I would like to make the following FOI. 1) Please provide copy of the steps taken by TfL SAR teem upon receiving an SAR. 2) Please provide copy of the SAR processing procedure in place within TfL SAR team.

---

TfL Ref: FOI-3562-1819

Thank you for your email of 25th March 2019 asking for information about the processes for handling Subject Access Requests at TfL.

Your request has been considered in accordance with the requirements of the Freedom of Information Act and our information access policy.

I can confirm that we hold the information you require. Your questions are answered in turn below:

Question 1) Please provide copy of the steps taken by TfL SAR team upon receiving an SAR.

Answer: There is no specific “SAR team” at TfL. Rather, TfL has a 'Privacy and Data Protection Team' that provides specialist advice and guidance to all areas of TfL on compliance with privacy and data protection polices and legislation. Subject Access Requests themselves can be received anywhere within TfL and it is up to individual teams to respond to them in adherence with all relevant legislation and policies, taking advice from the Privacy and Data Protection Team as necessary.

Question 2) Please provide copy of the SAR processing procedure in place within TfL SAR team. 

Answer: There is no single SAR processing team or procedure in place at TfL. As referenced above, it is for individual teams to respond to SARs, in line with all relevant legislation, taking advice from the Privacy and Data Protection team as necessary. General advice is provided to teams on the TfL intranet. For example, the “Responding to Subject Access Requests” page includes the following:

“If the Privacy and Data Protection team have approved your business area's process for dealing with requests for personal information (also known as Subject Access requests (SARs), you can respond directly to the person asking for information.  Details of the Subject Access request handling processes which have been approved by the Privacy and Data Protection Team, together with the relevant Subject Access request form can be found on the Access your data section of the TfL website.

All responses to SARs must include details of the Privacy and Data Protection Complaints Handling Procedure (PDF) and the requester must be informed that they are entitled to complain directly to the Information Commissioner’s Office.

However if a relevant process doesn’t appear on the TfL website it is essential that you direct the requester to the Privacy and Data Protection team so Transport for London (TfL) can respond within the one month statutory deadline.

You may be contacted by one of the teams responsible for processing SARs and asked to contribute to TfL’s response.”

The “Access Your Data” pages of the TfL website can be viewed via the following link – this includes information on how to access personal information from different areas within TfL:

https://tfl.gov.uk/corporate/privacy-and-cookies/access-your-data

The “Privacy and Data Protection Complaints Handling Procedure (PDF)” referenced above is attached with this email.

If this is not the information you are looking for, or if you are unable to access it for any reason, please do not hesitate to contact me.

Please see the attached information sheet for details of your right to appeal as well as information on copyright and what to do if you would like to re-use any of the information we have disclosed.

Yours sincerely,

David Wells

FOI Case Officer

FOI Case Management Team

General Counsel

Transport for London

Attachments

Back to top

---