ICO Publishes New Guidance on Responding to Subject Access Requests (SARs)

Background

On May 24, the UK Information Commissioner’s Office (ICO) published New Guidance, in the form of a Q&A, for businesses and employers on responding to Subject Access Requests (SARs).

Subject Access Requests form part of the UK General Data Protection Regulation (UK GDPR) in Art.15 of the UK GDPR and Data Protection Act 2018 (DPA 2018) in Part 3 of DPA 2018.

The right of access, which is commonly referred to as a Subject Access Request (SAR), gives individuals the right to obtain a copy of their personal information. Organisations must respond to a SAR without delay and within one month of receiving a request. However, a SAR could be extended up to two months in complex situation.

SAR Complaints to the ICO

ICO are taking appropriate actions on organisations for failing to comply with SARs and from April 2022 to March 2023, 15,848 complaints related to SARs were reported to the ICO.

Recently, ICO reprimanded Plymouth City Council and Norfolk County Council for failing to respond to SARs.

Plymouth was found to have taken up to two years to complete SARs in 18 separate cases and Norfolk had only responded to 51% of SARs on time between April 2021 and April 2022.

In September 2022, ICO took actions against seven organisations who failed in their duty to respond to SARs. For more information, please see here.

Many organisations are misunderstanding the nature of SARs or underestimating the importance of responding to requests, explaining the high number of complaints.

This has led to ICO publishing the new Guidance. This newsletter article explains some of the key SARs clarifications emphasised by the ICO.

Key ICO clarifications on SARs

• Submission format – there is no formal requirement on how SARs should be submitted. A SAR can be exercised in verbal or in written format, including through social media channels. A request does not have to be made to a specific person or a business function.
• Request for clarification – organisations have the right to ask for clarification from a data subject if a request is not clear. The time limit for responding to the request is suspended until the clarification is received.
• Withholding information – a data controller can withhold information where an exemption applies. For example, where other individuals’ information will be disclosed, and where SARs are manifestly unfounded or manifestly excessive according to DPA 2018 Schedule 2, Part 1, Paragraph 2.
• Management information – an exemption applies to personal information processed for management forecasting or planning about a business or other activity. A data controller may refuse the response to a SAR if the disclosure is likely to prejudice the conduct of its business.
• Non-disclosure agreement – a data controller must comply with a SAR in this regard as SARs cannot be overridden by a non-disclosure or settlement agreements.
• Tribunal – organisations must comply with a SAR when an employee is undergoing tribunal or a grievance process, even if the data controller believes the information might be used to support any claim or for potential litigation.
• Non–work related personal information – this SAR definition could apply, for example, to employees emails from personal email accounts accessed on work laptops. Organisations should have policies and procedures in place to make employees aware of what they can and cannot do on the organisation’s IT systems. An effective way of doing this is to have Acceptable Use Policy in place.
• Email information – organisations must consider what information included in emails constitutes as personal information of the requester. Before disclosing information, check the contents of the email and the context of the information it contains, and redact/exclude other people’s information.
• CCTV footage – CCTV footage that includes other persons’ information may be disclosed where the organisation has obtained their consent or if it is reasonable to do so without their consent. When installing a CCTV system, choose one that allows for the redaction of other people’s information.
• ICO advice on SARs – whilst the ICO can provide information and guidance on the interpretation and compliance with data protection legislation, it is an independent regulator and cannot advise organisations on how to respond to a SAR. Organisations must demonstrate compliance with their duties under the relevant legislation.

Our recommendations on process improvement for handling SARs

Based on the guidance above, organisations, especially UK organisations, should consider implementing the following process improvements when handling SARs

• Review current handling of the SARs process against the New Guidance and update appropriately.
• Review other internal policies which may be affected by the updates for example IT Security Policies.
• Train staff or consult with the relevant departments, for example HR or IT for the new changes.

How can we help?

Trilateral’s Data Protection and Cyber Risk Team  is a Team of dedicated data protection specialists with extensive expertise and experience in supporting public and private sector organisations. We can assist you with all aspects of the right of access, e.g., review or draft SAR Policies and Procedures, as well as by providing you with comprehensive advice on requests you may have received. Please contact us, we would be incredibly happy to assist you.