FOI vs DSAR: What’s the difference?

At The DPO Centre, we are very fortunate to be able to work with a wide range of organisations, some of whom are considered public bodies. One of the most frequently asked questions we receive is “what is the difference between a DSAR and an FOI request?” and if they are different, “how are they different?”.

Knowing the key differences between the two is essential for any organisation (especially public bodies) who processA series of actions or steps taken in order to achieve a particular end. data on behalf of data subjects. Being equipped with this knowledge will allow you to react accordingly when such requests are submitted and allow you to deal with these requests in confidence.

In this blog, we will be discussing what a Data Subject Access RequestA verbal or written request made by a data subject to access their data (in a portable format if requested), be informed about how it is used, to have their data modified if it is incorrect, or to have it deleted. (DSAR) is, what a Freedom of Information (FOI) request is, the key differences between the two, and how to confidently respond to these requests moving forward.

What is an FOI?

In England and Wales, a FOI request is a formal request for access to information held by public authorities. This right is possible to exercise due to the Freedom of Information Act 2000 (Scotland has their own Freedom of Information (Scotland) Act 2002), which gives both individuals and organisations the right to access information held by public authorities, such as:

• Governmental departments
• Local authorities (town and borough councils)
• National Health Service (NHS)

What is a DSAR?

A Data SubjectAn individual who can be identified or is identifiable from data. Access Request (DSAR) is one of the rights afforded to individuals under the GDPR. A DSAR is a request made by an individual (a data subject) to gain insight to and access the personal dataInformation which relates to an identified or identifiable natural person. that an organisation holds about them. Article 15 of the General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR) gives individuals the right of access to obtain confirmation about:

• What personal data an organisation holds about an individual (including categories)
• Copies of their data held by the organisation
• Why their personal data is being processed
• Who their data is being disclosed to (read more about this in our previous blog)
• How long their data will be stored for, where its stored, and what safeguardsWhen transferring personal data to a third country, organisations must put in place appropriate safeguards to ensure the protection of personal data. Organisations should ensure that data subjects' rights will be respected and that the data subject has access to redress if they don't, and that the GDPR principles will be adhered to whilst the personal data is in the... are in place if its transferred to a third countryA country that is not part of the European Economic Area (EEA).
• If automated decision-making is being used (e.g. Artificial IntelligenceThe use of computer systems to perform tasks normally requiring human intelligence, such as decision-making, speech recognition, translation etc.)

In short, a DSAR allows a data subject to access their personal data.

FOI vs DSAR: What is the difference?  

FOI

If an individual wishes to submit an FOI request, then they must do so by submitting a written request to the relevant public authority. They must provide a clear and specific description of the information they are seeking, and the request must include the individual’s contact information. Upon receiving a request, public authorities have 20 working days to respond to the request, either by providing the information requested, or an explanation as to why the information cannot be provided.

Under the Freedom of Information Act 2000, an entire request can be refused under the following circumstances:

• It would cost too much or consume too much staff time to deal with the request
• The request is found to be too vexatious
• The request repeats a previous request made from the same person

The Freedom of Information Act also gives a number of exemptions. These are broken down into two groups:

• Absolute exemptions – where there is no duty to disclose the information
• Qualified exemptions – where the public authority has to assess the balance of public interest for and against the disclosure

DSAR

Unlike an FOI request, which can only be submitted via formal writing, a Data Subject Access Request can be submitted in (almost) any way, whether that be a verbal request or in writing (including via social media); something all organisations should be aware of.

Once an individual submits a DSAR at your organisation, you must respond within one month of receiving the request. If the request is particularly complex, or if the individual has made multiple requests, this can be extended by a further two months. Aside from the timeframe, another key difference between an FOI and DSAR is that the DSAR response must be provided free of charge, unless the request is deemed manifestly unfounded or excessive.

Your organisation also needs to be aware that DSARs can only be made by individuals for their own personal data and cannot be made on behalf of someone else, except in specific circumstances.

Like FOIs, DSARs can be rejected in exceptional circumstances, including:

• If disclosing the information would “adversely affect the rights and freedoms of others”
• Information that is covered by the rules of legal professional privilege (you can read more about this on the ICO website)
• The request is deemed to be manifestly unfounded or excessive

However, not all exemptions apply in the same way and your organisation should not routinely rely on exemptions and should consider each request on a case-by-case basis.

How does my organisation respond to these requests?

If you are a public authority and have received an FOI request, you will need to undertake the following steps:

1. Acknowledge the request as soon as possible. Let the requestor know that their request has been received and that your organisation will respond within the statutory deadline of 20 working days
2. Identify the information that has been requested
3. Determine whether the information is exempt: As mentioned above, consider what, if any, exemptions apply
4. Provide a response: Your response to an FOI request should contain the following information:
   • Whether or not you possess the information being requested
   • The information requested, providing it is not exempt
   • If you have restricted access to some information, ensure that you explain the reasons for any exemptions applied
   • The right of the requester to appeal if they are not satisfied
5. Consider any fees: if there are fees applicable, let the requestor know the amount and the payment process

If your organisation isn’t considered a public body, then your chances of receiving an FOI request are low and you would not be required to fulfil the request. However, your chances of receiving a DSAR is much greater. If you have received a DSAR, these are the steps to take to respond in a timely, efficient manner:

1. Verify the identity of the requester: You must confirm the identity of the individual making the request to ensure that you do not disclose personal data to someone who is not authorised to receive it.
2. Locate the relevant personal data: Next, you will need to identify the personal data that your organisation holds on that individual as well as information that is applicable to the request. You must ensure that you redact any information that is not directly related to the requestor.
3. Provide a response: You must respond to the request within one month of receiving the request. The response should include the following information:
   1. Confirmation that your organisation is processing the individual’s personal data
   2. The reasons as to why you are processing their personal data
   3. The recipients or categories of recipients of the personal data (including any third party you share personal data with)
   4. The retentionIn data protection terms, a defined period of time for which information assets are to be kept. period for their personal data
   5. The right to request rectification, erasure or restriction of processing of personal data
   6. The right to make a complaint with the relevant supervisory authorityAn authority established by its member state to supervise the compliance of data protection regulation. (The ICOThe United Kingdom’s independent supervisory authority for ensuring compliance with the UK GDPR, Data Protection Act 2018, the Privacy and Electronic Communications Regulations etc. for UK residents)

Failing to respond to a DSAR promptly or provide an inadequate response can result in complaints and regulatory action, which could potentially harm your organisation’s reputation. For more information on DSARs you should check out our DSAR blog or our ‘top five challenges’ blog .

All organisations (whether you are a public body or not) need to be aware of both. This is because requestors can, and often do, mix up terminology. You should be aware and know how to spot them and manage expectations accordingly.

Conclusion

The DPO Centre provides a comprehensive DSAR response service to assist with these types of requests. Your organisation can benefit from this service if you lack the necessary in-house resource or confidence to deal with such requests. Our dedicated DSAR team can work with you to ease the burden of DSARs and ensure you understand where your data is located, and draft responses to ensure they are compliant with the most up to date data protection guidelines. Complete the form below and we will get in touch.