Information Commissioner issues Code of Practice on dealing with subject access requests

This article was produced by Olswang LLP, which joined with CMS on 1 May 2017.

The Information Commissioner's Office ("ICO"), which regulates compliance with the Data Protection Act 1998 ("Data Protection Act"), has published a Code of Practice for organisations when dealing with requests from individuals for personal information, known as data subject access requests (which can be viewed here).

Under the Data Protection Act, individuals have a right to find out what personal information an organisation holds about them by making a subject access request. Employers are increasingly receiving such requests from employees, often where an employment related dispute has arisen. The new Code of Practice is intended to provide useful guidance to organisations to help them deal with such requests.

The Code of Practice covers each aspect of receiving and responding to a request and the online version contains useful hyperlinks to other ICO guidance, such as its Guide to Data Protection (here) and its Guide to Determining what is Personal Data (here).

As part of its launch of the new Code of Practice, the ICO has also published 10 simple steps which organisations should consider when responding to subject access requests, which include:

• If you need more information from the requester to find out what they want, then ask at an early stage
• If you are charging a fee, ask for it promptly
• Consider whether the records contain information about other people
• Consider whether any of the exemptions apply

An interactive version of the checklist is available here.

Practical considerations

• ICO statistics state that during the last financial year, they handled over 6000 complaints related to subject access requests.
• Replying to subject access requests can be a complex process and therefore the new Code of Practice will provide useful guidance on the most common problems faced by employers when responding to such requests.
• However, employees or ex-employees may point to an employer's failure to comply with the Code of Practice in order to allege a breach of that employer's obligations under the Data Protection Act. In these cases, it should be noted that the Code of Practice is only guidance and, whilst likely to be considered by any relevant court and, crucially, by the ICO when handling any complaints or proceedings, failure to follow the Code will not in itself be a breach of the Data Protection Act.