Date: March 12, 2019
Subject Access Requests (SARs)
Under the updated data protection regime a patient’s request to access their records (commonly known as a subject access request (SAR) must now be processed free of charge and within one month.
SARs: Multiple requests
When a third party or an agent, makes a request under SAR for a copy of the records, under GDPR, you have to provide access to a copy in the form that they demand, because it is considered under GDPR to be coming directly from the data subject themselves (i.e. your patient). Whoever asks, as long as they have the consent of the Data Subject, is considered to be the Data Subject. But, under GDPR repeat requests for the same information (Article 12, para 3), i.e. another copy of what has already be provided to the data subject (even though via a 3rd party) is chargeable.
Therefore your response to any subsequent copy of the same records from the solicitors should be along the lines;
“Thank you for your request. We have already recently provided under GDPR Article 12 rules a copy of the records you have requested to the Data Subject via an intermediary. Under GDPR any intermediary, agent or third party is considered to be the Data Subject themselves. Therefore your request, being a duplication
of the SAR request already actioned, falls under Article 12(3) and becomes a chargeable action. Article 12(3) allows “the controller may charge a reasonable fee based on administrative costs”. Our costs in this matter will be £[X] [insert your fee]. Alternatively, you may wish to secure copies of the requested data that has been already disclosed from the Data Subject themselves or their representatives.” (October 2020)
Therefore your response to any subsequent copy of the same records from the solicitors should be along the lines;
“Thank you for your request. We have already recently provided under GDPR Article 12 rules a copy of the records you have requested to the Data Subject via an intermediary. Under GDPR any intermediary, agent or third party is considered to be the Data Subject themselves. Therefore your request, being a duplication
of the SAR request already actioned, falls under Article 12(3) and becomes a chargeable action. Article 12(3) allows “the controller may charge a reasonable fee based on administrative costs”. Our costs in this matter will be £[X] [insert your fee]. Alternatively, you may wish to secure copies of the requested data that has been already disclosed from the Data Subject themselves or their representatives.” (October 2020)
