In 2020 the court rules were changed to require that all residential tenants must be given 14 days’ notice of an eviction. What happens though if the eviction is cancelled on the day?
The UK Information Commissioner’s Office (ICO) has recently made some noteworthy changes to its guidance around data subject access requests (DSARs); specifically, around the time limit for responding and what may count as a ‘manifestly unfounded’ DSAR.
In light of the hallowed status of DSARs as a bulwark against the erosion of data subject freedoms, their increasing and creative use by employees, service-users and customers and the resource toll that DSARs are taking on organisations big and small, we at Anthony Collins Solicitors considered it important to highlight these otherwise, not entirely headline-grabbing tweaks.
Previously, ICO guidance stated that a DSAR should be responded to ‘without undue delay’ and within ‘one calendar month’, with the clock ticking from the day after the request was received until the corresponding date in the next calendar month. If the corresponding date were to fall on a weekend or bank holiday, the request would be due on the first working day thereafter. In some cases, this generous interpretation allowed organisations up to three extra days to field requests. The ICO now makes it clear that the one calendar month begins on the date that the request is received, regardless of whether it is a working day or not. For example, if a DSAR is received on 23 September, then a response must be sent to the data subject by 23 October.
The remaining guidelines stay the same. If the corresponding date in the next month does not exist because it is shorter, the request must be responded to on the last day of the month. If the day that the response is due falls on a weekend or public holiday, an organisation may choose to respond the first working day after.
Theoretically, the ICO’s new guidance is more in line with the wording of Article 12(3) of the General Data Protection Regulation 2016/679 (GDPR), which requires organisations to respond without undue delay and, in any event, within one month of receipt of the request. Practically, it is worth remembering that this has ramifications for more than just DSARs, as the same rules apply to all other data subject rights, i.e. rights to erasure and portability.
Much more awaited is the ICO’s guidance on what factors may legitimately indicate that a request is ‘manifestly unfounded’, allowing an organisation to refuse to comply. These factors include:
- The individual clearly not having any intention to exercise their right of access, such as making a request but then offering to withdraw it in return for some sort of benefit from the organisation. This would appear to cover those organisations that have successfully concluded without prejudice settlement negotiations with aggrieved ex-employees, as a part of which the ex-employee and/or their trade union advisor has provided written reassurances that all DSARs will be rescinded, only to have them resurrected post-signing of the settlement agreement, or if an individual offers to withdraw a DSAR in exchange for compensation; or
- The request is malicious in intent and is being used to harass an organisation with no real purpose other than to cause disruption, such as where:
- The individual has explicitly stated, in their request itself or communications, that they intend to cause disruption. Consider a scenario where an employee hints at having access directly or via third parties, to some or all of the documents that they have requested, only to make the point that if the organisation does not make full disclosures in response to other DSARs, the employee will know about it.
- The request makes unsubstantiated accusations against specific employees; e.g. of conspiracy and fraudulent manhandling of the DSAR, despite all reasonable searches being carried out.
- The individual is targeting an employee against whom they have some personal grudge; e.g. a parent who brings a DSAR or numerous DSARs about their dealings with a particular member of teaching staff against whom they have used and already exhausted all official and unofficial channels of complaint; or
- The individual systematically sends different requests to an organisation as part of a campaign, e.g. once a week. Examples include having thoroughly searched, reviewed and responded to a request and then receiving a regular ream of emails requesting further documentation, unreasonable demands for clarification on the search criteria or haranguing the organisation on any perceived unfairness in the searching or filtering process when all reasonable steps have been taken.
Although the above seems to confirm our own interpretation of the phrase, it must be made clear that this list of factors and associated examples is not exclusive. Every request that is considered to be manifestly unfounded must be judged on its own merits and within its own specific context. The question very often, is simply, “Would I, as a data subject in this scenario, reasonably expect to have access to this information?” If a request is not obviously ‘manifestly unfounded’ or excessive, e.g. repetitive in nature, even if it involves weeks of review and redaction or aids a data subject in their ongoing litigation against the organisation, the chances are that it isn’t and that it will need to be actioned.
When refusing to comply with a DSAR, it is imperative that organisations document the process that was followed (including searches conducted within databases, search terms used and how much data was retrieved), tell the data subject the reasons for non-compliance, including evidence or examples where possible, and ensure that the data subject is aware of their rights to make a complaint to the ICO or to a judicial remedy. The ICO will not generally look favourably upon organisations who extend the response deadline by up to a further two months because a request is complex, only to then claim an exemption or state that the DSAR is ‘manifestly unfounded’ or ‘excessive’.
It goes without saying that proving that a request is manifestly unfounded or excessive is just one means by which organisations can manage their burgeoning lode of DSARs. They can, and should, seek to clarify requests if the DSAR is vague, particularly complex or promises to be extensive by seeking to agree narrower or more specific search parameters, e.g. specific events, dates or individuals.
It is also worth remembering that other than in the simplest of cases, some personal data will doubtlessly be exempt because it belongs to a third party, e.g. an individual is entitled to their own disciplinary and grievance notes but not to those of other staff unless the other person has consented, or it is reasonable to disclose these in the circumstances.
Finally, other exemptions such as prejudice to ongoing negotiations and legal privilege, should not be discounted. Case law in the area makes it clear that whenever exemptions are applied, a reasonable search must be conducted so that documents are not exempted wholesale without proof of their exempt status.
All in all, the fabric of DSARs remains as we know it, but it is heartening to see the ICO confirm that a genuine common-sense approach to DSARs is very much in line with its own thinking. Meanwhile, we may look to the ICO’s own responses to the requests it receives, for reassurance and as a sneak preview to yet further guidance.
For more information, please contact Eeshma Qazi.
We are delighted to announce that our private wealth law department has continued to maintain its Band 2 position in the latest edition of Chambers and Partners High Net Worth.
The new CHF is set to launch and open for applications with £4 million set to be allocated to community-led housing groups to support an increase the supply of affordable housing in England.
Charities, like other organisations, may be subject to or choose to voluntarily comply with the reporting requirements under the Modern Slavery Act 2015.
The draft regulations making it mandatory for anyone entering a registered care home in England to have been double vaccinated unless they are clinically exempt were made on 22 July 2021.
In the Transforming Public Procurement Green Paper, the Government signalled its desire to increase its control over procurements by all contracting authorities.
The monthly round-up from the Anthony Collins Solicitors charities team.
Legal updates as the UK enters into stage 4 of the roadmap and legal restrictions on face coverings and social distancing are lifted.
The first disability we are going to discuss is diabetes. We begin by discussing the different types of diabetes; their similarities and differences and how we live with the disability within our day.
Tim Coolican and Freya Cassia explore the legal and practical options available to providers if a disappointing result is received following an inspection.
To receive invitations to our events, as well as information and articles on legal issues and sector developments that are of interest to you, please sign up to Newsroom.