STANDARDS & GUIDELINES INDIVIDUAL REQUESTS FOR DISCLOSURE MAY BE SUBMITTED ORALLY OR IN WRITING AND NEED TO INCLUDE: „ Proof of identity of the author of the request. Where the request is made by a duly authorized legal representative, proof of authority to act on behalf of the person of concern. Where the author of the request is an agency or organization, documentation supporting the authenticity and mandate of the agency or organization; In addition, it is useful for the handling of requests to know: „ The precise information requested; and „ The reason of the request. UNHCR staff who receive oral requests should ensure that the information required to support the request is received, and should record the details of the request on the individual file and on UNHCR’s case management database, as necessary. UNHCR Offices should respond to requests for personal data or other information on individual RSD files within a reasonable time and in a language and manner that the individual requesting the information would understand. As a general rule, responses should be in writing, and provide reasons where a request is denied. The action taken in relation to each request should be recorded on the file of the asylum-seeker or refugee concerned and on UNHCR’s case management database, as necessary. Disclosure of information on the RSD file of an asylum-seeker or refugee should be done in accordance with the guidance set out in the sections above and in accordance with UNHCR’s data protection policy and guidance. Individual requests made by persons other than the asylum-seeker or refugee about whom the information is sought will generally require the consent of the asylum-seeker or refugee concerned. The scope of disclosure of information from individual files should be limited to what is necessary and proportionate to further the legitimate purpose for which the information is sought. UNHCR staff should exercise the utmost sensitivity regarding the release of any medical information, unless this is specifically authorized by the individual concerned. The decision to disclose, or not to disclose personal data and other information on file gathered through the RSD process rests with the Protection staff member designated under established procedures in the UNHCR Office. It is recommended that the responsibility for requests for information from RSD files is delegated to the RSD Supervisor or a senior Protection staff member with overall responsibility for supervising RSD in the Office, who may seek advice from the designated Protection staff member or the Data Protection Officer in DIP, as necessary and in accordance with the data protection policy and guidance. Methods of disclosure of information should be carefully controlled. Unrestricted access to individual UNHCR files should not be permitted. Appropriate steps should be taken to minimize opportunities for misuse or adulteration of the information provided, including providing hardcopies rather than electronic copies of information wherever possible. Whether information regarding an individual file is shared with the individual concerned, a third party or another UNHCR office, UNHCR staff should identify and adopt an appropriately secure method and form for transmitting the information, taking into account the sensitivity of the information and the urgency 30 Procedural Standards for RSD under UNHCR’s Mandate