Unlawful demand for certified copies of identification documents and name of Data protection officer

Dear Mr Smith,

Glasgow City Health and Social Care Partnership has received an enquiry
from you as follows:

 

Dear Glasgow City Health and Social Care Partnership,

 

1. Can you please write me the name and full contact details (direct
office phone number , FAX number, email and office address) of the " DATA
PROTECTION OFFICER" OR "DATA CONTROLLER" OF Glasgow City Health and Social
Care Partnership.

 

2. under GDPR 2018, client sending a subject access request NOT required
to send you "CERTIFIED COPIES OF IDENTIFICATION DOCUMENTS"?  Under which
LAW specifically you aske clients to send you  "CERTIFIED COPIES OF
IDENTIFICATION DOCUMENTS"?

I can confirm that Glasgow City Council is treating this request as being
a request under the Freedom of Information (Scotland) Act 2002. 

Please note that Glasgow City Health and Social Care Partnership (GCHSCP)
is not a Data Controller. GCHSCP is also not a Scottish Public Authority
as defined at Section 3 of the Freedom of Information (Scotland) Act 2002.
 GCHSCP is instead an organisational structure for the delivery of Health
and Social Care services on behalf of two separate Data Controllers /
Scottish Public Authorities – Glasgow City Council (GCC) and NHS Greater
Glasgow and Clyde Health Board (NHSGGC) - working in partnership under the
direction of a third Data Controller / Scottish Public Authority – Glasgow
City Integration Joint Board (GCIJB).

I am responding to you under the FOI process of one of the partners –
Glasgow City Council – as your second question appears to suggest that it
is the Subject Access process of that body, which is applied within GCHSCP
to applications to access social care records, to which you are referring.

The specific answer to your questions is as follows:

Question 1: For the reason stated above, GCHSCP is not a data controller
and does not have an appointed Data Protection Officer. The current Data
Protection Officer for both GCC and GCIJB is currently Dr Kenneth Meechan.
His contact details are available online under the Council’s Privacy
Notice: [1]https://www.glasgow.gov.uk/privacy . The current Data
Protection Officer for NHSGGC is Ms Isobel Brown. Her contact details are
similarly available on-line under the Health Board’s privacy notice
(section 10 – your rights):
[2]https://www.nhsggc.org.uk/patients-and-v...

Question 2: The request for certified copies of identification documents
is a requirement of the GCC Subject Access Request process as set out at:
[3]https://www.glasgow.gov.uk/SubjectAccess... . As referred to above,
GCHSCP applies this procedure to requests to access social care records
which it holds as a constituent part of Council services.

You are correct that there is no requirement in law specifying that
certified identification documents should be provided when making a
subject access request, however there is a legal provision obliging a Data
Controller to use all reasonable measures to verify the identity of a
person claiming to be a data subject seeking access to personal data of
that person. Glasgow City Council has determined that certified
identification falls within the definition of a reasonable measure. The
full legal requirement is expressed under Recital 64 of the General Data
Protection Regulations: [4]https://gdpr-info.eu/recitals/no-64/

I hope that you find the above information to be helpful.

Right of Review

If you are dissatisfied with the way Glasgow City Council has dealt with
your request under the Freedom of Information Act (Scotland) 2002 you are
entitled to require the Council to review its decision.  Please note that
for a review to take place you must:

·        Lodge a written requirement for a review within 40 working days
of the date of this letter

·        Include a correspondence address and a description of the
original request and the reason why you are dissatisfied

·        Address your request to the Director of Governance and Solicitor
to the Council:

Director of Governance and Solicitor to the Council

Glasgow City Council

City Chambers

George Square

Glasgow G2 1DU

Email:  [5][email address]

You will receive notice of the results of the review within 20 working
days of receipt of your request.  The notice will state the decision
reached by the reviewing officer as well as details of how to appeal to
the Scottish Information Commissioner if you are still dissatisfied with
the Council’s response. 

You must request an internal review by the Council before a complaint can
be directed to the Scottish Information Commissioner. For your information
at this stage, an appeal can be made to the Scottish Information
Commissioner by contacting his office as follows if you do remain
dissatisfied with the outcome of the Council’s review decision - 

Address: Kinburn Castle, Doubledykes Road, St Andrews, KY16 9DS.

Email: [6][email address]

Telephone: 01334 464610

You can also use the Scottish Information Commissioner’s online appeal
service to make an application for a decision:
[7]www.itspublicknowledge.info/appeal

Please note that you cannot make an appeal to the Scottish Information
Commissioner until you have first requested an internal review by the
Council.

If you wish to submit a complaint to the Council in relation to the manner
in which it has handled your request for information then you can do by
requesting that the Council review its decision. Details of how to request
a review are set out in the above paragraph “Right of Review”.

Yours sincerely,

 

Jim Charlton

Business Development Manager

Glasgow City Health and Social Care Partnership

Commonwealth House

32 Albion Street

Glasgow G1 1LH

0141 287 8714

[8][email address]

 

 

 

Glasgow - UK Council of the Year 2015
Disclaimer:
This email is from Glasgow City Council or one of its Arm’s Length
Organisations (ALEOs). Views expressed in this message do not necessarily
reflect those of the council, or ALEO, who will not necessarily be bound
by its contents. If you are not the intended recipient of this email (and
any attachment), please inform the sender by return email and destroy all
copies. Unauthorised access, use, disclosure, storage or copying is not
permitted. Please be aware that communication by internet email is not
secure as messages can be intercepted and read by someone else. We
therefore strongly advise you not to email any information which, if
disclosed to someone else, would be likely to cause you distress. If you
have an enquiry of this nature then please write to us using the postal
system. If you choose to email this information to us there can be no
guarantee of privacy. Any email, including its content, may be monitored
and used by the council, or ALEO, for reasons of security and for
monitoring internal compliance with the office policy on staff use. Email
monitoring or blocking software is also used. Please be aware that you
have a responsibility to make sure that any email you write or forward is
within the bounds of the law. Glasgow City Council, or ALEOs, cannot
guarantee that this message or any attachment is virus free or has not
been intercepted and amended. You should perform your own virus checks.

For further information and to view the council’s Privacy Statement(s),
please click on link below:

[9]www.glasgow.gov.uk/privacy

References

Visible links
1. https://www.glasgow.gov.uk/privacy
2. https://www.nhsggc.org.uk/patients-and-v...
3. https://www.glasgow.gov.uk/SubjectAccess...
4. https://gdpr-info.eu/recitals/no-64/
5. mailto:[email address]
6. mailto:[email address]
7. http://www.itspublicknowledge.info/appeal
8. mailto:[email address]
9. http://www.glasgow.gov.uk/privacy