View Cambridgeshire LSCB Manual View Cambridgeshire LSCB Manual
View Working Together to Safeguard Children View Working Together to Safeguard Children

1.2.5 Access to Records

RELEVANT CHAPTERS

This chapter should be read in conjunction with the Confidentiality Policy.

See also Access to Birth Records and Adoption Case Records Procedure.

RELATED GUIDANCE

Children Act 1989 Guidance and Regulations - Volume 3: Planning Transition to Adulthood for Care Leavers (revised January 2015)

Information Commissioners Office – Guide to Data Protection

AMENDMENT

This chapter was updated in April 2019 to reflect the EU General Data Protection Regulations (GDPR) and Data Protection Act 2018.


Contents

  1. Right of Access
  2. Exceptions
  3. Open and Informal Approach
  4. Formal Requests for Access
  5. Timescales
  6. Requests by Children
  7. Applications by Parents
  8. Applications by Care Leavers
  9. Applications by Agents
  10. Application on Behalf of Deceased Persons
  11. Corrections or Erasure of Records
  12. Refusal of Access
  13. Appeals Process


1. Right of Access

The provisions for access to personal information or records held by Children's Services are contained in the EU General Data Protection Regulations (GDPR) and the Data Protection Act 2018. Those in respect of whom personal information is held in any form have a right of access to the information, unless one of the exceptions set out below applies.

The above legislation applies to both paper and manual records and records held electronically. It is important that electronic recording systems comply with the requirement for children and their families to easily find their story in a logical narrative.

The Freedom of Information Act 2000 gives people the right to see all types of other non-personal information held by children's services. There is information online for people wanting to see their records: Requesting information under the Data Protection Act (Cambridgeshire County Council website).


2. Exceptions

The following exceptions do not permit the total withholding of information but only those sections of the material covered by the exceptions. The remainder of the case records should be made available to the service user. The Information Governance Team (IGT) have responsibility for applying these exceptions and if staff have any concerns about the release of records they should contact the team at data.protection@cambridgeshire.gov.uk or call 01223 699137.

Exceptions to the right to access are:

  1. Information relating to third parties may be exempt from release. Where it would not be reasonable to disclose third-party information to the requester, and the Council does not have the consent of the third-party to disclose this information, it will likely be withheld;
  2. Where the person is incapable of managing his or her affairs (for example where the person is a child) with sufficient age and understanding and the information was given in the expectation that it would not be disclosed or is information which the subject of the information expressly indicated should not be disclosed;
  3. Adoption Case Records - see Access to Birth Records and Adoption Case Records Procedure;
  4. Where the practice of social work would otherwise be prejudiced because access to the information would be likely to result in serious harm to the person requesting the information or some other person;
  5. Where disclosure may hinder or prevent the detection or investigation of a crime.

The exceptions do not apply where disclosure is required by a court order or is necessary for the purpose of, or in connection with, any legal proceedings.

In addition, a Court may prevent disclosure of information where there is concern that disclosure could cause serious harm to the subject's physical or mental health.

Access can also be refused if an identical or similar request has been received from the same person and has already been complied with, unless a reasonable interval has elapsed. However, the threshold for refusing requests on these grounds is high and it would be very unusual for the council to be able to do this in relation to a person with ongoing social care involvement.


3. Open and Informal Approach

The practice of all staff should be to encourage ongoing and open sharing of information and recording, including providing copies of key documents.

If a person in receipt of services asks to see a particular document or wants to have information about a particular aspect of the case, the social worker should discuss this with them to see whether the request can be managed informally by showing them the relevant part of the file or providing copies of relevant documents.

It is, however, important to bear in mind the exceptions, above, particularly in relation to information from third parties.


4. Formal Requests for Access

Those making a formal request for access to their records should be asked to put the request in writing using the Council's 'Access to your Information' form (see Requesting information under the Data Protection Act (Cambridgeshire County Council website)) and the social worker should assist them to do this as necessary. The subsequent process will be managed by the Council's Information Governance Team (IGT).

The Information Governance Team are able to access ICS, AIS and Wisdom but will also request any additional files or other information, such as emails, held locally. In response to such a request, the Team must, within 5 days:

  1. For open cases:

    Collate all relevant word documents and case files and forward to IGT;
  2. For closed cases where there is a file still with the Team, forward this to IGT, ensuring all relevant and up-to-date information is included;
  3. For all cases:

    Using the security log book, ensure that a clear record of the file being sent to IGT is recorded and authorised/signed for by the appropriate manager.

    Record a Case Note on ICS that there is a request for access to files and what has been provided and to whom.

The whole record will be checked by the IGT to ascertain whether any of the material comes within the exceptions to the rights of access (see Section 2, Exceptions).

Any information supplied by third parties will not usually be disclosed without the third party's consent. When it is not possible to obtain consent, discretion may be used to release information where there is no possibility of serious harm.

The Information Governance Team will provide a redacted copy of the information to the requester in due course. Usually this will be done by secure email. The IGT is unable to provide any pastoral care or explanation of social care practices and decisions after releasing information. If there are any concerns about the impact of releasing information on the requester the worker must contact the IGT to discuss this. Where the person making the request has specific needs in relation to language or disability, arrangements would be made to present the information in a suitable manner and to involve approved interpreters as needed.

Copies of disclosed documents would normally be supplied on request.


5. Timescales

Data Protection regulations require that requests must be responded to within 1 month, or 3 months if they are considered complex.

A month is defined as the corresponding date in the next month – e.g. a request received on 26th February should be responded to by 26th March if it is not complex.

It is not always clear what constitutes a 'complex' request. The IGT will monitor guidance on this subject and will make the decision on what can be considered a complex request. It is likely that large social care requests will be considered 'complex'.


6. Requests by Children

Requests from children must be treated in the same way as requests from adults and the child should be supported by their social worker in making the request. A judgement should be made by the social worker as to whether the child making the request for access understands the nature of the request and also whether it can be managed informally or requires formal application as above. Where appropriate, a parent should be asked to provide written confirmation that the child understands the nature of the application.

A child of sufficient understanding should be allowed regular access to information held about him or her, consistent with their best interests. They should be encouraged to read, or be told, what has been recorded unless it falls within one of the exceptions set out above or might be unsettling/distressing and would need more sensitive presentation.

A child should be encouraged to record his or her own observations on the case record including when there is disagreement about an entry in the file.

In Scotland the law presumes that a child aged over 12 has the capacity to make a subject access request. The presumption does not apply in England but does suggest an approach that will be reasonable in most cases.


7. Applications by Parents

Sometimes, requests for access to a child's record will be received from a parent or other person with parental responsibility. Even if a child is unable to understand the implications of a request, the data about them is still their personal data and does not belong to anyone else, such as a parent. It is the child who has the right of access to information held about them, even though, in the case of young children, their rights are likely to be exercised for them by people with parental responsibility.

Before responding to a request for access to information held about a child, it should be considered whether the child is mature enough to understand their rights. If they are, they should be responded to, rather than the parent. If a worker is unsure about whether a child is able to understand what it means to make a request and how to interpret the information they receive as a result, the worker should consider:

  • The child's level of maturity and ability to make decisions like this;
  • The nature of the personal data;
  • Any court orders relating to parental responsibility that may apply;
  • Any consequences of allowing those with parental responsibility access to the child's information. This is particularly important if there have been allegations of abuse;
  • Any detriment to the child if people with parental responsibility cannot access this information;
  • Any views the child has on whether their parents should have access to information about them.


8. Applications by Care Leavers

For further information see Children Act 1989 Guidance and Regulations - Volume 3: Planning Transition to Adulthood for Care Leavers (revised January 2015).

Care leavers have the same entitlement to make a request as anyone else. However, in practice they are likely to have far more information held by the council than most people, which can make their requests difficult to respond to in a timely fashion. Where they are currently supported by a Social Worker or Personal Adviser, it might be possible to respond to their request informally, as above, particularly if there is a particular piece of information or a document they wish to obtain.

Where they are not 'open', or more comprehensive access is required, they will need to follow the formal procedure outlined above, including the completion of the 'Access to your Information' form (see Requesting information under the Data Protection Act (Cambridgeshire County Council website)).

The IGT will seek to manage the expectations of the care leaver, and possibly enquire if they wish to reduce the scope of the request to specific information, or to a specific time period. The IGT will keep in contact with any active workers so that they are aware of progress being made with the request and can support the young person through it.


9. Applications by Agents

A request for access to records may be made through an agent (for example, a solicitor).

It is the agent's responsibility to produce satisfactory evidence that they have the authority to have access to the records. This will always include proof of their identity.

Application can be made by completing the 'Access to information on behalf of somebody else' form (see Requesting information under the Data Protection Act (Cambridgeshire County Council website)).


10. Application on Behalf of Deceased Persons

The legislation only applies to living individuals. Therefore, a Subject Access Request cannot technically be made on behalf of deceased individuals.

Where a request is received for access to the records of someone who has died, the person making the application should be directed to the IGT who will determine the correct way forward.

No-one has a 'right' to access all information regarding a deceased individual.


11. Corrections or Erasure of Records

If a person considers that any part of the information held on the record is inaccurate, they have the right to apply in writing for it to be corrected or erased.

If the objection is justified, there is a duty to correct or erase the appropriate information. Where it is not possible to determine conclusively that the record is inaccurate, a note could be added to the file indicating the dispute and the applicant's version of events so that both are included within the record.

All requests of this nature should be reported to the IGT.


12. Refusal of Access

If the IGT or an involved worker considers there are reasons to refuse a request for access to all or any part of the records (beyond Section 2, Exceptions), this should be discussed with their manager and legal advice should be obtained.

The line manager should be asked to make a final decision on refusal of access, having sought legal advice if required. If refused, the date of the request and reason for refusal should be recorded in the file.

The decision and the reasons for it should be confirmed in writing to the person requesting access, or in a format appropriate to their needs.


13. Appeals Process

The person concerned has the right to apply to the Court for an order to disclose, correct or erase information held. They also have a right of appeal to the Information Commissioner who can make an assessment about whether the law has been complied with and issue enforcement proceedings to make the Authority comply with the request if necessary and/or recommend an application to court alleging a failure to comply with data protection legislation.

End