What is a Subject Access Request?
Data Protection (Jersey) Law 2018 provides individuals with rights over their personal data.
More specifically, the Law provides you with a right to access personal data which is processed about them by a controller, such as the States of Jersey.
You can ask:
- whether your personal data is being processed by the States of Jersey
- the purposes for which your data is being or is to be processed
- the categories of personal data concerned
- the recipients or classes of recipients to whom your data may be disclosed
- how long that data is likely to be retained
- where the data was collected from if not from the States of Jersey
- about any automated decision making about your personal data and the rationale behind it
- about safeguards in place where data is transferred to a third country (this usually means outside Europe) or any international organisation
You also have rights to:
- lodge a complaint with the Data Protection Authority
- request rectification, erasure, restriction of processing (under certain circumstances)
- object to processing on the basis of direct marketing, legitimate interest or public function
- request for your data to be provided in a structured machine readable format in order to transmit to another data controller (portability)
You can also request a copy of the data that the States of Jersey holds about you.
Before making a subject access request
You only have a right to request personal data about yourself, or about someone you have a right to ask about, such as a child you have parental responsibility for.
If the information you're requesting is not about yourself or someone you have a right to make a request on behalf of, your request may be refused.
Central Data Protection Unit
The personal information you provide will be processed by the Central Data Protection Unit (Chief Minister's Department) of the States of Jersey and will be the Controller for these purposes.
Information will be processed in accordance with the Data Protection (Jersey) Law 2018 for all purposes associated with the administration of requests received under the Data Protection (Jersey) Law 2018, including the monitoring of communications to check for compliance with any relevant policies and legislation.
Your request (which may include sensitive information) and any personal information you provide (being your name, address and contact details) as part of that request, will be passed to the Data Protection staff authorised to handle your request in the relevant States of Jersey
In order to respond to your request, your request will then be passed, along with the personal information you provide in your initial request, to the relevant business area/ areas that may hold the information you have asked for.
That Department or Departments will then source the information, apply any exemptions or redactions as appropriate and you will be contacted so that the information can be released to you. You will need to provide photographic proof of identity again at that point and sign to confirm that you have received it.
Information will be supplied to you in hard copy in a sealed envelope. Your information will not be emailed to you unless specifically requested. It will be password protected. An individual from the relevant Department will call you to inform you of the Password before the information is sent.
Information will not be passed to any other third party outside of the States of Jersey without your prior consent.
States of Jersey Police
If you need information from the States of Jersey Police, contact them directly through the
States of Jersey Police website.
What you can ask for
You can ask for any personal information processed in relation to and which identifies you, or someone you have the authority to ask about (such as a child you have parental responsibility for).
Should you wish to request information about the States of Jersey which is not personal information you can make a ‘Freedom of Information’ request. More information is available on the
Freedom of Information (FOI) page.
Redactions and exemptions
Just like FOI, there is certain information which cannot be released as part of your subject access request. The reasons for this include (but are not limited to):
- personal details about other people
- information which is subject to ongoing court proceedings
- information which would reveal management information or other confidential information
- If your information is redacted or withheld for any reason we will inform you of this
Information is not kept forever, but some of it is kept for a long time. States of Jersey Departments maintain a list of what information they need to keep and how long it must be kept for.
These are maintained in line with any legislation and standards that relate to information (e.g. keeping financial records for audit purposes). Some public information is also passed to the Jersey Archive for safe-keeping or preservation.
How to make a subject access request
You can email the subject access request team or write to: Subject Access, 19-21 Broad Street, St Helier, Jersey, JE2 3RR, or complete the Subject Access Request online form.
Submit a Subject Access Request
If you submit a request for information that is not processed by a States of Jersey Department, your request will be declined. Your request will not be passed on to a third party.
You will need to provide your real name and contact details when you make a subject access request.
You should provide as part of your request:
- your full name
- a contact address (such as an email address or a postal address, preferably both)
- a clear description of the information you want to receive, including which States Departments are involved and if possible the time periods covered
You do not have to tell us why you want the information although you will be asked to provide proof of your identity before the information is sourced, and before it is released.
Writing your request
When writing your request, be as specific as you can. We cannot process requests which ask for ‘all’ information the States of Jersey hold about you.
Be as specific as you can as this will help us to identify the information you want and make sourcing your information more efficient.
Try to keep your request clear and objective. This will help us understand what you're asking for and process your request more efficiently.
Your request may be refused in whole or in part if you are asking for information about someone other than yourself or those you have a right to ask for information about (for example a child for whom you have parental responsibility).
We can help
If you need help with writing your SAR request
email the subject access request team.
You may also be able to get help from the
Jersey Citizens Advice Bureau or
email the Gabinete de Apoio ao Portuguese em Jersey(GAPJ).
Email the Jersey Citizens Advice Bureau
Do you have to pay to make a subject access request?
You do not need to pay to make a subject access request, although we may charge an administrative fee if you require more than one copy.
The law states that you are entitled to a response within four weeks.
However, if the information you ask for is very complex, large in volume, covers a broad period of time or covers a lot of areas, this may mean that it could take longer. The law states that there can be an extension of a further eight weeks in some circumstances. If this is the case, we will contact you to let you know within four weeks of your initial request.
We may contact you to help you refine or clarify your information request so that we can respond more quickly.
Complaints and comments
If you have a question or a complaint about a subject access request you have made,
email the subject access request team.