On 24 May 2023, the Information Commissioner’s Office (ICO) published new guidance for employers and businesses on responding to subject access requests (SARs). The guide is a helpful tool for organisations in ensuring they comply with their obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) when responding to requests for personal data. In particular, the ICO has supplemented the document with a useful ‘SARs Q&A for employers page’ which signposts some of the commonly arising issues for organisations, including those which have recently been the subject of sanctions. Some of the key takeaways from the guidance and the new Q&A page are:
1. There are no formal requirements for a valid SAR
The guidance reminds organisations that SARs may be directed to any individual within an organisation; they may be made via social media; they do not need to include the words ‘subject access requests’; and that they may mistakenly refer to legislation other than the UK GDPR and DPA but nevertheless constitute a valid SAR.
To safeguard organisations against the potential risk of failing to identify a SAR when submitted informally, the ICO encourages organisations to ensure all staff members are wary of the organisation’s obligations to respond to SARs and can correctly identify them. Additionally, the guidance suggests that organisations employ designated individuals to respond to any SARs they may receive.
2. Strict time limits apply when responding to SARs
The guidance emphasises that a failure to comply with the time limits set on responding to SARs can result in regulatory action, including either financial sanctions or reprimands.
The ICO helpfully clarifies, however, that the time to respond to a SAR can be extended when the request is particularly complex, and that organisations have a right to seek clarification of the exact nature of the information sought by the requester before responding, thereby “stopping the clock” on the response time.
3. There is no obligation to respond if the request is manifestly unfounded or manifestly excessive
An organisation will also not be required to respond when disclosure would include, amongst other things, information identifying an individual other than the requester, a confidential reference, or documents subject to legal professional privilege. The guidance provides helpful examples of when these, and other exemptions, may be applicable and the recommended steps to adopt in determining their applicability.
4. Compliance with a SAR is required irrespective of whether the requester is in the process of the tribunal or grievance processes
However, if certain documents (such as witness statements) contain the personal data of third parties given in confidence then it may be inappropriate to disclose such documents. It’s also important to note that whistle blowers are protected by the Public Interest Disclosure Act 1998.
5. Searches of all electronic systems are necessary
Personal information can include the contents of emails stored on computer systems and that disclosure may require providing redacted versions of email correspondence. A SAR may also require searches across social medical platforms, including Facebook, WhatsApp and Microsoft Teams chat channels to be conducted for any personal information shared about the requester.
6. Enforcement action may be taken due to non-compliance
According to the ICO, between April 2022 and March 2023, 15,848 complaints related to SARs were reported to the ICO. Where an organisation has failed to comply with a SAR, the ICO can take action by issuing a warning, reprimand, enforcement notice or penalty notice.
Non-compliance by way of delayed or non-response to a SAR has clearly been the most significant issue within the health and government sectors. For example, the ICO recently issued reprimands against both Norfolk County Council (Norfolk CC) and Plymouth City Council (Plymouth CC) for their statutory infringements relating to SARs. Investigations conducted by the ICO identified substantial delays on the parts of these councils in responding to SARs, with some requests still not have been responded to despite periods of up to two years passing since they were made. Notwithstanding the significant mitigating factors identified in each of these cases (which included, for example, the impact of the Covid-19 pandemic on the ability of Norfolk CC to access manual records, or the efforts of Plymouth CC to log and track SARs with KPIs), the ICO determined in both cases that reprimands were appropriate and made recommendations to both bodies to ensure their compliance with the GDPR and DPA.
While the guidance and new Q&A page have been published in the context of the ICO expressing its intention to move away from financial sanctions towards public reprimands, organisations should be reminded that reprimands can still act to significantly damage the reputation and should not be taken lightly.
Browne Jacobson’s specialist data team is here to answer any questions you may have about your personal data obligations and guide you through your requirements when responding to a SAR.
Contact
Mark Hickson
Head of Business Development
onlineteaminbox@brownejacobson.com
+44 (0)370 270 6000
Discover more
Related expertise
You may be interested in...
Online Event - Shared Insights
Shared Insights Data: Strategies for handling cyber attacks and data breaches
Press Release
‘Privacy by design’ approach will help health and care organisations gain public trust in using technology as ICO publishes new guidance
Legal Update
Understanding the ICO's new fining guidance
Legal Update
ICO consultation on accessing care records: A legal perspective
Legal Update
Cyber-attacks in UK universities: Why failing to prepare is no longer an option
Legal Update
Artificial intelligence – shaping a sustainable future
Press Release
Spring Budget 2024: Browne Jacobson reaction
Legal Update
Not quite a blanket ban on mobile phones in schools: DfE guidance insights
On-Demand - Shared Insights
Shared Insights: Sexual safety in the workplace — how leaders can help to create a sexual safety culture
Legal Update
Gatekeepers under the DMA – TikTok’s battle to have its designation revoked
Legal Update
Progress on the Automated Vehicles Bill
Legal Update
Data protection in higher education: what to expect in 2024
Legal Update
The rise of AI in construction
Legal Update
Government foreshadows significant savings for public bodies as part of data protection overhaul
Legal Update
ICO consultation on transparency in health and social care
Legal Update
How to mitigate risk in disputes arising from AI use in technology projects
Opinion
Monitoring workers – ICO guidance
Legal Update
ICO consultation on fertility tracking apps
Published Article
UK: Legal issues with deepfakes
Legal Update
New guidance for employers on subject access requests published by the ICO
Legal Update
Ali Round 2 - High Court gives further guidance on causation and quantum for data breaches
Press Release
Browne Jacobson welcomes former ICO lawyer to support growing UK&I data privacy and tech practice
Legal Update
Update on data protection claims - Austrian Post Case
Press Release
Browne Jacobson launches specialist Ascensus programme for in house lawyers and business leaders
Legal Update
Government to expand network and information systems regulations
Opinion
Mopping up after a leak – how businesses can take steps to protect their confidential information
Legal Update
Cyber security and data breaches
Legal Update
Update on the Digital Services Act (“DSA”) – Important Dates and Deadlines Looming
Legal Update
Government publishes its proposals for expanding the Scope of the Network and Information Systems Regulations 2018
Published Article
Reaching cloud nine? Public procurement for cloud-based services
Legal Update
Protecting children and their data in the online environment
Published Article
Bruce Willis AI and the problem with deepfakes
A deepfake of Bruce Willis is advertising Russian mobile phones. Many great artistic and metaphysical questions are raised by this performance. However, this article is going to look at the intellectual property law implications, from a UK perspective.
Legal Update
DSA approved: Targeted Advertising Rules explained
Legal Update
Economic crime and cybercrime
It is clear that the digital landscape, often termed cyberspace, is a man-made environment, in which human behaviour dominates and where technology both influences and aids our role in it — through the internet, telecoms and networked computer systems, which are often interdependent. The extent to which any organisation is potentially vulnerable to cyber-attack depends on how well these elements are aligned.
Legal Update
Data reform in the UK
Since the UK left the EU and are now able to move away from the EU data protection regime, the UK government have implemented a national data strategy with the aim of reducing the burden on organisations but maintaining a high data protection standard.
Legal Update
Are local authority companies subject to the Freedom of Information Act 2000?
In this article we look at local authority companies and whether they are subject to the Freedom of Information Act 2000. And for those that are, what information are they legally obliged to submit.
Legal Update
Digital Markets Act and Data Platforms - FRANDs for life?
The Digital Markets Act (the “DMA”) joins the dots between competition law and data protection law and actively targets data-driven platforms. It is also a comprehensive regulation to take note of, with familiar GDPR-style fines tied to turnover.
Legal Update
Avoiding the pitfalls of WhatsApp
The use of social media platforms and applications can have overwhelmingly positive benefits for public bodies. However, regulatory action recently taken by the Information Commissioner, has highlighted various pitfalls that public bodies should seek to avoid if allowing staff to use social media as a communication tool.
Legal Update
ICO consultation on research provisions guidance
The data protection legislation (namely, the UK GDPR and Data Protection Act 2018) contain various provisions that deal with the processing of personal data for research purposes.