Verifying identity

5. It may be necessary to verify the identity of the requester, absolutely so if they are requesting data on behalf of another party, (such as a child below the age of 18, or as a carer for an elderly person.

6. The rights of the child as the data subject will not necessarily be overruled by a request from a third party such as a parent that has proved their identity. The request is to be balanced against the data rights of the child, and their best interests in the view of an appropriate officer employed by the Authority. Any rationale applied to refuse or agree to release of data is to be documented.

7. No data is to be released until identify of the requester is confirmed, and if making a request on behalf of a third party, that they have the appropriate powers to do so, such as power of attorney over their affairs.

8. Reasonable steps to establish identity may include receipt of a copy of something with the requesters’ name and address on, such as a driving license. If received electronically, proof of identify is to be destroyed once the request has been verified.