SAR to access your data – and a couple where you shouldn’t!
Get a list of your loans from a lender
If you want to ask a payday lender for a refund and you don’t know all your loan details, it’s good to ask the lender for a list. Some lenders insist this is a SAR and try to charge £10. From 25 May they won’t be able to.
Check if your name is on a fraud database
If you are being turned down for credit and you don’t know why, you may want to check the National Hunter and Cifas databases to see if any fraud is associated with your name. Both firms have SAR forms you can use to ask for a check and they will no longer be able to charge £10. See Is your name on a fraud database? for details.
Ask for your credit report
Experian, Equifax and Call Credit, the three credit reference agencies, have to supply you with a statutory credit report when you ask. They currently charge £2 but from 25 May this will be free.
(There are already free ways to check your credit reports. They often include tips about how to improve your credit score, but these are pretty generic, no human actually thinks about your situation and gets a plan for you. There are also “helpful” suggestions about which loans or credit cards you might like to apply for – i.e. advertising.)
See what Facebook knows about you
If you are curious about the data Facebook holds about you (and your friends?) there is already a free, online tool for you to request this, and you get the answer back within an hour.
Get health information for an insurer
If you are making an insurance claim, sometimes you need to provide details of your GP’s medical records. At the moment GPs can charge up to £50 – this will be free after 25 May.
Get information before a court case
Whether you are suing someone or being sued, it may sometimes be helpful to send a SAR. A couple I have come across recently:
- a motorist who wants to defend a private parking ticket could send the Parking Company a SAR asking for all the information they about the alleged parking infringement.
- a landlord who wants to sue a letting agent for not conducting proper tenancy checks, could send a SAR to see what records the letting agent kept.
These are often situations where people may have been reluctant to pay £10 for something which may not help their case much, so it’s good the fee is being ended.
DON’T use a SAR instead of responding to court papers
If you have received a Claim Form then you have 14 days to enter a defence – which can be extended by another 14 days if you fill in the ‘acknowledgement of service’ form. You do not have time to send a SAR to find out more information first as you may not get a reply for a month.
It may be good to send a SAR as this may help with your case later, but your top priority has to be responding to the Claim within the time limits – talk to National Debtline to find out your options.
DON’T use a SAR to ask for your CCA agreement
If you want to ask a creditor for a copy of the Consumer Credit Act agreement for your loan, credit card, catalogue or hire purchase agreement, then there is a special procedure to do this, see National Debtline’s factsheet Credit agreements – getting information. This involves you paying £1. This is not a SAR and, so far as I know, the GDPR changes will not affect the £1 charge.
If you follow the special procedure then the debt collector has to try to obtain a copy of the CCA agreement and if they can’t do this within 12 days, the debt is unenforceable in court until they can do this. If you send a SAR instead, you do not have this protection. NB your request for the CCA agreement should be sent to the debt collector, not the original creditor.
What if you don’t get sent the information you want?
The ICO’s page Find out how to request your personal information covers what to do if:
- you do not get a reply in time;
- you think there is additional information you should have been sent.