Responding to a Subject Access Request? Don't Forget the Supplementary Information…
A subject access request (SAR) has reached the highest court in the EU and, whilst the case is not binding in the UK, it's a good reminder that requesters are entitled to more than just their personal data.
What Information Are Requesters Entitled to?
Under the UK GDPR, when an individual makes a SAR they are entitled to a copy of their personal data (subject to your organisation relying on an exemption). Broadly speaking, personal data is information relating to an identified or identifiable living individual. The requester is also entitled to certain supplementary information in addition to a copy of their personal data. In our experience, the supplementary information can often be overlooked by organisations when preparing their response.
The supplementary information is listed in Article 15 of the UK GDPR. It includes (but is not limited to) any available information as to the source of the personal data (if not collected from the requester), the right to lodge a complaint with the Information Commissioner's Office, and the recipients or categories of recipient to whom the personal data have been or will be disclosed.
The new CJEU case (RW v Österreichische Post) was about the extent to which requesters are entitled to information about recipients of their personal data.
What Did the Court Decide?
The requester complained that he had not been provided with information about the specific recipients of his personal data. Instead Österreichische Post had provided more general information about the categories of recipients. The CJEU had to decide if organisations have a choice over whether to provide information about specific recipients ie can they chose to simply provide information about the categories of recipients?
The CJEU ruled in the requester's favour. It held that requesters have the ability to obtain information about the specific recipients to whom their personal data have been or will be disclosed.
Why Does This Matter Post-Brexit?
Although this decision does not bind the UK courts, the courts may have still have regard to it.
Do We Always Have to Provide Information about Recipients (and the Other Supplementary Information)?
No - but to withhold it you must identify an exemption, just as you would if you were withholding the requester's personal data.
SARs made in the context of employment matters often involve making difficult judgment calls. If you would like any assistance when dealing with a SAR please do contact Claire Hall in our Data Protection team on 07467 148 750, or complete the form below.