The Labour Party has been reprimanded by the Information Commissioner’s Office (ICO) after repeatedly failing to respond to people who asked what personal information the party held on them.

Known as a subject access request (SAR), a backlog of this type of request developed after the Labour Party faced a cyber-attack in October 2021.

In November 2022, the party had received 352 SARs from the public which required a response.

Of that number, 78% had not received a response within the maximum compulsory time limit of three months, and over half (56%) were significantly delayed by over one year.

In total, the ICO received over 150 complaints regarding the Labour Party’s handling of SARs in the year from November 2021 to November 2022.

During its inquiry, the regulator was also informed of the existence of a “privacy inbox” that had not been monitored by the Labour Party since November 2021.

The inbox in question contained around 646 additional SARs, and approximately 597 requests for personal information to be deleted.

While some of these may have been duplications, none of the requests had been responded to by the Labour Party.

Under data protection law, people have the right to ask an organisation if it’s using or storing their personal information and to receive a copy of any personal information held.

They also have the right to ask firms to ensure that their personal information is up-to-date and accurate, or, in certain cases, deleted.

The ICO said that, since engagement, the Labour Party has continued to take steps to address its backlog.

This includes assigning three temporary members of staff to solely tackle the outstanding requests, allocating extra funds, and implementing an action plan.

Recommended reading

• Nine in 10 Organisations to Increase Data Security Budgets
• Critical Infrastructure Cyber-Attacks up 30%
• Which Industries Face the Most Cyber-attacks?

“Being able to ask an organisation ‘what information do you hold on me?’ and ‘how it is being used?’ is a fundamental right, which provides both transparency and accountability,” said Stephen Bonner, deputy commissioner at the ICO.

“It is vital that organisations do not underestimate the importance of responding to these requests on time.”

“The public need to fully trust that a political party will handle their data correctly and respect their information rights.

“We welcome news that the Labour Party has now cleared its backlog of SARs and implemented further measures to ensure people receive a prompt response going forward.”