Request

QUESTION 1:

Please advise how many Data Subject Access Requests (hereafter referred to as SARs) you received and responded to in 2021, 2022 and 2023 relating to employees (past or present) and other requests (e.g. customers, general public, service users etc).

The next few questions relate to the SARs process which includes collating (pulling the data together from across your organisation/department), redacting the data, pulling the information/ data together into a response and checking the information before issuing it to the requestor.

QUESTION 2:

When responding to SARS do you manage the process in-house, or do you outsource the whole or part of the process? And if conducted in house please specify the name of the team/function that is responsible for this part of the process (eg Data Privacy, HR, etc).

If for example you outsource one type of SAR (e.g. employee) but complete others (e.g. citizen/customer) inhouse, please provide details.

QUESTION 3:

Approximately how many working hours does it take to pull together a typical SARs response, this includes the time taken to collate and redact the information, and putting the information together for issuing?

QUESTION 4:

What is the estimated percentage of handwritten documentation within a typical SAR response?

Response

Question 1

A copy of the information is attached.

This data relates to SAR responses issued to the requestor in the dates detailed above. It also only includes recognised SAR requests and does not include BAU, invalid or cancelled requests.

This is based on SAR requests received by the NHSBSA who are known to be employees / former employees, as they have identified their request relates specifically to their employment. This does not include data for employees who may have made requests relating to other services within the NHSBSA such as prescriptions, as these are not recorded as being by employees.

Fewer Than 5 requests

Please be aware that I have decided not to release the exact number of requests where the total number of requests falls below 5. This is because the patients could be identified, when combined with other information that may be in the public domain or reasonably available.

This information falls under the exemption in section 40 subsections 2 and 3A (a) of the Freedom of Information Act.

This is because it would breach the first data protection principle as:

a) it is not fair to disclose patients' personal details to the world and is likely to cause damage or distress.

b) these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the patients.

Please click the below web link to see the exemption in full.

https://www.legislation.gov.uk/ukpga/2000/36/section/40

Breach of Patient confidentiality

Please note that the identification of patients is also a breach of the common law duty of confidence. A patient who has been identified could make a claim against the NHSBSA or yourself for the disclosure of the confidential information.

The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act.

Please click the below web link to see the exemption in full.

https://www.legislation.gov.uk/ukpga/2000/36/section/41

Question 2

A copy of the information is attached.

To help you understand the type of information the NHSBSA hold I have provided the following web link.

http://www.nhsbsa.nhs.uk/About.aspx

This provides an overview of the NHS Business Services Authority which summarises the various services we provide.

Question 3

I have established that the information you requested is not held by the NHS Business Services Authority. This is because we do not hold an estimate and do not record the time taken to process a SAR.

Question 4

I have established that the information you requested is not held by the NHS Business Services Authority. This is because we do not identify the number of handwritten documents within a SAR.

Data Queries

If you have any queries regarding the data provided, or if you plan on publishing the data please contact foirequests@nhsbsa.nhs.uk ensuring you quote the above reference. This is important to ensure that the figures are not misunderstood or misrepresented.

If you plan on producing a press or broadcast story based upon the data, please contact communicationsteam@nhsbsa.nhs.uk This is important to ensure that the figures are not misunderstood or misrepresented.

The information supplied to you continues to be protected by the Copyright, Designs and Patents Act 1988 and is subject to NHSBSA copyright. This information is licenced under the terms of the Open Government Licence detailed at: http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/

Should you wish to re-use the information you must include the following statement: “NHSBSA Copyright 2024” This information is licenced under the terms of the Open Government Licence:

http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/

Failure to do so is a breach of the terms of the licence.

Information you receive which is not subject to NHSBSA Copyright continues to be protected by the copyright of the person, or organisation, from which the information originated. Please obtain their permission before reproducing any third party (non NHSBSA Copyright) information.