Topic
Data Subject Access Requests
96 published works
Privacy & Information Security Law Blog
UK ICO Revises Subject Access Guidance Following Court Rulings
On June 20, 2017, the UK Information Commissioner’s Office published an updated version of its Code of Practice on Subject Access Requests. The updates are primarily in response to three…
UK Finance Disputes and Regulatory Investigations Blog
Subject access requests likely to increase in customer disputes?
Financial institutions often receive a subject access request made under the Data Protection Act 1998 (“SAR”) from individual customers as pre-cursor to a formal complaint or a legal claim. That…
Tech Law Blog
Data Subject Access Requests – Proportionality and Motive
The UK Court of Appeal has clarified the scope of the disproportionate effort exemption, and the relevance of motive, when responding to Data Subject Access Requests (DSARs). The decisions are…
Data Protection Report
UK Court of Appeal Rules that Exemptions to Access Rights are Construed Narrowly
By Marcus Evans
Under the UK Data Protection Act 1998 ("DPA"), data subjects have rights to obtain copies of their personal information through a data subject access request ("DSAR"). Data subjects frequently use…
Technology Law Dispatch
The Subject Access Request That Led to a Security Breach, or Why Having a System to Respond to Access Requests Is Essential
In August, the UK’s data protection regulator, the ICO, fined a Hertfordshire GP practice £40,000 under the Data Protection Act 1998 (“DPA”) after a subject access request (“SAR”) went badly…
Technology Law Dispatch
Data Subject Access Requests – Stick to What’s Reasonable, Proportionate, and Has the Proper Motive, Says UK Court
By Kate Brimsted, Cynthia O’Donoghue
In August, the High Court, in Dawson-Damer & Ors v Taylor Wessing [2015] EWHC 2366 (Ch), refused an application to compel a UK law firm (“TW”) to comply with a…
Restructuring Globalview
New High Court Treatment for Subject Access Requests
Dealing with subject access requests (“SAR”s) under the Data Protection Act 1998 is becoming a regular occurrence for many organisations, particularly banks and their advisors. Processing such requests can take…
Technology Law Dispatch
Enforced subject access requests now a criminal offence in the UK
By Cynthia O’Donoghue, Katalina Bateman
In September 2014 we reported on the UK’s intention to stamp out a practice commonly known as “enforced subject access requests”. This concerned the previously dormant section 56 of the…
Technology Law Dispatch
Ireland and the UK ban forced subject access requests
By Cynthia O’Donoghue, Kate Brimsted
The practice of employers forcing employees or applicants to exercise subject access rights has been described by the UK’s Information Commissioner’s Office (‘ICO’) as a “clear perversion of an individual’s…
Tech Law Blog
Annual Report of the Data Protection Commissioner 2013
By John Whelan
The Annual Report of the Irish Data Protection Commissioner has been published. It reveals a few interesting trends in both the approach of the Irish regulator and the level of…