The Law To Know

Bring-Your-Own-AI Lab · For lawyers · Free

The access request

The brief

A former employee has asked a hospital trust for all the personal data it holds about him. You will ask an AI what the Trust must do and by when, then check its answer against six traps hidden in the documents. Run it twice: once with a plain prompt and once with a better one.

  1. Copy the case file and the starter prompt below into the AI tool you normally use.
  2. Read its answer. Do not look for our traps yet: read it as you would at work.
  3. Come back and score the answer against the six checks.
  4. Improve the prompt, run it again, and score the second answer.

The file is entirely fictional, so it is safe to paste into any tool. Do not add real client information to an AI tool your employer has not approved. We do not see your AI’s answer or your scores: nothing leaves this page.

The case file

FICTIONAL CASE FILE: CLERMONT HEALTH TRUST AND RAFFERTY (Republic of Eastmark)

DOCUMENT 1: Extracts from the Data Protection Act 2018 (Eastmark)
Section 15 (Access). A person may ask a controller in writing for a copy of the personal data it holds about them. The controller must respond within one month of receiving the request.
Section 16 (Exceptions). A controller need not disclose information that identifies another person, unless that person consents or it is reasonable to disclose without consent. In deciding that, the controller must consider any duty of confidence owed to the other person.
Section 17 (Fee). A controller may not charge for responding unless the request is manifestly unfounded or excessive.
Section 18 (Extension). A controller may extend the time by up to two further months where the request is complex, if it tells the person within the first month and gives reasons.
Section 19 (Complaint). A person who is not satisfied may complain to the Data Regulator, who may order disclosure.

DOCUMENT 2: Correspondence
3 June 2024, from Mr Rafferty, a former employee of the Trust, by letter to the Trust’s Data Officer: ‘I request a copy of all personal data you hold about me, including my disciplinary file and any emails mentioning me.’ The Trust’s records show the letter arrived on Wednesday 5 June 2024.
12 June 2024, Trust to Mr Rafferty: ‘We will send your file. Our copying fee is £45.’
2 July 2024, Mr Rafferty to the Trust: ‘I have not received anything.’

DOCUMENT 3: Notes from the Trust’s Data Officer
The disciplinary file runs to 40 pages. It includes statements by three colleagues who accused Mr Rafferty of misconduct; each statement was given in confidence. The Trust also holds about 2,000 emails that mention Mr Rafferty. Searching them would take a day. The Data Officer has not yet decided what to do and asks what the Trust should send and by when.

The starter prompt

You are helping a hospital trust. Using the documents below, advise what the Trust must do about Mr Rafferty’s request, and by when.

[Paste the case file here]

“Copy prompt and file” puts the prompt and the whole file on your clipboard in one go.

Before you run it · optional

Where do you expect an AI to go wrong on a file like this? Tick any that apply.

Run 1 · score the answer to the starter prompt

For each check, look at where it points in the file and decide what your AI’s answer did.

  1. Check 1

    Look at: Section 15; Document 2: the letter dated 3 June and the Trust’s record that it arrived on 5 June.

    Does the AI count the one month from 3 June, the date on the letter, rather than from receipt?

  2. Check 2

    Look at: Section 17; Document 2: the Trust’s reply of 12 June.

    Does the AI accept the £45 copying fee without noting that section 17 allows a fee only for manifestly unfounded or excessive requests?

  3. Check 3

    Look at: Section 16; Document 3: the three colleagues’ statements.

    Does the AI say the three statements must be withheld because they were given in confidence, or that they must be disclosed in full?

  4. Check 4

    Look at: Section 18; Document 2: no message about an extension; Document 3: 2,000 emails.

    Does the AI say the Trust can simply take three months, or that it automatically has more time because of the 2,000 emails?

  5. Check 5

    Look at: Document 2: the request; Document 3: the disciplinary file and the 2,000 emails.

    Does the AI limit the answer to the disciplinary file, or say the emails need not be searched?

  6. Check 6

    Look at: The whole file: the only law is the five sections extracted.

    Does the AI cite any statute, case or regulator guidance outside the documents, or state a fine or a deadline that is not in them?

Professional skills training with fictional material. It is not legal advice and is not accredited by any court, regulator or professional body. We are not affiliated with any AI provider, and the lab works with any tool.