UK ICO reprimands 7 organisations for failing to adhere to UK GDPR Subject Access Request laws

The UK’s Information Commissioner’s Office (ICO) has announced that it has acted against seven UK organisations for failing to respond to the public when asked for personal information held about them. Organisations must respond to a Subject Access Request (SAR) under Article 15 of the UK GDPR within one to three months, but an ICO investigation found seven organisations across the public and private sectors repeatedly failed to meet this legal deadline. This has resulted in regulatory action including reprimands as well as practice recommendations issued under the Freedom of Information Act 2000 (FOIA).

MoD, Home Office, Virgin Media among reprimanded UK organisations

In a posting on its website, the ICO stated that the seven organisations were identified following a series of complaints in relation to multiple failures to respond to requests for copies of personal information collected and processed, either within statutory timeframes or at all, breaching the UK GDPR and Data Protection Act. The seven organisations the ICO has reprimanded are:

• The Ministry of Defence (MoD)
• The Home Office
• The London Borough of Croydon
• Kent Police
• The London Borough of Hackney
• The London Borough of Lambeth
• Virgin Media

The ICO has ordered these organisations to make improvements in between three and six months or face further possible enforcement action.

ICO will “continue to support” organisations to meet data privacy obligations

Information Commissioner John Edwards said, “SARs and requests made under FOIA are fundamental rights and are an essential gateway to accessing other rights. Being able to ask an organisation “What information do you hold on me?” and “How it is being used?” provides transparency and accountability and allows the person to ask for changes to be made or even for the information to be deleted.”

Edwards said that the ICO will continue to support organisations to meet their obligations to individuals. “This includes developing a SAR generator to help people identify where their personal information is likely to be held and how to request it, at the same time as providing information to the organisation regarding what is required from them. We expect all information requests to be handled appropriately and in a timely way. This encourages public trust and confidence and ensures organisations stay on the right side of the law.”