FOI-01742

#Request _QUESTION 1:_ _Please advise how many Data Subject Access Requests (hereafter referred to as SARs) you received and responded to in 2021, 2022 and 2023 relating to employees (past or present) and other requests (e.g. customers, general public, service users etc)._ _The next few questions relate to the SARs process which includes collating (pulling the data together from across your organisation/department), redacting the data, pulling the information/ data together into a response and checking the information before issuing it to the requestor._ _QUESTION 2:_ _When responding to SARS do you manage the process in-house, or do you outsource the whole or part of the process? And if conducted in house please specify the name of the team/function that is responsible for this part of the process (eg Data Privacy, HR, etc)._ _If for example you outsource one type of SAR (e.g. employee) but complete others (e.g. citizen/customer) inhouse, please provide details._ _QUESTION 3:_ _Approximately how many working hours does it take to pull together a typical SARs response, this includes the time taken to collate and redact the information, and putting the information together for issuing?_ _QUESTION 4:_ _What is the estimated percentage of handwritten documentation within a typical SAR response?_ ##Response __Question 1__ A copy of the information is attached. This data relates to SAR responses issued to the requestor in the dates detailed above. It also only includes recognised SAR requests and does not include BAU, invalid or cancelled requests. This is based on SAR requests received by the NHSBSA who are known to be employees / former employees, as they have identified their request relates specifically to their employment. This does not include data for employees who may have made requests relating to other services within the NHSBSA such as prescriptions, as these are not recorded as being by employees. __Fewer Than 5 requests__ Please be aware that I have decided not to release the exact number of requests where the total number of requests falls below 5. This is because the patients could be identified, when combined with other information that may be in the public domain or reasonably available. This information falls under the exemption in section 40 subsections 2 and 3A (a) of the Freedom of Information Act. This is because it would breach the first data protection principle as: a) it is not fair to disclose patients' personal details to the world and is likely to cause damage or distress. b) these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the patients. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/40 __Breach of Patient confidentiality__ Please note that the identification of patients is also a breach of the common law duty of confidence. A patient who has been identified could make a claim against the NHSBSA or yourself for the disclosure of the confidential information. The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/41 __Question 2__ A copy of the information is attached. To help you understand the type of information the NHSBSA hold I have provided the following web link. http://www.nhsbsa.nhs.uk/About.aspx This provides an overview of the NHS Business Services Authority which summarises the various services we provide. __Question 3__ I have established that the information you requested is not held by the NHS Business Services Authority. This is because we do not hold an estimate and do not record the time taken to process a SAR. __Question 4__ I have established that the information you requested is not held by the NHS Business Services Authority. This is because we do not identify the number of handwritten documents within a SAR. __Data Queries__ If you have any queries regarding the data provided, or if you plan on publishing the data please contact [email protected] ensuring you quote the above reference. This is important to ensure that the figures are not misunderstood or misrepresented. If you plan on producing a press or broadcast story based upon the data, please contact [email protected] This is important to ensure that the figures are not misunderstood or misrepresented. The information supplied to you continues to be protected by the Copyright, Designs and Patents Act 1988 and is subject to NHSBSA copyright. This information is licenced under the terms of the Open Government Licence detailed at: http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ Should you wish to re-use the information you must include the following statement: “NHSBSA Copyright 2024” This information is licenced under the terms of the Open Government Licence: http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ Failure to do so is a breach of the terms of the licence. Information you receive which is not subject to NHSBSA Copyright continues to be protected by the copyright of the person, or organisation, from which the information originated. Please obtain their permission before reproducing any third party (non NHSBSA Copyright) information.