Marie Murphy
One of the powers bestowed on data subjects by data protection regulation is the power to request information about the personal data that is held by a company or authority. It is the power to make subject access requests. This is one of the most powerful tools given to individuals who share their personal data with banks, insurers, medical practitioners, schools, public authorities, shops and a huge variety of other companies. It is the power of regulation gifted to the individual. It is a hugely potent tool. Any company or public authority who collects personal data have an obligation to give data subjects full access to that data, for no reason other than the individual making the request. For business, this is one area where taking a proactive approach to data protection will payback. Designing the ability to handle access requests, restrictions, rectification and erasure of personal data is essential for all data-intensive businesses. And highly recommended for all business. This is one of the key costs of collecting personal data. It is only by preparing for these potential costs upfront that a data controller can hope to keep this cost under control. If you are going to collect personal data be aware of the rights of data subjects and ensure your systems can handle requests from data subjects to exercise their rights. Make that assessment upfront. Before you collect one item of data ask yourself will you be able to provide that data back to a data subject without incurring undue cost or disruption to your business.
GDPR is making some changes that impact subject access requests. The changes appear to be driven by two factors – one the desire to harmonise practices across the EU and two to improve the level of transparency for data subjects. The changes are administrative mainly and for most companies will simply require a review and revision of existing processes to ensure they can comply with the new time-frames and implement some relatively simple changes to how responses are structured. Some companies may find the reduction of the time allowed for responding to subject access requests from 40 days to one month to be challenging though I doubt that there is any company who will feel the financial loss of the €6.35 fee levied in Ireland. There are some stronger provisions for controllers who have to deal with “nuisance” access requests, which can be quite disruptive to a business when they occur but the burden of proof is on the controller to demonstrate that a request is excessive or unfounded.
I’ve included a handy reference to subject access requests under GDPR that will be useful to any business. There is one small disclaimer. Feel free to use this as a reference but if you are dealing with complex requests and you need to exempt data or refer to the special provisions do consult a qualified data protection practitioner for advice.
GDPR Subject Access Requests Quick Reference
GDPR Subject Access Requests – Content of Response
Sign-up to receive news and information from Fort Privacy
Fort Privacy processes your personal data in order to respond to your query and provide you with information about our products and services. Please see our Data Protection Statement for further information
As a technologist, I am both excited and appalled at the developments in AI and it seems from various surveys that I am not alone. My greatest wish is that we can harness its power for good while dampening its power for misuse. It is early days yet – let’s hope this wish comes true!
Everyone loves a quiz so we decided we would kick-off the new year with a bit of tongue-in-cheek fun.
Continuing the tradition of the Fort Privacy Christmas blog this year we are thinking about Santa and AI. Well, we need to keep these articles topical after all!
