The Information Commissioner’s Office (ICO) has taken action against seven organisations for failing to respond to personal data requests.

The data regulator criticised the organisations, which includes the Home Office and Ministry of Defence, for failing in their duty to respond to public requests for information held about them.

Known as a ‘Subject Access Request’, organisations are obligated to respond within one to three months.

However, an investigation by the ICO found that the organisations “repeatedly failed” to meet this legal deadline.

This resulted in regulatory action, including reprimands, as well as practice recommendations issued under the Freedom of Information Act 2000.

Other organisations found to have not met these deadlines included Kent Police service, Virgin Media, and the Croydon, Hackney and Lambeth Borough Councils.

According to the ICO, the organisations were identified following a “series of complaints” over their failure to respond within statutory timeframes – or not at all.

Recommended

• National Robotarium opens in Edinburgh
• Scottish startups in “resilient” mood despite economic fears
• TikTok faces £27m fine over child privacy failures

On some occasions information was also withheld, the regulator noted, resulting in a breach of the UKGDPR and Data Protection Act.

Commenting on the action, Information Commissioner John Edwards described SARs as a fundamental right and an “essential gateway to accessing other rights”.

He said: “Being able to ask an organisation “What information do you hold on me?” and “how is it being used?” provides transparency and accountability and allows the person to ask for changes to be made or even for the information to be deleted.”

Edwards added: “We expect all information requests to be handled appropriately and in a timely way. This encourages public trust and confidence and ensures organisations stay on the right side of the law.”

Regulatory obligations

The MoD and Home Office were both issued reprimands for their regulatory infringements.

A probe into processes at the MoD revealed a backlog of more than 9,000 SAR requests. The investigation also found that people were typically waiting over 12 months for their information.

Similarly, the Home Office probe showed that over an eight-month period in 2021, the department also had a “significant backlog” amounting to just under 21,000 requests.

As of July 2022, the ICO said this backlog had been cut to just over 3,000 unanswered requests outside of the legal timeframe.

Investigations into the other organisations found:

• Kent Police received over 200 SARs between October 2020 and February 2021 – some are reported to have taken over 18 months to issue a response.
• Virgin Media received over 9500 SARs across a six-month period in 2021, with 14% of these not responded to during the statutory timeframe
• Between April 2020 to February 2021, the London Borough of Hackney did not respond to over 60% of the SARs submitted to them in the statutory timeframe – the oldest SAR was over 23 months.

A spokesperson for Virgin Media said: “We apologise that our handling of subject access requests last year was not to the standard it should have been. We have since put measures in place which have significantly improved our performance and will continue to carefully monitor this.”

Improvements

The organisations reprimanded by the ICO have been given three to six months to make improvements to their processes. Failure to do so could result in further enforcement action, the regulator wanted.

John Edwards said the ICO offers support to organisations to ensure they meet their legal obligations to the public, as well as information for individuals on how to exercise their rights.

He explained: “We will continue to support organisations to meet their obligations to individuals. In addition to providing education to people about their rights.

“This includes developing a SAR generator to help people identify where their personal information is likely to be held and how to request it, at the same time as providing information to the organisation regarding what is required from them.”

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.