Can Someone Submit A DSAR On Someone Else’s Behalf?
There are a number of scenarios where it is appropriate for someone to submit a DSAR on someone else’s behalf. This includes: Where the individual has given their consent Where the individual has granted someone else power of attorney Where parents are acting on behalf of their children The Individual Has Given Their Consent An individual may request someone else (a third party) make a DSAR on their behalf (e.g. a relative, friend, solicitor). Before providing the personal information to this third party, it is important that the organisation is sure that the individual making the request is entitled to act on behalf of the individual whose personal data it is. It is the third party’s responsibility to provide evidence of their authority e.g. a written authority, signed by the individual, stating that they give the third party permission to make a DSAR on their behalf. The Individual Has Given Someone Power Of Attorney There are other scenarios where a third party is able to submit a DSAR on someone else’s behalf such as power of attorney. Whilst the attorney's* particular powers and situation determine whether they can submit a Data Subject Access Request, it is reasonable to assume that an attorney with authority to manage the property and affairs of an individual has the appropriate authority to make a DSAR on their behalf.(*This doesn’t necessarily mean attorney in the sense of a solicitor, etc. It’s a term used to define an appointed individual). An example of this would be where an individual does not have the mental capacity to manage their own affairs, and would therefore likely have someone with power of attorney to manage their affairs. Again, It is reasonable to assume that this attorney is able to submit a DSAR on their behalf. Parents Are Acting On Behalf Of Their Children As stated above, children can submit their own Data Subject Access Requests. However, parents or guardians are able to exercise this right on their behalf. If the child is 12 years old or over, the organisation should check whether the child authorises the disclosure of their personal data to their parent or guardian. Conversely, the child may authorise someone else, other than a parent or guardian, to make a DSAR on their behalf.