The GDPR gives data subjects the right to access the personal data which a controller holds in relation to them. Although this may sound fairly innocuous, dealing with DSARs in practice continues to be a source of much frustration for controllers, particularly in the field of employment where DSARs are often used by disgruntled employees as part of a wider litigation strategy.
Meanwhile, the ICO’s Annual Report 2018-19 (published in July 2019) shows that subject access requests generate by far the most complaints to the regulator (at 38%). We expect the use of DSARs will continue to be prevalent in 2020. Businesses who do not yet have processes in place for dealing with such requests should develop procedures and protocols to be followed when requests are received. To this end, the ICO published updated draft guidance in relation to the right of access towards the end of 2019. Some key points for controllers to note are as follows:
- Procedure for submitting requests – there is no particular procedure data subjects must follow when submitting a DSAR. Individuals do not need to designate their request as being a DSAR for it to be treated as such. Furthermore, individuals can submit DSARs through whatever channel they prefer (including verbally), meaning that it’s important that relevant staff are trained in recognising such requests.
- Receiving DSARs from 3rd parties – it is common for 3rd parties, such as law firms, to submit DSARs on behalf of others. In such circumstances, controllers are entitled to (and should) ask the relevant 3rd party for proof of the authorisation permitting them to act on behalf of the data subject. The onus is on the 3rd party to provide proof of authorisation, and this can be achieved through a letter of authorisation or a general power of attorney.
- Time for responding to DSARs – normally you must comply with a DSAR without undue delay and at the latest within one month of receipt of the request. You can extend the time to respond by a further two months if the request is “complex” or you have received a number of requests from the same individual. Some organisations claim the extra time on the basis that the request is complex because it involves a large volume of information. The ICO guidance indicates that, while this may add to the complexity of a request, a request is not complex solely because the individual has requested a large amount of information.
The ICO guidance provides helpful advice in relation to the timeframe controllers are required to respond to DSARs, including the circumstances in which a controller may be able to extend the time for responding to a request on the basis of it being “complex” or where it has received multiple requests from the same individual.
The following are given as examples of factors that may in some circumstances add to the complexity of a request. However, you need to be able to demonstrate why the request is complex in the particular circumstances:
- Technical difficulties in retrieving the information – for example if data is electronically archived.
- Applying an exemption that involves large volumes of particularly sensitive information.
- Any specialist work involved in redacting information or communicating it in an intelligible form.
One key area where the ICO has changed its position is in relation to circumstances where a controller needs to raise clarifications in relation to the DSAR. Whilst previously the ICO had taken the view that the statutory timeframe for responding to a DSAR would not commence until the controller received a response to any clarifications raised by it, this is no longer the case in the updated guidance. The ICO now takes the position that the timeframe for responding commences from the date the DSAR is received, irrespective of whether any clarifications are raised by the controller or whether the data subject has replied.
- Being ready for DSARs – the ICO guidance expresses little sympathy for controllers who aren’t able to process DSARs efficiently, stating that DSARs have been a feature of the law since the 1980s and that therefore organisations should have systems in place to deal with them. From our experience, many organisations do not currently have systems in place to deal with DSARs, and particular difficulties are faced with unstructured data such as emails. While there are a growing number of third-party solutions which claim to assist, organisations are often forced to expend significant time and expense in dealing with DSARs.
- Charging for DSARs – the guidance provides further guidance as to what is meant by the “administrative” costs which can be charged by controllers where an individual submits excessive or manifestly unfounded DSARs. Printing, photocopying and postage would fall within the meaning of an administrative costs. Charging for employee time taken to deal with such requests – which can be significant – would not be.