Subject Access Request

The General Data Protection Regulations gives you a number of rights including the right to find out if an organisation is using or storing personal data about you. This is called the right of access.

You can exercise this right by asking for a copy of the personal data held, which is known as making a ‘Subject Access Request’.

If you wish to make a Subject Access Request, you can complete a form. Download a Subject Access form here.

Once you have completed the form, you should return this to us at the address below:

Information Governance Team, Wheatley Group, Wheatley House, 25 Cochrane Street, Glasgow, G11HL.

You can also email: InformationRequests@wheatley-group.com

You do not have to use this form but it will make it quicker and easier for us to deal with your request. If you choose not to use our form, your request should include the following information:

• your full name, address and contact telephone number
• any information used by us to identify or distinguish you from someone else of the same name (for example, rent reference number, application number or common charges account number)
• details of the specific information you require and any relevant dates that will help us identify what you want.

For example, you may want to ask for:

• your tenancy file
• emails between ‘person A’ and ‘person B’ (say from 1 June 2018 to 1 September 2018)
• CCTV camera data situated at ‘location E’ on say 23 May 2017 from 11am to 5pm.

You do not have to specify why you want this information. The details we need are those that will aid the efficient location and retrieval of information.

We will need to be satisfied you have the individual’s permission to act on their behalf. You may be committing an offence to seek data about other individuals without their consent.

If you wish to access information about someone else, we will require their written consent for you to do this in the form of representation mandate or a legal document which proves you can act on their behalf, for example a power of attorney or guardianship order. The relevant sections of the Subject Access form should be completed confirming you are acting on behalf of the individual.

Click on the link to download a representation mandate form.

We will make all efforts to fully comply with your request within one month, starting from the day after we receive your request. In any event, you will receive all the information that has been located and can be released within one month and an explanation for any information that cannot be provided at that time.

Before we release information to you, we need to be confident of your identity so we may ask you for additional information in order to verify it.

There are some circumstances where the information you have asked for contains information that relates to another person.

Unless the other person gives their permission, or it is reasonable in all the circumstances to provide the information without permission, we are entitled to withhold this information.

Third party information may be edited out (redacted) so that it does not form part of the requested information.

There are exemptions within the General Data Protection Regulations and the UK Data Protection Act 2018 which may allow us to refuse to comply with your request.

Where an exemption applies to the facts of your request, we may refuse to provide all or some of the information requested, depending on the circumstances. For example, if providing you with the information would be likely to affect the way crime is detected or prevented. When responding to you, the reasons will be explained.

If you are unhappy with the response to your subject access request then you can raise a concern to us about it. We will then review your concern and issue a response to you within one month of receipt. If you wish to raise a concern then, please write to:

The Information Governance Solicitor, Wheatley Group, Wheatley House, 25 Cochrane Street, Glasgow, G1 1HL.

To allow us to investigate your concern please:

• be specific about the issues you wish us to address
• include full details of your concern
• include all information to help us identify you and your concern correctly.
• send us copies of all the key documents you have to evidence your concern.

Don’t send us the originals as you might need them later. Also, don’t include additional documentation ‘just in case’.

Should you remain dissatisfied with the handling of your subject access request and the review, you may wish to raise a concern with the Information Commissioner’s Office.

The Information Commissioner’s Office provides useful information.