Right to Access

Anyone who has their data stored by your church can request to see a copy of this data. This is called a Data Subject Access Request. This would include everything that is stored about that person. 

This isn’t something that is new to GDPR but has been around as part of the current UK Data Protection Act. What has changed as part of GDPR is that the data should be provided to the person at no charge.

Previously organisations could charge a fee of up to £10 but from May 25th 2018 it must be at no cost. The exception to this is if a data subject requests data held about themselves regularly (i.e. every week) and then it could be justifiable for the church to charge a small fee.

If the subject makes the request electronically, the information must also be supplied electronically. It must be clear as to whom the person should contact to ask for this information.  The information must also be supplied within 30 days of receiving the request.   When providing this information it should be made clear to the person what your church’s policies are on the retention, correction and deletion of that data. 

Your church will likely store address details and contact information about each member. However there may be additional information held such as pastoral notes and giving information.  There has to be a valid reason as to why this information is being held and this should be linked to your privacy policy.

A Data Subject Access Request does not mean only sharing some information with the Data Subject. It means letting them see everything you hold on them, from Gift Aid records to notes from sensitive pastoral meetings. This is to encourage organisations to really think before they write something down; again, this is going back to treating other people's information as you would want your own to be treated.

A DSAR does not require you to breach another Data Subject's privacy. So, if you have a married couple who have been receiving counselling separately, and one of them makes a DSAR, you would allow them to see any notes made during their counselling sessions, but not notes made during their spouse's sessions which may mention them.

You can read more about Data Subject Access Requests on the ICO website here .
 




Terms and Conditions | Our Privacy Policy | Disclaimer