The Subject Access Request Dilemma
Liam works for a local council's housing department. On 1 March, he received a subject access request (SAR) from a tenant, Maria, who is in a dispute with the council over a housing repair. Maria asked for 'all information you hold about me and my family, including internal emails and notes from visits.' Liam has 30 days to respond. He estimates that retrieving the information will require searching multiple systems: the housing management system, email archives, and paper files. He also knows that some emails contain discussions about Maria's case among colleagues, including opinions about her credibility. Additionally, some information relates to Maria's children (who are minors) and to a neighbor who complained about noise. Liam is unsure what to disclose and how to handle the third-party data. He is also concerned about the workload and whether he can extend the deadline.
1. What information should Liam disclose in response to Maria's SAR, and what can be withheld or redacted?
Read the worked answer
Disclosable information:
Personal data about Maria: All information that relates to Maria and from which she can be identified. This includes her name, address, tenancy details, repair requests, correspondence, and any opinions or assessments about her. The fact that data includes opinions about her credibility does not exempt it; she is entitled to see it unless an exemption applies.
Internal emails and notes: Emails and visit notes that contain Maria's personal data are within scope. The council must search all relevant systems, including email archives and paper files.
Family information: Maria has requested information about her family. She is entitled to her own personal data, but not necessarily to personal data of her children or other family members unless they have consented or she has parental responsibility and it is in the child's best interest. However, data about her children may be considered her personal data if it forms part of her family life. The council should assess each piece of information. Generally, information about minors should be redacted unless the child has consented or the parent has authority. In many jurisdictions, a parent can access a child's data if the child is under 12 or lacks capacity, but for older children, consent may be needed. Liam should consider the child's age and best interests.
Third-party data (neighbor): The neighbor's personal data (e.g., name, address, complaint details) should be redacted unless the neighbor has consented to disclosure or it is reasonable to disclose without consent. The council must balance Maria's right of access against the neighbor's rights. Typically, redact the neighbor's identifying details.
Information that may be withheld or redacted:
- Third-party personal data: Redact names, contact details, and any identifying information of the neighbor and other third parties, unless they consent or it is reasonable to disclose. Consider whether the third party is a public official acting in an official capacity (e.g., council employee) – their names may be disclosed if acting in a professional role.
- Legal privilege: If any emails contain legal advice from lawyers, they may be exempt under legal professional privilege.
- Crime prevention/detection: If disclosure would prejudice a criminal investigation, an exemption may apply, but this is unlikely in a housing repair dispute.
- Management information: Internal discussions that are not about Maria but are purely operational may not be her personal data and can be excluded.
- Opinions: Opinions about Maria are her personal data and should be disclosed unless an exemption applies. Do not withhold simply because they are embarrassing or critical.
Procedure: Liam should conduct a thorough search, document what was searched, and apply redactions where necessary. He should provide a copy of the data in an accessible format, along with an explanation of any redactions (unless doing so would defeat the purpose of the exemption).
2. Can Liam extend the 30-day deadline? If so, under what circumstances and what must he do?
Read the worked answer
Extension of deadline:
Under GDPR (and many similar laws), the controller must respond to a SAR without undue delay and in any event within one month of receipt. The one-month period may be extended by up to two further months where necessary, taking into account the complexity and number of requests.
Circumstances for extension:
- The request is complex (e.g., involves a large volume of data, multiple systems, or requires significant redaction).
- The number of requests is high (e.g., multiple requests from the same person or a surge in requests).
What Liam must do:
- Assess complexity: Determine whether the request is genuinely complex. The fact that it involves multiple systems and third-party data may justify an extension, but Liam should not automatically extend; he must be able to justify it.
- Notify the data subject: Within one month of receipt, inform Maria that the extension is necessary, together with the reasons for the delay. He should do this as soon as he realizes an extension is needed, not wait until the last day.
- Document the decision: Record the reasons for the extension and the steps taken.
- Ensure compliance: The extension is not indefinite; the maximum total is three months from receipt. Liam should aim to respond as soon as possible.
Important: The extension must not be used as a routine measure. If the request is not complex, Liam must respond within one month. He should also consider whether he can clarify the request with Maria to narrow the scope (e.g., ask her to specify dates or types of information), which might reduce the workload and avoid the need for an extension. However, he cannot unreasonably refuse to comply. If he cannot extend, he must still provide the data within one month, even if some parts are redacted or pending. He could provide the data in phases if appropriate, but the initial response must be within the deadline.