Data Protection Commission to take impact of COVID-19 into consideration when dealing with Subject Access Requests
The Data Protection Commission (DPC) has acknowledged the significant impact of the Covid-19 health crisis on an organisation’s ability to action General Data Protection Regulation (GDPR) requests from individuals such as a subject access request (SAR). While the timelines for responding to a SAR from individuals are set down in law in the GDPR and cannot be changed, the DPC has recognised that unavoidable delays may arise as a direct result of the impacts of COVID-19.
Members of the public have been asked to bear in mind that frontline and critical services organisations may need to divert resources to priority work areas with consequential impacts on other areas such as the handling of a SAR.
Any organisation experiencing difficulties in responding to requests should, where possible, communicate with the individual concerned about the handling of their request, including any extension to the period for responding and the reasons for the delay in responding. The GDPR provides for an extension of two months to respond to a request where necessary, considering the complexity and number of requests received by an organisation.
Organisations experiencing difficulties in actioning a SAR should also consider whether it is possible to respond to requests in stages. With employees working remotely it may prove difficult for organisations to access hard copy records. In such cases, the requester can be provided with an electronic copy of the record sought, with hard copies to be provided at a later stage.
Organisations are advised to communicate clearly with the requester and ensure that the SAR is as specific as possible in relation to the personal data sought.
Where an organisation, due to the impact of COVID-19, cannot respond to a SAR in full or in part within the statutory timelines, they remain under an obligation to do so and should ensure that the request is actioned as soon as possible. The reasons for not complying with the timelines should be documented by the organisation and clearly communicated to the requester.
The statutory obligations cannot be waived. However, should a complaint be made to the DPC, the facts of each case, including any specific extenuating circumstances will be fully taken into account.
In summary, the one-month timeline for responding to a SAR (from the date of receipt) remains in place. Where it is necessary and proportionate, the deadline for responding to a SAR could be extended by a further two months due to the complexity and number of requests provided that the organisation informs the data subject about the extension, and documents the reasons for relying on the extension.
For more information, please contact us at postmaster@vblaw.ie, or your usual contact at Vincent & Beatty LLP.