Enforcement notices served under the 1998 and 2018 Data Protection Acts for sustained failures to comply with individuals’ rights in respect of subject access requests.

The UK’s Information Commissioners Officer (ICO) have been working with the Metropolitan Police Service (MPS) to address its large data subject access request (DSAR) backlog, but it came to light that Police service had more than 1,100 open requests, and that nearly 680 were over three months old, which the ICO said is a “cause for concern”.

The Police service has failed in its data protection obligations by not responding to DSARs within a calendar month and as a result, the ICO have issued two enforcement notices ordering the MPS to respond to all requests by September 2019.

The ICO have also ordered the Police service to make changes to their internal systems, procedures or policies, so that people are kept up to date on any delays that may affect their data protection rights and how the situation is being addressed.

Suzanne Gordon, Director of Data Protection Complaints and Compliance at the Information Commissioner’s Office commented; “Ultimately, the public must be able to trust that police forces are upholding their information rights, and this case is a reminder to other police forces that the ICO will take action against those organisations that do not comply with their SAR obligations“.

ICO advice to Police Forces

The ICO have issued these practical steps, aimed at Police forces, for responding to subject access requests:

There are a number of practical steps that police forces can take to ensure they deal with SARs in line with the law. It is worth remembering that it is in Part 3 of the DPA2018 where police forces will find the rules surrounding the processing of data for law enforcement purposes.

  • There is no requirement for a request to be in writing, so it is good practice for police forces to have a policy for recording details of all the requests received, including verbal requests.
  • Requests can be responded to electronically (as long as it is secure) and paper copies can be provided only if you are asked to do so and it is reasonable.
  • Requests need to be replied to within one calendar month. For practical purposes, we recommend that police forces adopt a 28-day period to ensure they respond to requests within the time limit.
  • Police forces can ask for further information to establish the identity of a requester, particularly where sensitive data is involved. Such requests should be reasonable and proportionate. The calendar month time limit will start once you have received the necessary information.
  • Although police forces must consider every request, you may limit the amount of information provided if, for example, it would prejudice an investigation or legal inquiry.
  • Police forces should make the public aware of any delays which may affect their requests. They also need to explain how the situation is being addressed.

For more advice the right of access and how to respond, we’re here for you.  See www.tdwico.com