Data Protection

Data Protection

April 2023

Abbreviations

The following abbreviations have been used in this work:

BIS Department for Business, Innovation and Skills

CHM Case Help Manual

DP Act Data Protection Act 1998

FOI Act Freedom of Information Act 2000

FCU Forensic Computer Unit

IES Investigations and Enforcement Services

IP Insolvency Practitioner

TM Technical Manual

The Service Insolvency Service

Introduction

1. Requests for personal information and the DP Act

The right to know whether personal information is held and to have access to it is exempt from the provisions of the FOI Act (section 40) and will instead be dealt with under the provisions of the DP Act. Any application from an individual for information regarding him or herself will thus become a ‘subject access request’ under the DP Act and be treated accordingly. Requests for personal information received from bankrupts, former bankrupts, partners and company officers will fall into this exemption.

Where the information requested relates to a third party, it will also be exempt under the FOI Act if either:

its disclosure would contravene the DP Act data protection principles
it would contravene section 10 of the DP Act regarding the right to prevent processing likely to cause distress or damage
the person to whom it relates would not have a right of access to it under the DP Act

2. What are the DP Act ‘data protection principles’?

The DP Act is governed by eight principles which are set out in Schedule 1 part 1 of the Act and these must be complied with by data controllers, such as the official receiver, in respect of personal data they hold. These principles cover such points as:

the need for fair and lawful processing of personal data (first principle)
the purpose for which personal data may be obtained and processed (second principle)
the accuracy of personal data (fourth principle)
that personal data may only be processed in accordance with the rights of data subjects under the Act (sixth principle)

In the case of unstructured personal information, only the fourth and sixth principles are applicable (see paragraph 14).

To view all eight principles click HERE

3. The official receiver as statutory office holder (requests quoting the FOI Act)

Legal advice received by The Service states that if requested information was obtained by the official receiver solely by virtue of acting as ‘statutory office holder’, the FOI Act will not apply. Instead, the DP Act provisions must be considered as far as requests for any personal data held, whether the request is for information personal to the applicant or personal to a third party. All requests for information in bankruptcy cases are likely to be for personal information and the DP Act provisions must be applied.

The provisions of the Insolvency Act 1986, Insolvency Rules 1986 and any other relevant legislation will be applied to requests for other information.

The official receiver will need to take into account the restrictions in the insolvency legislation on who is entitled to the information, as well as the guidance in TM Chapter 47 – Disclosure of information (including inspection and production of records), when deciding if the requested information can be given in full or in part. For example, if an applicant who is not a creditor requests a copy of the list of creditors, a copy of the list should not be provided, as Rule 12A.54 of the Insolvency Rules 1986 will apply.

4. What if the official receiver has instructed agents who are holding requested information?

Where the official receiver is acting as statutory office holder and instructs agents, a request for information held by those agents should be considered for disclosure in the same way as if the official receiver was holding the information, and the DP Act and TM Chapter 47 considerations may also apply.

5. When is the official receiver not acting as statutory office holder?

There are some occasions where the official receiver is not acting as statutory office holder and where the FOI Act must then be considered. If the official receiver is holding information in the capacity of a civil servant, as a manager of staff for example, the FOI Act as well as the DP Act will be relevant. Also more likely are those occasions where the official receiver is acting on the specific instructions or carrying out delegated functions of the Secretary of State, when the FOI Act will also apply (see TM Chapter 81).

6. What if an official receiver needs guidance regarding a request for information held?

If the official receiver is uncertain in what capacity he or she is holding the information requested, the FOI/DPA Liaison Officer in Technical Section should be consulted. Whenever possible the information should be given but if the official receiver considers that the requested information cannot be provided, the reason for that decision must be given to the applicant.

7. What has been the effect of the Freedom of Information Act 2000 on the Data Protection Act 1998?

The FOI Act amends the DP Act but does not repeal it. Basically, the DP Act regulates the handling of personal data and grants an individual the right, subject to various qualifications and exemptions, to be told by any ‘data controller’ e.g. the official receiver, whether any personal data in which that individual is the data subject is being processed and, if so, to be told what information is contained in that data.

The DP Act also covers third party information if disclosure of that information would contravene the data protection principles (paragraph 2) or section 10 of the DP Act. This is regarding processing and the likelihood to cause distress or damage, or if the individual to whom it relates would not have a right of access to it because an exemption under the DP Act applies.

8. Who would be described as a ‘data controller’?

A ‘data controller’ means a person who either alone, jointly or in common with other persons determines the purposes for which and the manner in which personal data is being, or is to be, processed. In this definition official receivers are data controllers in respect of the personal data they control, held on The Service’s computer system and in manual records. The official receiver is a data controller in respect of the data belonging to bankrupts where he or she i
s acting as receiver and manager or trustee, and in partnerships and companies where he or she is liquidator. The Department for BIS is data controller in respect of all other personal data processed by The Service, on ISCIS, or on other computer systems and manual records.

9. What happens when a request for information is first received?

When a request for information is received, and the official receiver is not holding the information solely in his or her capacity as statutory office holder, he or she must consider whether the FOI Act or DP Act provisions should be applied, or whether both should be applied. There may be some information which is not personal data but does relate to an individual making an information request, in which case both Acts will need to be considered.

Generally requests for personal information in bankruptcy or partnership cases (as long as the individual is still alive) will fall to be dealt with under the DP Act, but if the individual to whom the information relates is deceased, the DP Act will not apply. The specific exemption in section 40(1) of the FOI Act means that where information requested constitutes personal data of which the applicant is the data subject, the request will be dealt with under the DP Act. Similarly, requests by a company director about himself or herself will be a ‘subject access request’ under the DP Act.

10. What is a ‘subject access request’

A request under section 7(1) of the DP Act is called a ‘subject access request’ and must be made in writing and relate to the personal information of the data subject. The data controller is not obliged to supply information under this section unless supplied with information reasonably required to satisfy him or herself of the identity of the person making the request.

Subject access requests should be dealt with by the official receiver (data controller) in each official receiver’s office, or by the appropriate section head holding the information. In official receivers’ offices, the data controller is the official receiver and for the remainder of The Service section heads act as data processors for the data controller (BIS). In addition the FOIA/DPA Liaison Officer in Technical Section is available to provide specialist advice and, if required, to co-ordinate a response across The Service.

11. Fees

In accord with the spirit of openness it has been decided that, for the majority of requests received by The Service, information will be provided free of charge. Therefore no charges should be levied for processing subject access requests under the DP Act, but expensive requests, those estimated to cost more than £600 in relation to unstructured data (see paragraph 14) should be refused.

12. If charging of a fee is approved, how is it calculated, and what action then follows?

For information on how to calculate costs and fees, see TM Chapter 81 Part 4 – Fees and Appropriate Limits Regulations 2004. It should be noted that there is a difference between the calculation of costs to decide if a fee can be charged and the calculation of the actual fee charged.

If Technical Section agree that a fee is appropriate, the applicant should be informed in writing that a remittance is required. The clock will stop running on the response time for the request at that point. When the fee is received, it must not be credited to the estate account but should be forwarded to Finance Section. In the case of a cheque, Finance Section will notify the official receiver once the cheque has cleared, the clock will re-start and the information should be provided within the timescale.

13. What data is covered by the DP Act?

The definition of ’data’ under the DP Act has been extended by the FOI Act to include all recorded information held, even if in manual form. It was formerly limited to information processed or intended to be processed automatically i.e. by computer, and to information held in a manual file that fell within the definition of a ’relevant filing system’. There is a division of manual data into structured and unstructured information, the aim being to limit the obligation to provide access to manually held personal data that can be found ’with reasonable endeavours’.

14. What is ‘unstructured’ personal information?

This is any information that is not recorded as part of a set of information structured by reference to individuals or criteria relating to individuals. The access to such information is limited in two ways:

the applicant must expressly describe the information requested or access will not be given, and
even if the unstructured personal information is adequately described, there is no obligation to provide it if the estimated cost of doing so would exceed the appropriate limit.

Charges for unstructured personal information can be made in accordance with the FOI (Fees and Appropriate Limits) Regulations 2004 (see paragraphs 11 and 12).

15. What is ‘structured’ personal information?

For the information to be ‘structured’ it must be information with something coherent or defining about it that means it may be regarded as ‘a set’

the information must relate to a living individual, and
the set must have an internal structure dictated by reference to individuals or criteria relating to them.

Thus a file arranged in date order, such as the official receiver’s case file, would be covered as long as the name of the individual was on the front cover. There is no requirement that structured personal information must be readily accessible and if the personal information falls within this structured category, it must all be provided unless it is exempt information (see paragraphs 24 and 25).

16. ‘Right to know’ under the DP Act

Once a request is received in writing (including transmission by electronic means) and the official receiver is satisfied as to the identity of the individual making the subject access request, and that the information requested is not exempt under the DP Act, the individual is entitled:

to be told whether their personal data is being processed, and if so
to be given a description of the personal data, the purpose for which it is being processed and to whom it is or may be disclosed, and
to be provided with copies of all the information that forms such personal data and information that may be available as to the source of the data

17. In what form should the information be supplied?

The data subject is entitled to the information in a permanent form, unless the supply of such copies is not possible or would involve a disproportionate effort, or if the data subject agrees otherwise. Unlike the FOI Act, under the DP Act the data subject is not given a choice as to how the information requested is to be provided.

Subject to any exemptions that may apply in the DP Act, bankrupts, company directors and insolvency practitioners are entitled to know what personal data about them is held on any of The Service
’s record systems and to have copies of that data.

18. Can information relating to another individual be disclosed?

If to comply with a subject access request under the DP Act would involve disclosing information regarding another individual who could be identified from that information, the official receiver does not have to comply with the request. That is unless either the other individual concerned has given consent to the disclosure or it is reasonable in the circumstances to comply without consent.

Where it is straightforward to remove the third party information from the document(s) to be disclosed by covering names or other identifying particulars, this should be done. A copy of the data so provided should be taken and placed on the file in case of subsequent query.

19. Can personal information be disclosed to third parties?

The second data protection principle states ’personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes’. ’Processing’ includes disclosure.

It is also necessary to ensure that the first data protection principle that personal data should be processed fairly and lawfully is not breached.

20. When is the official receiver ‘expressly required’ to disclose information?

The official receiver should only disclose information about individuals where expressly required to do so by insolvency legislation e.g. in the report to creditors, or in other circumstances, having considered the exemptions contained within the DP Act. For example, if the official receiver is approached by HM Revenue and Customs for information about a bankrupt’s tax affairs, disclosure might be justified under the DP Act, section 29, on the basis that the information is required for the assessment of a tax, provided the conditions set out in Schedules 2 and 3 of the DP Act are met. Equally, if the organisation seeking the personal data has a statutory power to require the information, its disclosure in pursuance of that requirement is permitted under the DP Act, section 35.

Exemption under the FOI Act section 40, ensures that access to third party personal data is not widened. Basically, if the information constitutes third party personal data and its disclosure would contravene one of the data protection principles, it will be exempt.

21. How quickly must a DP Act request be dealt with?

The DP Act lays down a 40-day timescale for dealing with subject access requests but the internal target for The Service is 20 working days. The official receiver thus has 20 days to comply from the time the request is received, along with sufficient information to identify the individual making the request.

Once a request has been received that is to be dealt with under the DP Act, the data subject making the request should be asked to provide two forms of identification. Send DP Act form (#1) – ‘Response to initial request’ enclosing form (#2) – ‘Subject access request (to official receiver)’ or form (#3) – ‘Subject access request (to support services)’. On receipt of a duly completed request form and the two forms of ID, the 20 day time limit will begin.

22. Can the official receiver provide information held by other parts of The Service?

Official receivers should be aware that files may be held for bankrupts and company directors by various parts of the Service. If advice has been sought about a case from Technical Section, a file will have been opened which will contain copies of any exchange of minutes and may contain other associated papers. In addition, the Authorisations Team hold files on various bankrupts and directors and also maintain databases of prosecution and/or disqualification details.

23. Who is the ‘data controller’ for data held by other parts of The Service?

The data controller for such data is the Department for BIS, therefore none of this information will be under the control of the official receiver and he or she will not have any duty to disclose its existence. A bankrupt or director will be required to make a separate subject access request to the appropriate section head to obtain details of personal data held and should be informed of this necessity by the official receiver, if appropriate. The Department for BIS is also data controller for information held on ISCIS. One request will cover all information held by sections for which BIS is the data controller, and it will be the responsibility of the section head receiving the request to see if any personal information is held by other sections.

24. Exemptions from the right of subject access

Some personal data is exempt from the right of access by the data subject and the right to receive the information, the ’fair processing of information’ specified in paragraph 2 of Part II of Schedule I of the DP Act will apply. Such exemptions are specified for personal data processed for the following purposes, amongst others:

to prevent or detect crime
to apprehend or prosecute offenders
to assess or collect any tax or duty or any imposition of a similar nature
was obtained for that purpose from a person who had it in his possession for any of the purposes in (a – c) above. (Crime and taxation, DP Act section 29)
to discharge functions which are designed for, amongst others, protecting members of the public against financial loss due to dishonesty, malpractice, or other serious improper conduct by, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate
financial loss due to the conduct of discharged or undischarged bankrupts involving dishonesty or malpractice
dishonesty, malpractice or other seriously improper conduct by or unfitness or incompetence of, persons authorised to carry on any profession or other activity, e.g. insolvency practitioners, to the extent that permitting subject access rights or providing data subjects with the fair processing of information, would be likely to prejudice the proper discharge of those functions (DP Act section 31)

There are also other exemptions relating to national security, ‘special purposes’ such as journalism, and historical or statistical research but these are less likely to be applicable to the cases dealt with by official receivers.

25. Section 31 DP Act exemptions

Under section 31 of the DP Act, a data subject is prevented from seeking access to their personal data if access would be likely to prejudice the proper discharge of functions designed for protecting members of the public against financial loss as outlined in paragraph 24(e). This exemption is relevant to the official receiver’s or the Secretary of State’s functions in relation to unfit directors, bankrupts and insolvency practitioners.

It must be borne in mind that this is not a blanket exemption from the subject information prov
isions and is only available to the extent that, permitting access to the data or informing the data subject of the purposes for which the data is held, would be likely to prejudice the discharge of those functions. For example, if the official receiver is investigating an offence or misconduct or is attempting to trace undisclosed assets, section 31 is likely to apply.

In cases of doubt, guidance should be sought from Technical Section in the case of asset related enquiries or IES in the case of enquiries relating to offences or misconduct. (See also paragraph 6 for details of the refusal notices that are available)

26. Subsequent requests

If the official receiver has previously complied with a subject access request he or she is not obliged to comply with a subsequent identical or similar request by that individual unless a reasonable time has elapsed between the two requests. Consideration should be given to the nature of the data, the purpose for which the data is processed and how frequently the data is altered. Where a request is received within a 6 month period for the same or substantially similar information, it is reasonable to refuse the request but, beyond that time period, the information should be provided unless there are other reasons for not doing so.

NB: There is no DP Act equivalent to ‘vexatious requests’ as exist under the FOI Act.

27. Answering enquiries where an individual’s details do not appear on the Individual Insolvency Register (IIR)

Where an inquiry is dealt with over the telephone, care should be taken not to breach the provisions of the DP Act. Enquiries by members of the public involving an individual whose details appear on the IIR are not a problem and information can be given freely. But if an individual’s details do not appear on the IIR, telephone enquirers should be informed that the matter cannot be looked into any further over the telephone.

NB: A search of ISCIS should not be undertaken.

The duration of entries on the IIR is limited by the Insolvency Rules 1986 so that, for example, all information relating to a bankruptcy will be deleted three months after the date of discharge.

28. What should enquirers be told where The Service has internal records and details of cases which are not in the IIR?

Enquirers should be told that The Service’s internal records do contain details of cases which are not included in the IIR, and that, while such details cannot be discussed over the telephone, if they exist, they may be disclosable, depending on the enquirer’s interest. If the enquirer wishes to pursue the matter, it must be by means of a non-verbal inquiry, i.e. by letter, fax or e-mail.

On receipt of a non-verbal enquiry in respect of an individual whose details do not appear on the IIR, consideration must be given to the enquirer’s interest in the case. Enquiries from known creditors or from a person claiming to be a creditor who provides adequate information for there to be no reason to doubt his or her claim to be a creditor, can be answered. All other types of enquiry must be referred to the examiner to decide if the enquirer has a legitimate interest entitling him or her to the information requested. In case of doubt, the FOI/DPA Liaison Officer in Technical Section should be consulted.

29. Answering telephone enquiries regarding companies

ISCIS information on companies can be revealed to telephone callers. However, caution should be exercised as regards providing personal details of directors (e.g. their addresses) and if the winding-up order was made more than five years ago, it is advisable to supply no personal information about the directors over the telephone. Requests for such details should be referred to Companies House, which will have information on files available for search. Alternatively, a non-verbal request can be made to the official receiver and if done, consideration should then be given as to whether there are good grounds for releasing the information to the enquirer.

30. Can the official receiver obtain personal data from third parties?

(Amended June 2024)

Other data controllers will be under the same constraints as the official receiver when it comes to disclosing personal data. Whilst section 35(2)(a)& (b) of the DP Act allows disclosure if it is required, there are no provisions in insolvency legislation which would entitle the official receiver to require that a third party make disclosure to him or her. The official receiver should quote section 35(1) and (2)(a)&(b) if refused information by a third party, but if the official receiver is unable to obtain the information by any other means, the bankrupt should be asked to sign a disclosure authority. If that fails, the official receiver may then consider obtaining an order under section 366 of the Insolvency Act 1986.

The DP Act applies to an organisation that is established in the UK. It is important to consider the data protection legislation in force within the jurisdiction where the third party is based. An example of this is where the official receiver needs information about a bankrupt who has been gambling online using a casino based in Gibraltar. In this example the relevant legislation is the (Gibraltar) Data Protection Act 2004, and the process is outlined in more detail in TM paragraph 81A.70A

The official receiver may require personal information from Channel Island based casinos, who operate under their own data protection legislation. Details of requesting information is given in TM paragraph 81A.70B

See also the notices that are available for use in requesting personal information from third parties (#6) – ‘Information request under section 35 DPA’ and (#7) – ‘General form of authority to disclose DPA’

31. Can the official receiver sell computer equipment containing personal data?

Where the official receiver intends to dispose of computer equipment which he or she is aware contains personal data, he or she should, unless the disposal takes place as part of a sale of the data, ensure that the personal data is ’cleaned’ from the equipment prior to the sale. It is important to remove all traces of data from the system, it is not sufficient to simply delete the files. Consideration may also be given to destroying the equipment, if the costs of cleaning it up is likely to exceed its realisable value.

If in doubt, speak with FCU who may be able to assist. The Service are in the process of arranging contracts with specialist contractors who are able to carry out data deletion, destruction and recycling work to the required specification for all digital media collected from insolvent estates.

32. What is the role of the Information Commissioner?

The Information Commissioner is responsible for monitoring the compliance of public authorities with the FOI Act, DP Act and the Codes of Practice. The Commissioners role extends to public rights under the Environmental Inform
ation Regulations and the Privacy and Electronic Communications Regulations.

33. What if a person is dissatisfied with the Service’s compliance with the DP Act

Under section 50 of the FOI Act any person who is dissatisfied may apply to the Information Commissioner regarding The Service’s compliance with the requirements of the DP Act, the most likely reason being that the complainant does not agree with the exemption relied upon for not providing the information. The Information Commissioner is obliged to consider an application unless he considers that:

the complainant has not exhausted the complaints procedure provided by The Service
that there has been an undue delay in making the application
that it is frivolous or vexatious
that the application for information has been withdrawn or abandoned

34. What should be done when a ‘notice’ from the Information Commissioner is received?

Insolvency Service staff must not ignore any notice issued by the Information Commissioner as the courts may treat any failure to comply with an Information or Decision Notice as a contempt of court. Also, the FIO/DPA Liaison Officer in Technical Section must be notified without delay, and supplied with copies of any notice or other correspondence that is received from the Information Commissioner.

Notes

a Where someone makes a subject access request under section 7 of the

DP Act, it is a criminal offence to alter, deface, block, destroy or conceal

any record, or part of it, to prevent disclosure of all or part of the

information in it (provided that the applicant would have been entitled to

the information). Section 77 of the FOI Act states the individual employee

who carried out such action would be liable to prosecution and this applies

to the DP Act as well as the FOI Act.

b The Guide to Bankruptcy and the Guide for Directors contain details of the

identity of the data controller (the official receiver) and the purposes for

which the data is being processed. In order to comply with the first data

protection principle, it is important to ensure that these Guides are

provided to all bankrupts and directors that are interviewed.

c The official receiver may receive subject access requests from individuals

who have had dealings with an insolvent and who believe that personal

data about them may be held in records kept by the insolvent. If this

happens, the official receiver should follow the same procedure as for any

other subject access request.

d Where the official receiver is dealing with an insolvent that holds personal

data, the insolvent will no longer be the data controller and the data will

instead be covered by the official receiver’s registration for the duration of

his appointment. Where an IP is subsequently appointed trustee of the

bankrupt’s estate or liquidator of the company or partnership, the official

receiver should make the IP aware of the existence and nature of the

personal data as the IP will need to have his own notification under the DP Act to deal with the data.

Where can I find out more?

Freedom of Information Act 2000

Data Protection Act 1998

Freedom of Information (Fees and Appropriate Limit) Regulations 2004

Technical Manual

Chapter 81 – Freedom of Information Act and Environmental Information Regulations

Chapter 81A – Data Protection

Chapter 47 – Disclosure of information (including inspection and production of records)

Case Help Manual

Freedom of Information Act and Environmental Information Regulations

Technical Notices

T8-08 – Responding to information requests and complaints within the requirements of the Freedom of Information Act 2000

T46-08 – Responding to information requests made under the Freedom of Information and Data Protection Acts and obtaining personal information

T31-10 – Instructions for handling subject access requests.

The Information Commissioner’s website

www.ico.gov.uk

Forms to be used

(#1) – Response to initial request

(#2) – Subject access request (to official receiver)

(#3) – Subject access request (to support services)

(#4) – Schedule of information provided

(#5) – Covering letter when providing information

(#6) – Information request under section 35 DPA

(#7) – General form of authority to disclose DPA

(#8) – Regulatory functions – section 31 DPA

(#9) – Publicly available information – section 34 DPA

(#10) – DPA refusal – personal information of 3rd party

Procedure

(Amended December 2024)

Data Protection Act ‘subject access requests’ only

DATA PROTECTION ACT – SUBJECT ACCESS REQUESTS

GUIDANCE NOTES FOR OFFICIAL RECEIVERS STAFF

All subject access requests rec
eived by official receivers must be notified to Technical Section by copying to FOI@insolvency.gsi.gov.uk

Where any information is to be refused, in part or in full, the response sent out by the official receiver must be copied to Technical Section by copying to FOI@insolvency.gsi.gov.uk

Any complaint arising from a response, or any correspondence received from the Information Commissioners Office must be forwarded to Technical Section by copying to FOI@insolvency.gsi.gov.uk

Contents

1) Data Protection Act – effect

2) What is a subject access request

3) What can be disclosed

4) Third party information

5) Grounds to refuse a request

6) How to deal with a subject access request

7) Forms and letters

8) Flowchart

1) Data Protection Act – effect

The Data Protection Act provides a framework to ensure that personal information is handled properly. It states that anyone who handles personal information must comply with a number of important principles and also gives individuals certain rights over personal information that is held about them.

The Data Protection Act applies to all individuals and organisations that process personal data. The official receiver is registered as a data controller under the Act and determines the purpose and manner in which personal data is processed. The official receivers staff are data processors in relation to the personal data they work with on behalf of the data controller. Any individual who’s personal data is being processed is referred to as the data subject.

Anyone who processes personal information must comply with eight principles, which ensure that personal information is:

processed fairly and lawfully;
processed for limited purposes;
adequate, relevant and not excessive;
accurate and up to date;
kept for no longer than needed;
processed in line with an individual’s rights;
kept secure; and
not transferred to other countries without adequate protection.

The Act provides individuals with important rights, including the right (subject to certain exceptions) to:

find out what personal information the data controller holds about them;
obtain copies of that information;
find out how the information is being processed;
find out why it is being processed; and
find out to whom the data has or may be disclosed.

2) What is a subject access request

A subject access request is a written request from an individual requesting details and copies of personal information about themselves that is held by the data controller. This will include personal information in a manual file or on any type of computer storage.

An individual can be any of the following:

Bankrupt
Director
Business partner
Creditor
Insolvency practitioner
Relative of a bankrupt or director
Associate of a bankrupt or director
Customer/client of a bankrupt or company

It is not necessary for the individual who makes the request to use the term ‘subject access request’, or to refer to the Data Protection Act in their request.

When a request for information is received consideration should given as to whether it falls within the subject access provisions of the Data Protection Act by considering the following:

Is the request from an individual?
Is the information they are seeking personal information about themselves?
Could the information be provided other than as a subject access request?

If a bankrupt or director asks for specific piece of information or document it is not always necessary to treat this as a subject access request. For example a bankrupt may ask for copy of his narrative statement or copy of a letter sent to a bank to release funds. These can be provided as normal business practice.

3) What can be disclosed

NB It is important to note that a document need not be disclosed if it would prejudice an ongoing enquiry or it contains information about another individual (unless consent has been given or it is reasonable to disclose without consent). In all cases of doubt Technical Section should be consulted.

Documents which can always be disclosed (subject to the above points)

Petition; Bankruptcy Order; Gazette Notice; Advertisement; Inspection Report; PIQ; Questionnaire; Narrative Statement; Statement of Affairs; Records Schedule; CARA; Meetings Notice; Proofs of Debt; Disclaimers; Trustees Record Book; IPO/IPA papers; PE papers; Closing notices.

Other documents which may be disclosed subject to case status

Document

Comment

CARB and CARC.

May be disclosed when enquiries on the case are completed – see flow chart

Third party correspondence.

May be disclosed unless it is with an individual, in which case consent of individual to be sought and if refused refer to Technical Section.

Internal minutes e.g. between OR and CBS or the Regional Director.

May be disclosed once any enquiries and investigations which the correspondence relates to is concluded. Must be considered case by case and withheld only if disclosure would prejudice the ORs functions.

Information provided by BIS or OGDs or regulatory authorities.

Information obtained through statutory disclosure gateways should not be disclosed without consent of the body concerned. The guidance in chapter 47 of the Technical Manual should be followed.

Third party statements.

May be disclosed if any investigation actions are concluded, but only with the consent of the statement giver. If consent is refused refer to Technical Section.

Land Registry and DVLA searches.

Disclose, but only after any ongoing enquiries about the asset is concluded. Refer to examiner if in doubt.

BRO, Disqualification or Statement of Facts (draft or abandoned cases)

Refer to Enforcement Technical Team.

(If Proceedings have been issued the individual will have copies already)

4) Third party information

If complying with a subject access request would lead to disclosing information relating to another individual who could be identified from that information (or from that information and other information which is in the possession of, or likely to come into the possession of, the requester), the following action is required.

1) Consider redacting (blanking out) the name or other identifying features.

2) If this is not sufficient to conceal the third party’s identity, seek the consent to disclosure of the third party.

3) If consent is not provided the data controller must consider whether it is reasonable in the circumstances to disclose without consent. Factors such as the potential prejudice to the third party and any grounds given in any refusal should be considered.

4) If there are remaining doubts seek advice from Technical Section.

5) Grounds to refuse a request

There are various grounds where a request can be refused in part or in full.

1) Where complying with the request would involve disclosure of personal information about another individual – see above.

2) Where disclosure would be likely to prejudice an ongoing enquiry or inve
stigation. Where this can be demonstrated you do not even need to disclose the existence of such information.

3) If the information requested is subject to one or more of the exemptions in the Data Protection Act – see chapter 81A of the Technical Manual for details of exemptions and refer any cases of doubt to Technical Section.

4) Where the data controller has previously complied with an identical or similar request, unless a reasonable interval has elapsed between compliance with the previous request and the new request.

5) If providing documents would involve disproportionate effort or expense. If this is the case the data subject must be informed what information is held, the source of the information, the purpose it is being processed and who it may be disclosed to. The form #4 below can be used for this purpose.

What is disproportionate effort?

Disproportionate effort refers to the time and cost of complying with a request and this must be balanced against the effects on the individual requesting the information of not supplying the information. In practice this situation should seldom arise.

Can a bankrupt or director inspect the official receivers file?

No, the Data Protection Act does not entitle an individual the right to inspect or have access to any file held by the data controller which contains personal information about them.

It would be impossible to enable such inspection without the enquirer seeing documents to which they have no entitlement and time consuming weeding of files cannot be undertaken to accommodate this. The official receivers files are confidential and request by individuals to visit the office to look at bankruptcy or company files should be refused.

6) How to deal with a subject access request

1) Carry out an initial search to see whether any information is held about the individual on computer or in a manual file. If no information is held inform the individual accordingly.

2) If it is not possible to identify the case from the information the individual has provided request further identifying data e.g. date of birth, NI number, all addresses used.

3) If information is held by The Service send the individual forms #1 Response to initial request and #2 Subject access request – available below.

4) When the completed Subject access request and two forms of ID are returned and are sufficient to satisfy the data controller as to the identity of the requester the time limit is 40 calendar days in which to respond under the Act will start. NB – The Service’s guideline response time is 20 working days.

5) If the request is for all the individuals personal data any stored files must be recovered immediately to ensure the deadline is met. Copy or obtain screen prints of all personal data held on computer – as detailed in section 3) above.

6) Once you have collected all the personal data for the data subject the data controller must decide what information can be disclosed, refused or must be redacted before disclosure.

7) Copy all the documents that are to be disclosed and list these in table #4 Schedule of information provided – available below. The documents listed are examples of what may be discloseable and is not an exhaustive or complete list. Delete and/or add to the list as required.

8) In form #4 indicate for each information item the source e.g. court file, creditors, other government dept etc; the purpose for which it is being processed e.g. bankruptcy administration, statutory requirement etc; and possible disclosure e.g. other parts of IS, BIS, regulatory authorities, OGDs etc.

7) Forms and letters