Third-party information subject access request disclosure procedure

Use this procedure when a subject access request contains personal information about another person. The decision must be case-specific and reflect the identities and relationships involved, available contact details, confidentiality concerns, any power imbalance, evidence of consent and the risks of disclosure.

Assess the third-party information

Identify the information that relates to another person and assess whether that person has consented to its disclosure or whether disclosure without consent would be reasonable in the circumstances.

Consider the identities and relationships of the requester and the third party, the available contact details, confidentiality concerns, any power imbalance, the evidence of consent and the risks associated with disclosure.

Decide whether to seek consent

Where appropriate, the school may ask the relevant third party for consent to disclose their personal information in response to the subject access request. Seeking consent is optional and is not a universal requirement.

It may be inappropriate to seek consent where the school does not have contact details for the third party, where seeking consent could disclose the requester’s subject access request to the third party when they were not already aware of it, where it would be inappropriate for the third party to know that the requester made the request, or where the third party cannot consent freely because of an imbalance of power.

Decide what information to disclose

If the third party has consented, or the school is satisfied that disclosure without consent is reasonable, provide the information in the same way as other information provided in response to the subject access request.

If the school does not have the third party’s consent and is not satisfied that disclosure without consent is reasonable, withhold the third party’s information. Provide as much of the requested information as possible without disclosing the third party’s identity.

Where appropriate, edit or redact the response to remove information that identifies the third party. The information disclosed should not identify the third party where disclosure of their information is not justified.

Respond to the requester

Respond to the requester whether or not information about the third party is disclosed. The response should reflect the decision about the third-party information, including where that information has been withheld.

Record the decision

Keep a record of what was decided and why. The record should identify the third-party information considered, whether consent was obtained or sought, whether disclosure was made or withheld, the reasons for the decision and any reason why consent was not sought or why seeking it was inappropriate in the circumstances.