The Information Commissioner's Office maintains a register of Data Controllers and enforces the various pieces of information legislation when a complaint is received. It can investigate breaches of the legislation. It cannot award you compensation for those breaches, although if a crime has been committed by that breach then it may prosecute the Data Controller concerned.

The two pieces of legislation that most people will use to access information are the Freedom of Information Act 2000 and the Data Protection Act 1998

Freedom of Information Act

Under this law you can request any recorded information held by a public authority (eg. a local council or a state school). However, information that unfairly reveals personal details about other people will be redacted (ie. "censored") or not provided at all. The request should be in writing (either a letter, fax or email) but does not have to give the reasons why you want the information, or mention the law under which you are requesting it. You should be as specific as possible about identifying the information you want. The public authority may make a reasonable charge for providing the information you ask for (eg. photocopying expenses, etc).

An example of a Freedom of Information Act letter can be found here

The authority must reply to your request within 20 working days, either with the information requested or with the reasons why it can't provide the information. If it requires more time to consider your request they should reply within 40 working days from your initial request.

If you think the authority is withholding information which they should be disclosing, or have not responded within the time limits set out above, you can complain following the procedure set out below.

Data Protection Act

Under this law you can obtain information held by a Data Controller about yourself. A Data Controller is anybody who processes or holds information about a living person who can be identified from that information. Generally, a Data Controller includes businesses, public authorities or other organisations. The information must be held or processed on electronic equipment (eg. computers, phones), including paper information which will be input to the electronic system, or on a "highly-indexed" paper filing system.

The Data Protection Act does not apply to individuals holding information solely for personal use, nor to information about dead individuals or non-individuals (eg. companies or organisations).

Again, your request should be in writing and, if no other address is specified, write to the organisations registered or head office. The organisation will usually charge a fee of up to 10 for each request, and must reply within 40 days from the date of receipt of the request and fee. You do not have to mention the Data Protection Act by name in your letter. Such requests are known as "Subject Access Requests" under the Act. An example of a subject access request letter can be found here

Complaints Procedure

If you think the organisation is wihholding information it should be providing, or has simply not supplied the information requested in the time limits allowed, you can complain.

The first step in the complaints procedure is to write to the organisation concerned with a letter asking them to deliver the information requested, explain why they haven't delivered it to you, or otherwise give them a chance to put things right. Give them a short time to respond, say 14 days. If you still have not received a satisfactory outcome through the organisations internal complaints department, you can then (and only then) complain to the Information Commisioners Office.

The Information Commissioners Office can investigate breaches of the law and ask the organisation concerned to solve the problem. It cannot award compensation. It's main purpose is to change the way the organisation works to ensure compliance with the law in the future.

It is important that you have sufficient evidence (copies of letters, etc) to start a complaint. Bear in mind that if there is no conclusive evidence either way the Information Commissioner will usually give the benefit of the doubt to the organisation whose actions have been called into question.

The Information Commissioners Office has a page detailing how to refer a complaint to them.

Additionally, or alternatively, you can take your complaint to the Courts to obtain compensation. The Information Commissioner has produced a booklet to help you in taking your case to court

The Courts Service have a range of forms and booklets to help guide you through the process, which can appear daunting at first to many people. Two publications commonly downloaded are the Claim Form N01 and the Claim Guide EX302. There will be a fee charged by the Court to initiate the legal process. Claims for less than 5,000 are dealt with through the small claims track, whereby each party has to bear its own legal costs.