Part 4: Intelligence services processing Chapter 3: Rights of data subjects Sections 94 and 95: Right of access
These sections set out the right of access accorded to data subjects and the information that should be disclosed on request so that the data subject is aware of, and can verify the lawfulness of the processing. Securing such access would then enable a data subject, if necessary, to exercise the other rights provided for in this Chapter, namely the rights to rectification and erasure. Controllers must respond to subject access requests promptly and, in any event, within one month (or such longer period, not exceeding three months, as is specified in regulations made by the Secretary of State). In contrast to the GDPR and the provisions in Part 3 of the Act, under these provisions a controller may charge a reasonable fee before responding to subject access requests.
	Sections 94(6) and 95(5) provide for situations where the personal data which would be disclosed following the right to information, also constitutes the personal data of another person. In such cases the data controller may restrict the provision of this data, unless the other party has consented to the disclosure or can be rendered unidentifiable.
	If a controller does not comply with a request under section 94(1) the data subject who made the request can apply to the High Court (or, in Scotland, the Court of Session) under section 94(11) for an order requiring the controller to comply with the request. Under section 94(12) a court may make an order under subsection (11) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates. In practice, this means that any order made by the court must be consistent with the responsibilities assigned to a controller under a joint controller agreement.
	Section 95 describes how the controller must provide a copy of personal data to a data subject, and the circumstances under which a controller may decline to respond to a subject access request where it duplicates a previous one.