A Subject Access Request has to be made in writing but doesn't have to be a "hard copy", meaning a valid SAR can be submitted via Twitter, Facebook, etc. Additionally, it doesn't have to be submitted to the person that deals with them or via a form. Which in the case of Scotrail giving a driver...