The Information Commissioners Officer has published detailed guidance on the ‘Right of Access’. This provides clarification for employers on how to deal with Subject Access Requests (‘SAR’).
The guidance addresses three main areas:
- It confirms that there is a balancing act when determining whether a SAR is ‘manifestly excessive’ and the employer must determine whether the SAR is ‘clearly or obviously unreasonable’. This involves assessing whether the response is ‘proportionate when balanced with the burden or costs involved’. Employers should consider all the circumstances.
- It confirms the ‘reasonable fee’ for complying with a manifestly excessive or unfounded SAR and that it can include: the cost of staff time; photocopying; printing; postage; envelopes; and, USB sticks etc. Employers can also take into account the administrative cost related to assessing the information, locating it, copying it and communicating with the employee.
- It confirms that employers can potentially ‘stop the clock’ on the 30-day time limit for complying with a SAR if it’s genuinely required and if the organisation processes a large volume of information about that employee.
The full guidance can be found at: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/right-of-access/
