ICO consultation on accessing care records: A legal perspective

As the Information Commissioner’s Office (ICO) calls on individuals to share the challenges they have faced when accessing their records from UK care organisations, Heather McKay, explores the challenges faced by care organisations in responding to subject access requests.

For people who grew up in the care system, great importance can be attached to accessing personal information as it may reveal elements of childhood history they can’t recall. Each person’s story is different and while some may uncover important parts of their history, others may encounter difficult truths of which they were not aware. 

Under UK data protection law, everyone has the right to access their own personal information via a subject access request. Despite the one-month timeframe for organisations to respond, it is widely acknowledged this can often be a lengthy and stressful process. 

In a positive step towards tackling this issue, the Information Commissioner’s Office (ICO) launched an evidence-gathering exercise in February to find out more about the challenges individuals have faced in obtaining such information from care organisations. 

Feedback it gathers about the impact of delays, redactions and other concerns will help the ICO to identify areas where it can focus its support to provide valuable guidance that will help organisations to improve response times and the quality of content provided. 

For care organisations, there is a delicate balance to be struck between their duty to individuals requesting personal data, and privacy obligations towards other members of their story, such as family members, care workers and anyone else involved in the care system. 

There are also challenges to overcome regarding best practice, with previous ICO workshops indicating that organisations sometimes struggle to understand what information they can release from complex records and the level of sensitivity required when handling requests. 

Why access to personal information from the care system is important 

More than 80,000 children are registered in the care system in England alone, having been taken into care for reasons such as abuse, neglect or safety.

Children’s care services are split between public, voluntary and private ownership, meaning there’s a myriad of agencies and organisations responsible for handling data.

The ICO’s survey, which runs until 10 April, is aimed at adults who have previously been in care, which includes those who have been accommodated in a children’s home, fostered, adopted, in special guardianship or lived with a family. 

For many of these individuals, the ability to access information helps them fill in gaps across the jigsaw that makes up their life story and identity.

Records may include care admission details, adoption or service referral arrangements, information about birth relatives, school and branch reports, progress reports and assessments, and letters and correspondence.

Organisations like the Rees Foundation have campaigned on this issue, calling for greater compassion and care within the process. 

However, providing access to personal data in this context can be a double-edged sword when we consider the potentially difficult information someone may receive. This raises the question of how a care organisation can sensitively provide that information and who is responsible for supporting an individual in this situation.

While some may have strong support networks, others won’t and may be more vulnerable, which could place an additional unexpected duty on the care system. 

Accessing and handling personal data 

So where does one start? An applicant must submit a subject access request to receive a copy of their personal data from a particular organisation.

But if they don’t know which organisation holds the relevant data – a common issue given how many responsible bodies have merged with others, rebranded or gone out of existence – it can feel like a daunting prospect.

This is just one element and the ICO has stated it hopes the results of this survey will help it to understand the impact of delays, redactions and other issues to provide more focused support. 

On the flip side, providing guidance to organisations that hold the data is to be welcomed.

Assisting organisations in fulfilling their legal obligations as custodians of the data, and helping them to effectively and communicate their decisions is important.

Challenges they face currently include understanding what information should be released, and what should be withheld or redacted, whether this is due to the risk of serious harm it may cause the individual or an expectation of confidentiality towards a third party. 

Removing some of this uncertainty will help ease the administrative burden.

In conclusion, the ICO’s consultation and any resulting guidelines are sure to be welcomed within the care system, but it’s vital that it leads to further targeted support for organisations on how they can best work with individuals requesting access to personal data.