SAR carried out by solicitor on behalf of client?

[ReverendCounter]

Is there a specialist 'type' of solicitor/lawyer who undertakes subject access requests on behalf of clients (individuals rather than businesses/organisations) please? I'm struggling to find one so I'm wondering if there is a specific search term I need to use. The organisations are public bodies.

[ATG]

Why not phone a firm of solicitors and ask them if they can help you or recommend someone who can? Do you really need a solicitor to help, though? Why not just ask the organisations yourself?

[Amateurish]

Just do it yourself? Plenty of example letters on the internet.

[ReverendCounter]

I've phoned numerous solicitors and the answer has been no. I'd like a watertight request to be made which would lessen the risk of information being omitted.

[rix]

I don't think there would be any such thing as a watertight request. There are various provisions that would mean that you would not be entitled to all information sought and the responding public authority would be the initial arbitrator. I would suggest sending in the request in plain English and if you are not satisfied then maybe consider engaging specialist advice.

[Amateurish]

[Name and address of the organisation]

[Your name and full postal address]

[Your contact number]

[Your email address]

[The date]

Dear Sir or Madam

Subject access request

[Include your full name and other relevant details to help identify you].

Please supply the personal data you hold about me, which I am entitled to receive under data protection law, held in:

[Give specific details of where to search for the personal data you want, for example:

my personnel file;
emails between ‘person A’ and ‘person B’ (from 1 June 2017 to 1 Sept 2017)
my medical records (between 2014 and 2017) held by ‘Dr C’ at ‘hospital D’;
the CCTV camera situated at (‘location E’) on 23 May 2017 between 11am and 5pm; and
financial statements (between 2013 and 2017) held in account number xxxxx.]
If you need any more information, please let me know as soon as possible.

[If relevant, state whether you would prefer to receive the data in a particular electronic format, or printed out].

It may be helpful for you to know that data protection law requires you to respond to a request for personal data within one calendar month.

If you do not normally deal with these requests, please pass this letter to your data protection officer or relevant staff member.

If you need advice on dealing with this request, the Information Commissioner’s Office can assist you. Its website is ico.org.uk, or it can be contacted on 0303 123 1113.

Yours faithfully

[Signature]

[ReverendCounter]

Thanks, but i have made an SAR to one of the organisations previously. The response was very delayed and the information ultimately provided was incomplete, which is why I want an established legal outfit to undertake it on my behalf who are familiar with the obligations/requirements. It's now a more pressing matter and I'm not having my time wasted further.

[QuickQuack]

Are you looking for all the data about you, or are you interested in a specific subset of your personal data?

This firms has "Legal advice surrounding Data Subject Access Requests" in the list of their services:

https://www.ellisjones.co.uk/services/gdpr

This one has a specific service for individuals who want access to their data:

https://www.forbessolicitors.co.uk/personal/data-b...

If you Google "gdpr data breach claim solicitor" that brings up plenty of solicitors but you obviously need to do your due diligence about the companies it brings up.

[ReverendCounter]

QuickQuack said:

If you Google "gdpr data breach claim solicitor" that brings up plenty of solicitors but you obviously need to do your due diligence about the companies it brings up.

I will do, thanks for your suggestions and advice.

[ATG]

ReverendCounter said:

QuickQuack said:

If you Google "gdpr data breach claim solicitor" that brings up plenty of solicitors but you obviously need to do your due diligence about the companies it brings up.

I will do, thanks for your suggestions and advice.

That sounds like a good way of finding shysters.

As far as I can see there's nothing here that requires any degree of specialisation. Surely any competent solicitor can write a letter for you and then follow up on the response or lack of it? The obligations of someone holding your personal data are pretty clear including his quickly they need to respond to a subject access request. If they fail to meet them, the escalation process is pretty clear too.

[Amateurish]

ReverendCounter said:

Thanks, but i have made an SAR to one of the organisations previously. The response was very delayed and the information ultimately provided was incomplete, which is why I want an established legal outfit to undertake it on my behalf who are familiar with the obligations/requirements. It's now a more pressing matter and I'm not having my time wasted further.

Is this actually a SAR or is it some sort of grievance?

[MarcelM6]

Keep in mind that a SAR is for data that identifies you as an individual. In my experience, this is a very grey area and quite open to interpretation e.g:

Name and Address - clearly identifies you
Medical records - clearly identifies you
Name only - requires context


Where it gets tricky is if you have a common name (john Smith), and you are asking for any emails in a particular organisation with the following search terms:
- John
- John Smith
- Johnny
- Jon
- Smithy
etc

Even if an organisation gets past that hurdle, there are the murky waters of what is personally identifiable information:

Name and address - yes; so they can send you a copy of your name and address
Any emails in which you are mentioned - very debatable

So in conclusion - often what people expect from a SAR and what has to be provided are poles apart.

[QuickQuack]

ATG said:

That sounds like a good way of finding shysters.

Oh absolutely, I'm certain that some will be shysters, hence my comment that one must do due diligence on any firm identified by the search; however, as well as the scam artists, the legitimate ones will also be covered by that search. It will need a bit of weeding, but it isn't difficult to check credentials with SRA. For example, the firm I linked to is registered with the SRA and the two partners in their Data Breach Claims Team are both SRA-regulated solicitors with their own registration.

https://www.sra.org.uk/consumers/register/organisa...

[ReverendCounter]

Amateurish said:

Is this actually a SAR or is it some sort of grievance?

I'd like to find out if information formally presented to two organisations has been recorded properly over a long period. These are organisations that have a responsibility to act on information provided to them. I think that serious matters have been allowed to develop due to the previous information not being recorded and acted on properly. I suspect that this was not a mistake.