The right of subject access has been a cornerstone of the Data Protection Act 1998 (“the DPA”). This is the right that allows individual data subjects to, among other things, receive confirmation from a data controller whether or not the controller is processing their personal data and to obtain copies of that data which is being processed by the data controller. Under the DPA, data controllers have 40 calendar days in which to respond to a subject access requests and can charge a fee which does not exceed the prescribed limit (which is £10 for most data controllers).
The critical importance of the right of subject access means there is no surprise that the General Data Protection Regulation (“GDPR”), which becomes applicable from 25 May 2018, continues to have in place a right of subject access. The right of subject access is to be found in Article 15 of the GDPR and has been incorporated into Clause 43 of the Data Protection Bill, published by the government earlier this month. There have been some changes to that right which are designed to make it much more effective for data subjects. This blog post explores some of the key changes to the right of subject access; however, it is by no means comprehensive.
The first key change to note is the length of time that data controllers will have to comply with a subject access request; this is being reduced from the current 40 calendar days to 30. Where the data controller has “reasonable doubts as to the identity of an individual making” as subject access request, then they may request the provision of additional information to enable the controller to confirm the identity. Where such a request is made, Clause 52 of the Data Protection Bill provides that the 30 day period does not begin to be calculated until the day on which that information is provided to the data contoller. It should be noted though that this does not provide a route to delay the fulfilling of a subject access request; the data controller must have doubts as to the identity of the requester and those doubts must be reasonable.
In terms of fees, there is no provision within the GDPR for a data controller to request a fee for making a subject access request; however, Article 15(3) of the GDPR does permit data controllers to charge a reasonable fee based on administrative costs for providing copies of the personal data being processed beyond the first copy (i.e. the first copy is free). For subsequent copies, what will be considered a “reasonable fee” remains to be seen. The Data Protection Bill has supplemented this provision and allows the Secretary of State to set a cap on such fees. There has not yet been any indication as to whether (a) the Secretary of State will set such a cap; and (b) if so, what that cap will be.
The administrative fines provisions of the GDPR apply to the right of subject access and a failure to comply with the requirements of Article 15 can attract a maximum administrative fine of the greater of €20m or 4% of global turnover.
Data Controllers have sometimes interpreted the right of subject access under Section 7 of DPA as only providing a right to receive copies of the personal data processed, but that is not the case; and it continues to be the case under the GDPR. Data Controllers should therefore familiarise themselves with the full suite of rights that a data subject has under the heading of subject access; these can be found in Clause 43(2) of the Data Protection Bill or in Article 15 of the GDPR.
There are a number of circumstances in which a data controller can restrict a data subject’s right of subject access. These are set out in Clause 43(4) of the Data Protection Bill and are:
- to avoid obstructing an official or legal inquiry, investigation or procedure;
- avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- to protect public security;
- to protect national security
However, where a data controller has restricted the data subject’s right to subject access, the data contoller is required to provide certain information to the data subject in writing and without undue delay. That information is:
- that the rights of the data subject have been restricted;
- the reasons for the restriction;
- the data subject’s right to make a request to the Information Commissioner to check that the processing is compliant;
- the data subject’s right to make a complaint to the Information commissioner; and
- the data subject’s rights to make an application to the court (in Scotland, the Court of Session or the Sheriff Court).
One additional point of note about subject access requests is that the GDPR, in recital 63 and unlike the Data Protection Directive, upon which the Data Protection Act 1998 is based, states that the purpose of the right to subject access is to enable the data subject “to be aware of, and verify, the lawfulness of the processing.” This may mean that Subject Access Requests may be rejected where they are submitted for other reasons. Whether the courts will consider Recital 63 as exhaustive as to the purposes for which an individual may exercise their rights of subject access or not remains to be seen.
There is a lot to the right of subject access and there are some key changes which will come into effect on 25 May 2018. This is a cornerstone of data protection law and data controllers should be attaching substantial weight to compliance as a consequence.
If you would like any advice and assistance on subject access requests, either under the GDPR or the Data Protection Act 1998, or any other Information Law matter; then contact Alistair Sloan on 0345 450 0123. Alternatively, you can send him an E-mail.