Luton Borough Council was prosecuted by the HSE late last year following an incident at a high school in which an assistant headteacher was attacked by a pupil and left with life-changing injuries.
The UK Information Commissioner’s Office (ICO) has recently made some noteworthy changes to its guidance around data subject access requests (DSARs); specifically, around the time limit for responding and what may count as a ‘manifestly unfounded’ DSAR.
In light of the hallowed status of DSARs as a bulwark against the erosion of data subject freedoms, their increasing and creative use by employees, service-users and customers and the resource toll that DSARs are taking on organisations big and small, we at Anthony Collins Solicitors considered it important to highlight these otherwise, not entirely headline-grabbing tweaks.
Previously, ICO guidance stated that a DSAR should be responded to ‘without undue delay’ and within ‘one calendar month’, with the clock ticking from the day after the request was received until the corresponding date in the next calendar month. If the corresponding date were to fall on a weekend or bank holiday, the request would be due on the first working day thereafter. In some cases, this generous interpretation allowed organisations up to three extra days to field requests. The ICO now makes it clear that the one calendar month begins on the date that the request is received, regardless of whether it is a working day or not. For example, if a DSAR is received on 23 September, then a response must be sent to the data subject by 23 October.
The remaining guidelines stay the same. If the corresponding date in the next month does not exist because it is shorter, the request must be responded to on the last day of the month. If the day that the response is due falls on a weekend or public holiday, an organisation may choose to respond the first working day after.
Theoretically, the ICO’s new guidance is more in line with the wording of Article 12(3) of the General Data Protection Regulation 2016/679 (GDPR), which requires organisations to respond without undue delay and, in any event, within one month of receipt of the request. Practically, it is worth remembering that this has ramifications for more than just DSARs, as the same rules apply to all other data subject rights, i.e. rights to erasure and portability.
Much more awaited is the ICO’s guidance on what factors may legitimately indicate that a request is ‘manifestly unfounded’, allowing an organisation to refuse to comply. These factors include:
- The individual clearly not having any intention to exercise their right of access, such as making a request but then offering to withdraw it in return for some sort of benefit from the organisation. This would appear to cover those organisations that have successfully concluded without prejudice settlement negotiations with aggrieved ex-employees, as a part of which the ex-employee and/or their trade union advisor has provided written reassurances that all DSARs will be rescinded, only to have them resurrected post-signing of the settlement agreement, or if an individual offers to withdraw a DSAR in exchange for compensation; or
- The request is malicious in intent and is being used to harass an organisation with no real purpose other than to cause disruption, such as where:
- The individual has explicitly stated, in their request itself or communications, that they intend to cause disruption. Consider a scenario where an employee hints at having access directly or via third parties, to some or all of the documents that they have requested, only to make the point that if the organisation does not make full disclosures in response to other DSARs, the employee will know about it.
- The request makes unsubstantiated accusations against specific employees; e.g. of conspiracy and fraudulent manhandling of the DSAR, despite all reasonable searches being carried out.
- The individual is targeting an employee against whom they have some personal grudge; e.g. a parent who brings a DSAR or numerous DSARs about their dealings with a particular member of teaching staff against whom they have used and already exhausted all official and unofficial channels of complaint; or
- The individual systematically sends different requests to an organisation as part of a campaign, e.g. once a week. Examples include having thoroughly searched, reviewed and responded to a request and then receiving a regular ream of emails requesting further documentation, unreasonable demands for clarification on the search criteria or haranguing the organisation on any perceived unfairness in the searching or filtering process when all reasonable steps have been taken.
Although the above seems to confirm our own interpretation of the phrase, it must be made clear that this list of factors and associated examples is not exclusive. Every request that is considered to be manifestly unfounded must be judged on its own merits and within its own specific context. The question very often, is simply, “Would I, as a data subject in this scenario, reasonably expect to have access to this information?” If a request is not obviously ‘manifestly unfounded’ or excessive, e.g. repetitive in nature, even if it involves weeks of review and redaction or aids a data subject in their ongoing litigation against the organisation, the chances are that it isn’t and that it will need to be actioned.
When refusing to comply with a DSAR, it is imperative that organisations document the process that was followed (including searches conducted within databases, search terms used and how much data was retrieved), tell the data subject the reasons for non-compliance, including evidence or examples where possible, and ensure that the data subject is aware of their rights to make a complaint to the ICO or to a judicial remedy. The ICO will not generally look favourably upon organisations who extend the response deadline by up to a further two months because a request is complex, only to then claim an exemption or state that the DSAR is ‘manifestly unfounded’ or ‘excessive’.
It goes without saying that proving that a request is manifestly unfounded or excessive is just one means by which organisations can manage their burgeoning lode of DSARs. They can, and should, seek to clarify requests if the DSAR is vague, particularly complex or promises to be extensive by seeking to agree narrower or more specific search parameters, e.g. specific events, dates or individuals.
It is also worth remembering that other than in the simplest of cases, some personal data will doubtlessly be exempt because it belongs to a third party, e.g. an individual is entitled to their own disciplinary and grievance notes but not to those of other staff unless the other person has consented, or it is reasonable to disclose these in the circumstances.
Finally, other exemptions such as prejudice to ongoing negotiations and legal privilege, should not be discounted. Case law in the area makes it clear that whenever exemptions are applied, a reasonable search must be conducted so that documents are not exempted wholesale without proof of their exempt status.
All in all, the fabric of DSARs remains as we know it, but it is heartening to see the ICO confirm that a genuine common-sense approach to DSARs is very much in line with its own thinking. Meanwhile, we may look to the ICO’s own responses to the requests it receives, for reassurance and as a sneak preview to yet further guidance.
For more information, please contact Eeshma Qazi.
This ebriefing looks at the proposal to set out 'public procurement principles' in the proposed procurement legislation.
Happy New Year - our first newsletter of 2021! Throughout this year we will continue to bring you news and developments relating to the charities sector.
Local authorities should be wary of reserving contracts for local suppliers, as recommended by Procurement Policy Note (PPN) 11/20. Other contracting authorities may want to maximise their use of this
Most housing practitioners have perhaps been waiting for this news since the latest lockdown was announced by the Prime Minister on 4 January 2021.
Climate change and biodiversity is an area where significantly faster changes are needed on a global and local basis.
Chris Lloyd Smith, Adrian Leonard and Lisa Whitehouse discuss the planning opportunities available to owners of businesses and how to prepare for unforeseen events.
In their 3rd podcast of the series, Chris Lloyd-Smith and Maria Ramon discuss a number of problems with and difficulties that can arise in mediation and the mechanisms they use to overcome them.
Our previous round-up began by sharing the news that two vaccines had shown very promising test results. Here we are, not even a month later, and the first vaccines have already been administered!
The Covid-19 crisis has demonstrated that there is great resilience and innovation in the housing sector across Greater Manchester, it has also brought shortfalls and other priorities sharply into foc
To receive invitations to our events, as well as information and articles on legal issues and sector developments that are of interest to you, please sign up to Newsroom.