Appendix 3
Procedures for Information Requests and Disclosures
To demonstrate the legitimate exchange of data Form 1 (Request for Information 224/9) will be completed for all requests for information, and Form 2 (Disclosure of Information 224/10) will be completed when information is disclosed.
Individuals completing request documents must ensure that the information requested is always limited to that which is necessary and/or expedient for the purposes of that enquiry.
Form 3 (Information Review 224/16) must be completed and attached to the front of the working file. All data exchanged must be audited and destroyed when it is no longer required. All data reviews must be recorded on Form 3.
The partners should respond to formal request for personal data, in writing within 10 working days. However, there may be occasions when information is urgently needed. If it can be demonstrated that: -
- there is a real threat to the health of a data subject and/or
- it is needed to prevent likely injury to a data subject
The information may be disclosed before receipt of a request document. In such instances and to maintain an accurate audit trail, a retrospective request document must be submitted within 5 working days. In an emergency faxed confirmation of a request may be made, but for security reasons, faxed data should only be made when it has been pre-arranged by the sender/receiver. The document should be divided into at least two parts to avoid sensitive information being linked to personal data. Confirmation of receipt must be given between faxes. No personal data must be disclosed by e-mail.
Upon receipt of an application a partner shall first establish whether another partner has supplied any of the required data.
If yes, the data owner shall be asked to confirm in writing, that:
- the data remains accurate, and
- all the data may be disclosed.
If not the recipient should disclose in accordance with their normal procedures. Referrals to other partners should not be delayed.
Prior to disclosing any information the Nominated Officer will ensure that:
- the person making the request is authorised to receive the data.
- the information is accurate
- the information is relevant and necessary to expedite the case in question