Your right to records
This page outlines the rights that apply to accessing care records
What is a subject access request?
Your rights
You have the right to request and access records and information about your time in care from ANY organisation that holds them. This includes local authorities, foster agencies, charities, schools, the NHS and any other organisation that was involved in your life. We have a step-by-step guide [link to Accessing Records page] that can help you to do this.
Your right to records is provided by the Data Protection Act 2018 and the General Data Protection Regulation (‘GDPR’). The Act says that any person can make a ‘Subject Access Request’ [link to a page describing a SAR – see text below] to any organisation that might hold information about them.
You can read more about the details of Data Protection law and access to care records, including information about exemptions, if you would like.
Human rights
The European Court on Human Rights has also ruled that the ability to access your care records is a human right. Under Article 8 of the Human Rights Act 1998 you have a right to privacy, family life and a home. In 1989 the Court ruled that this should include access to records about your childhood, if you have been in care. This came about because of Graham Gaskin, a British care leaver who was denied access to his records by Liverpool City Council in the 1980s. He fought his case for nine years until the European Court on Human Rights finally ruled in his favour. [Link to case study of Graham Gaskin’s fight to access his records – see text below]
The right to access records has changed over time. The first access laws were passed in the 1980s, but Subject Access Requests weren’t introduced until 1998. If you would like to find out more about the history of access to records take a look at our history timeline.
What is a subject access request?
The Data Protection Act 2018 and the General Data Protection Regulation state that we all have the right to access the ‘personal data’ that organisations hold about us.
‘Personal data’ is anything that is about you and from which you can be identified. In the language of Data Protection you are the ‘subject’ of this data. This is why requests to access it are known as ‘Subject Access Requests’ or SARs for short.
Your care records include lots of ‘personal data’ about you. However, because care records contain information about many different individuals, there may be sections that are ‘redacted’ or removed because they are about other people. This type of information is often called ‘third party information’. Deciding what to redact is a very individual process and each organisation will have a different approach. For more information see our page on withholding information (known as redaction).
You can make a SAR in writing by post or email, or by asking on the phone or in person. Organisations may have a form to fill in to make a request. SARs are free, and this includes receiving copies of your records.
Organisations have one month to respond to your request, but they may extend this to three months if the request is ‘complex’. Most requests for care records are ‘complex’, because records are long, and so often you will have to wait more than a month. However, the organisation must keep you informed about how long it will take for you to receive the records.
The GDPR states that a person is able to make a subject access request on their own behalf from the age of 13. Children younger than 13 can also make access requests if they wish, but parents or legal guardians may make the request instead so long as this is ‘in the best interests of the child.’ If you are still in care you can make your request to whoever is responsible for Data Protection in your local authority, or via your social worker.
If you are involved in a legal case you may authorise your solicitor to make a SAR on your behalf. If you do this the rules about what you can and can’t see may differ, as the courts have decided that your Article 6 right to a fair trial under the Human Rights Act is greater than the privacy of any third parties. This may mean fewer redactions. However, you may also be restricted from viewing or receiving copies of these unredacted records to keep.
The Graham Gaskin Case
Graham Gaskin was in care in Liverpool in the 1960s and 1970s. As an adult he requested access to his records to find evidence of abuse he had experienced whilst in care. Liverpool City Council gave him some records but refused to provide him with the information he wanted, claiming that they had a ‘duty of confidentiality’ to ‘third parties’. Gaskin appealed to the UK Court of Appeal who decided for Liverpool, saying that it wasn’t in the ‘public interest’ to give him access.
Eventually Graham appealed to the European Court of Human Rights and his case was decided in 1989, almost 10 years after his original request. The Court ruled that access to records was a human right under Article 8 of the European Convention on Human Rights, which guaranteed private and family life. This is because care-experienced people may rely on their records to understand the circumstances of their family life, and to retrieve memories and information that they might otherwise get from parents and others.
The Gaskin case established care leavers’ rights to access their records and led directly to the first access legislation in the UK, the Access to Personal Files Act 1987. This was replaced by the Data Protection Act in 1998, and most recently by the Data Protection Act 2018.
