Many patients are aware that they can request copies of their dental records. Known as subject access requests (SARs), these rights of access to personal data and other supplementary information are granted under UK data protection law.

But as well as their own personal data, patients may also ask for copies of any communications their dental professional may have had with their defence organisation. This can often happen in the context of an ongoing complaint or claim, and so raises some different questions for dental professionals than those involved with a SAR for copies of dental records.

So what happens if a patient makes an SAR that includes a request for information you may have shared about them with a third party - such as the DDU?

UK data protection law

The relevant law governing rights of access can be found at Article 15 of UK GDPR, and in the definition of personal data at Article 4(1), which specifically states that, "'Personal data' means any information relating to an identified or identifiable natural person."

That means someone who can be identified by reference to (as cited in the law,) "a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."

Do you have to disclose?

Although 'legal privilege' - the protection of information shared between a lawyer and their client - might apply to some exchanges you have with the DDU, it does not automatically apply.

The need for disclosure depends on what information you have exchanged with the DDU, and crucially, whether the patient is identifiable.

• If you include the name of the patient in the information you forward to the DDU, the information is probably disclosable because the patient is identifiable.
• If the patient is not identified by name, and there is nothing else that can identify the patient, the information is not disclosable because the patient is not identifiable.

In some cases we've dealt with, members redact (anonymise) some information they send us, such as the name, address, email addresses and telephone numbers from the records. But they don't redact other documents such as emails or referral letters, which means some exchanges may be disclosable.

There may be an assumption by the person making the request that under an SAR, there is an obligation on the data controller to provide copies of all the documents that include personal data.

That is not correct.

An SAR is meant to allow a data subject to verify that their personal data is being processed lawfully by the data controller. The request focuses on the personal data, not the document.

It's therefore often acceptable to provide an extract or a summary of the data.

Would draft complaint responses be disclosable?

Drafts that have been amended or deleted are not disclosable. There is no obligation on a data controller to reconstruct documents that did exist but have since been replaced or amended.

If a draft does exist and the patient is not identifiable in the document, it is not disclosable. 

If draft responses exist and contain a reference to the patient by name, or in some other way that makes the patient identifiable, the patient should be provided with the document (or a summary) to allow them to verify that their personal data is being processed lawfully.