Subject Access Requests, by which an individual data subject has
a legal right under the DPA to apply to an organisation and find
out what personal data it holds on them, were the subject of 6,000
complaints to the ICO last year. Perhaps as a consequence, the ICO
has produced a draft subject access code of practice aimed at
organisations in order to prevent misunderstandings and to outline
clearly the scope of individuals' rights and organisations'
responsibilities to provide information relating to an
applicant's personal data.
The ICO is looking to achieve a balance between the protection of
privacy for individuals which is provided by the subject access
right, and the proportionality of the obligations placed on
organisations which process personal data and who usually need to
provide a substantive response to a request within 40 days.
The consultation document is available to view here and the draft subject access code of
practice is here.
Charities who process personal data, as well as individuals and
other stakeholders, are invited to respond by 21 February 2013. The
ICO hopes to publish the final code of practice by April 2013.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
