Subject Access Request

Individuals who wish to gain access to personal data which Housing and Care 21 may hold and process in their name are required to make a Subject Access Request (SAR). Please refer to the guidance below to understand how you can make a formal request for your personal data.

What am I entitled to receive?

The General Data Protection Regulations ((EU 2016/679) (GDPR)) and the Data Protection Act 2018 gives individuals the right to receive a copy of the personal information which an organisation may hold and process in their name. This right is called ‘Subject Access’.

An individual (data subject) is only entitled to receive copies of their own personal data. Third party personal data will not normally be disclosed under a Subject Access Request and will be redacted (removed) prior to disclosure.

Under the GDPR and the Data Protection Act 2018 individuals can also exercise the following rights:

  • Request that we rectify their personal data
  • Request that we erase their personal data, under certain circumstances
  • Request that we restrict the processing of their personal data
  • Request that we transfer their personal data to another organisation, electronically, under certain circumstances
  • Object to the processing of their personal data, under certain circumstances
  • • Request not to be subject to automated decision-making

Can someone make a request on my behalf?

Personal information will only be provided to a third party in two circumstances:

  1. a. If you have representative acting on your behalf, such as a Solicitor, Power of Attorney, Next of Kin etc. It is important to note that data will only be released to your representative once we have received your explicit consent to do so. Explicit consent must be provided in writing, together with evidence that the person is entitled to act on your behalf. Such evidence can be:
    • A written authority from you to make the request, together with two forms of id in order that we can verify your identity; or
    • A more general power of attorney 
    b. There may be cases where an individual does not have the mental capacity to manage their own affairs. In such a case we will accept written evidence from:
    • An attorney with the appropriate authority to manage the property and affairs of a person lacking mental capacity; or
    • An individual appointed to make decisions about such matters by the Court of Protection.

  2. If the data is required by law e.g. subject to a Police investigation.

Please note that anyone who impersonates another individual to gain access to his or her information may be guilty of an offence under Section 170 of the Data Protection Act 2018 and subject to prosecution.

How do I make a request for personal information?

In order to make a formal, valid Subject Access Request you will be required to:

  • make the request in writing (letter or email)
  • provide a suitable contact postal address and/or email address 
  • provide 2 forms of identification, such as a photocopy of your Birth Certificate, Passport, Drivers Licence or ID Card

We are unable to process your request without this information.
In order to assist you, you may wish to fill out the Subject Access Request Form. Once completed, please mark your request for the attention of the Data Protection Officer and send to either: Dataprotection@housingandcare21.co.uk or:

Data Protection Officer
Housing and Care 21
10th Floor, Tricorn House
51-53 Hagley Road
Birmingham B16 8TP

If you have difficulties completing the form or making a written request please contact us on 0370 192 4000 and ask for the Data Protection Officer.

Is there a fee?

No, in line with the GDPR, Housing and Care 21 do not charge a fee to process Subject Access Requests.

What will I receive?

You will be entitled to receive the data which you have asked for that we hold and process in your name. This can include your client file (which includes data such as your tenancy agreement, support plans, next of kin information etc.).

In certain circumstances, there may be a restriction on the data you are provided. Under data protection regulations and legislation there are certain exemptions which mean we may not be able to disclose information to you. For example, we are unable to provide data which could affect a Police investigation or provide third-party data (unless that third-party data is also about you, you are acting on behalf of someone else, we have the consent of the third-party or it is reasonable in all the circumstances to provide you with the third-party data without their consent). If this is the case we will contact you and let you know the reasons why we are unable to provide the information.

Furthermore, if we do not hold the information which you have requested, we will confirm this in writing, detailing the reasons why, if applicable.

How long does it take?

Under the GDPR and under the Data Protection Act 2018, we are legislatively bound to provide a response to your request within 1 month. At Housing and Care 21, we have interpreted to this to be 30 calendar days. Please note that this timeline is only relevant from the point at which we receive your request in writing, together with the obligatory identification documentation.
Therefore, it is recommended that you send all your documentation as early as possible to avoid any disappointment or delay.

What can I do if I am unhappy with the response?

If you are unhappy with the Subject Access Request response, please let us know the reasons why and we can review our response to you. You can contact us by writing via email at dataprotection@housingandcare21.co.uk or to the: Data Protection Officer, Housing and Care 21, 10th Floor, Tricorn House, 51-53 Hagley Road, Birmingham B16 8TP.

If you remain unsatisfied with our response following the internal review, please contact the Information Commissioners Office (ICO) citing your concerns. The ICO can be via email at https://ico.org.uk/global/contact-us/email/ or to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or you can ring the ICO on 0303 123 1113. Further details on the ICO and their role can be found here www.ico.org.uk 

What can I do if I think the information provided is incorrect or I want to exercise any of my rights under the GDPR and the Data Protection Act 2018?

If you think the information we hold and have provided is incorrect or you want to exercise any of your other rights under data protection regulations and legislation you are advised to contact us in writing and ask us to review the data. You can contact us via email at Dataprotection@housingandcare21.co.uk or to the: Data Protection Officer, Housing and Care 21, 10th Floor, Tricorn House, 51-53 Hagley Road, Birmingham B16 8TP.

The rights that you have under the GDPR and the Data Protection Act 2018 are:

  • Request that we rectify their personal data
  • Request that we erase their personal data, under certain circumstances
  • Request that we restrict the processing of their personal data
  • Request that we transfer their personal data to another organisation, electronically, under certain circumstances
  • Object to the processing of their personal data, under certain circumstances

Request not to be subject to automated decision-making the individual (data subject) is only entitled to receive copies of their own personal data. Third party personal data will not be disclosed under Subject Access Request and will be redacted (removed) prior to disclosure.