Access to Records

The rights of a data subject to access personal information and records held by the agency are set out in the Data Protection legislation (namely the EU General Data Protection Regulations (GDPR) and the Data Protection Act 2018). Under Data Protection legislation, those in respect of whom personal information is held in any form have a right of access to the information, unless one of the exemptions set out in Section 2, Exemptions to the Right of Access apply.

The right of access applies to both paper / hard copy records and records held electronically. It is important that electronic recording systems comply with the requirements for data subjects to easily find their story in a logical narrative.

A foster carers' assessment records can, with their permission, be shared with another Fostering Agency / local authority Fostering Service if they apply to the new service to become carers.

• The Data Protection Act 2018 (Schedule 3) contains exemptions to the rights of access set out in Article 15 of the UK GDPR for health, social work, education and child abuse data. The right of access which is afforded to data subjects is restricted in the following circumstances: Where the right of access would prejudice carrying out social work because access to the information would be likely to cause serious harm to the physical or mental health of the data subject or some other individual;
• Where the records contain child abuse data; there is an exemption from Article 15 if the application of that provision would not be in the best interests of the data subject. ("Child abuse data" is defined in the Act as personal data consisting of information as to whether the data subject is or has been the subject of, or may be at risk of, child abuse. For this purpose, "child abuse" includes physical injury (other than accidental injury) to, and physical and emotional neglect, ill-treatment and sexual abuse of, an individual aged under 18);
• Where the person is incapable of managing his or her affairs (for example where the person is a child);
• Where complying with the right of access would mean disclosing information which was given by the data subject in the expectation that it would not be disclosed to a third party or it is information which the data subject expressly indicated should not be disclosed;
• Where the data is processed by a court, consists of information supplied in a report or other evidence given to the court in the course of proceedings, the data may be withheld by the court in whole or in part from the data subject.

Access can also be refused if:

• Disclosing information to the data subject would involve disclosing information relating to a third party who can be identified from the information. Unless (a) the other individual has consented to the disclosure of the information to the data subject, or (b) it is reasonable to disclose the information to the data subject without the consent of the other individual;
• Where disclosure may prevent the detection or investigation of a crime or jeopardise public or national security;

Access requests can also be refused if they are 'manifestly unfounded or excessive' (for example if an identical or similar request has been received from the same person and already been complied with).

These exemptions do not justify the total withholding of information but only those records / parts of records covered by the exemptions. The remainder of the case records should be made available to the data subject.

The exemptions above do not apply where disclosure is required by a court order or is necessary for the purpose of or in connection with any legal proceedings.

The practice of all staff should be to encourage routine sharing of information and recording, including providing copies of key documents on an ongoing basis. All recording should be made on the basis that the subject will be reading them, even if in some key exceptions data is withheld.

If a current carer asks to see a particular document or wants to have information, their supervising social worker should discuss this with them to see whether the request can be dealt with informally by showing them the relevant part of the recording or providing a copy of relevant documents.

Those making a formal request for access to their records should be asked to put the request in writing. The receipt of the written request should be recorded by staff, who must verify the identification of the person making the request. If the person making the request is not known personally to those working at the agency, staff must ask for photographic evidence, either through a passport or driving licence.

Prior to access being given, all case records held on the person should be located and collected and the approval of the Fostering Manager should be sought. If approval is not given, this must be communicated to the person seeking access with an explanation.

Staff should carefully check the case records to ensure they are complete and that the information is provided in an intelligible and easily accessible form, using clear and plain language. The whole file should also be checked to ascertain whether any of the material comes within the exemptions to the rights of access and would, therefore, need to be removed / redacted (see Section 2, Exemptions to the Right of Access).

There should be no disclosure of the identity of third parties or other sources of information, and any other information supplied by third parties should not usually be disclosed without that third party's consent. When it is not possible to obtain consent, discretion may be used to release information where there is no possibility of serious harm or it would be reasonable to disclose the information without the consent of the other individual.

An appointment should be made at the earliest opportunity to share relevant information from the case record with the person making the request. The data subject should be reminded to bring appropriate proof of identity.

Staff should be available to explain the contents of the records, to answer questions and to help the person understand the information recorded.

Where the person making the request has specific needs in relation to language, literacy or disability, arrangements must be made to present the information in a suitable format and to involve approved interpreters as needed.

Offering interpretative and supportive counselling may be advisable in certain cases, as well as using a number of interviews to disclose the information in stages.

The data subject should be provided with a copy of the data. A fee may be charged for any requests for additional copies.

Access must be given to disclosable information within 1 month of receiving the request (or 1 month from the point at which the identity of the subject is confirmed or any relevant fees are paid).

In certain circumstances, for example when responding to particularly complex or multiple requests, the agency may take a further 2 months to provide data. If this is the case, the person requesting the information must be informed of the delay within 1 month of their original request and the reasons for the delay explained to them.

Requests from children should be treated in the same way as requests from adults. In each case a judgement should be made by the staff, following discussion with the child's social worker, as to whether the child making the request for access understands the nature of their request. Where appropriate, a parent / carer should be asked to provide written confirmation that the child understands the nature of the application.

Children with disabilities have the same rights as others to have access to information held about them. No assumption should be made about their level of understanding. This should be assessed on an individual basis as with all children.

A child of sufficient understanding should be allowed regular access to information held about them, consistent with their best interests. Relevant documents should be shared unless one of the exemptions set out above applies.

Even if a child is unable to understand the implications of a request, any data held about them is still their personal data and does not belong to anyone else, including a parent. It is the child who has the right of access to information held about them, even though in the case of young children their rights are likely to be exercised for them by people with parental responsibility.

Before responding to a request for access to information held about a child, it should be considered whether the child is mature enough to understand their rights. If they are, they should be responded to rather than the parent.

If staff are unsure about whether a child is able to understand what it means to make a request and how to interpret information they received as a result, they should consider:

• The child's level of maturity and ability to make decisions like this;
• The nature of the personal data;
• Any court orders relating to parental responsibility that may apply;
• Any consequences of allowing those with parental responsibility access to the child's information. This is particularly important if there have been allegations of abuse;
• Any detriment to the child if people with parental responsibility cannot access this information;
• Any views the child has on whether their parents should have access to information about them.

An application by a parent or those with parental responsibility can be refused if it would mean disclosing information which was provided by the child in the expectation that it would not be disclosed, or if the child expressly indicated that it should not be disclosed.

Regardless of whether or not a child is capable of understanding the request or has consented to the parent making the request, it is important that a parent should only be given access to the information about the child if the worker in consultation with their manager is satisfied that the request is made in the child's and not the parent's interest.

For further information, see Children Act 1989 Guidance and Regulations - Volume 3: Planning Transition to Adulthood for Care Leavers.

A request for access to records may be made through an agent (for example, a solicitor).

It is the agent's responsibility to produce satisfactory evidence that they have authority to have access to the records. This will always include proof of their identity.

The fostering manager will decide whether the representative will be allowed access, having sought legal advice if necessary.

Where a request is received for access to the records of someone who has died, the person making the application should be asked to explain in writing their relationship to the deceased person, what information is needed and why. The staff should make a decision in consultation with their manager and advise the applicant in writing of the decision with reasons.

If a person considers that any part of the information held on their records is inaccurate, they have the right to apply verbally or in writing for it to be rectified or deleted. The agency has 1 month to reply to any such request.

If a request for rectification is received, the agency should take reasonable steps to establish that the data is accurate and to rectify the data if necessary.

What steps are reasonable will depend, in particular, on the nature of the personal data and what it will be used for. The more important it is that the personal data is accurate, the greater the effort the agency should put into checking its accuracy and, if necessary, taking steps to rectify it.

The agency can refuse to comply with a request for rectification if the request is manifestly unfounded or excessive, taking into account whether the request is repetitive in nature.

If the request is manifestly unfounded or excessive you can:

• Request a "reasonable fee" to deal with the request; or
• Refuse to deal with the request.

If staff consider there are reasons to refuse a request for access to all or any part of the records (see Section 2, Exemptions to the Right of Access), this should be discussed with a manager and legal advice should be obtained.

The fostering manager should be asked to make a final decision on refusal of access, having sought legal advice if required. If refused, the date of the request and reason for refusal must be recorded in the file.

The decision and the reasons for it should be confirmed in writing to the person requesting access, or in a format appropriate to the needs of the person concerned.

The data subject has the right to apply to the court for an order to disclose, correct or erase information held. They also have a right of appeal to the Information Commissioner.