Voluntary Organisation - Subject access request

[thedryad]

Hello, 

I couldn't find the right forum for this - so please feel free to move it.

 

I want to send a SAR to a voluntary organisation that I volunteered for for over 6 years.

Recently they changed their policies and have been making things very difficult for me and I've decided to leave.

But I want to know what information they hold on me.

 

Do I send them the SAR by Bankfodder that is in the debt forums?

Can I e-mail it instead of sending by post (do I have to sign it?).

 

 

[BankFodder]

You could certainly send a copy by email – but of course they are entitled to verify your identity. It might be easier and more straightforward simply to send the request in writing, signed with your usual signature which presumably they are familiar with.

[thedryad]

Thank you - it would be an e-mail sent through the official organisation's e-mail system that only members have access to, and they have been liasing with me via e-mail recently. Are they entitled to request I sign the SAR? As I would prefer not to sign anything. 

 

[Will Goodfellow]

Find out who the data controller is and send it to that email.

[thedryad]

Hi, I received this reply today to my dated, signed SAR. I also sent a PDF of the SAR to the people manager via e-mail using the internal e-mail system, and it's been acknowledged so they know it's from me. They are clearly messing me around. 

 

"Dear ****

 

RE: Subject Access Request

 

Thank you for your letter dated 15 May 2019, regarding your request for data, which we received on 20 May 2019. 

 

As you will be aware the timescale to process GDPR (Data Protection Act 2018) Subject Access Requests is one calendar month from the day after which we receive a request. Any personal data that we may hold on you will be sent to you within the permitted time frame. However, to note that before we release any data that we may hold we will need to confirm your identity to ensure that you are entitled to receive the data. 

 

If you have any further questions or comments relating to this matter, please contact us on *email address*. 

 

Yours sincerely, 

*scanned signature*

Name

People manager

Organisation

 

 

[thedryad]

I’m still not sure if this is in the correct forum but if it’s nitvcab it please be moved to the correct forum? Thank you.

[honeybee13]

Hi.

 

What is nitvcab please?

 

If you like, we can move your thread to the data protection forum.

 

HB

[BankFodder]

I suppose that there is a typo which means "not can".

If you really want to make a point then if you think that they have got enough information to identify you then you could challenge them in court but that will take time.

If you want to make things quick then you could simply send them the information they want.

It would help if you tell us which organisation you are dealing with

[thedryad]

Thanks yes you’re right. 

It was a typo.

I’d rather not type it as it could be traced by them. It’s a first a i -d organisation. 

 

I’m confused about their wording. “However, to note that before we release any data that we may hold we will need to confirm your identity to ensure that you are entitled to receive the data. 

 

If you have any further questions or comments relating to this matter......”

THEY DO NOT STATE HOW THEY INTEND TO CONFIRM IDENTITY or what will happy next.

Edited May 21, 2019 by thedryad

[honeybee13]

From what I've read, it isn't unusual to ask for proof of ID, but I can see you need more information from them about confirming that.

 

Is it possible to ask them how to prove your ID?

 

HB

 

 

[dx100uk]

do you not still have your ID card etc etc.

if its whom I think it is and you are thinking of switching 'sides' shall we say .....you are not alone!!

 

dx

[stu007]

Hi

 

They have acknowledge receipt of your SAR so irrespective that they need to confirm ID the 30 days has started for them to comply with your SAR request.

 

As for the ID, I would simple do as you initially did to request this and ask for clarification as to what they require to confirm said ID.

 

Dear Data Controller

 

Reference: (if a ref given in their letter put here)

 

Further to your letter dated XX/XX/2019, I require further clarification exactly what information you require if you need to 'Confirm my Identity' as this information has not been provided in your letter.

 

Yours Sincerely

 

 

 

 

 

 

[thedryad]

They have not fulfilled the SAR and we’ve heard nothing since they acknowledged it. What next? 

[Andyorch]

Thread moved to Data Protection Forum.

 

Andy

[thedryad]

Complained to the ICO and informed the data controller of this. This morning I had some of my data delivered but it wasn’t even half of what I should have received, for example my contract and letters I’ve sent them. It was all just emails relating to a recent matter! 

What next?