ICO warns councils to be vigilant when handling subject access requests

The ICO has called on local authorities to remain vigilant against possible breaches of the Data Protection Act when handling subject access requests.

The call was made after Portsmouth City Council admitted to the inappropriate disclosure of personal information relating to an individual’s physical and mental health.

The council had informed the ICO of the breach, which involved the mistaken provision of sensitive information in response to a subject access request. Portsmouth had failed to redact the documents correctly, leading to the accidental disclosure of the information relating to another individual.

An ICO investigation found that:

• the individual responsible for redacting the documents was neither employed by the council, nor acting under the terms of a formal contract for services, and
• the supervision and training provided to staff involved in the subject access request process was inadequate.

Mick Gorrill, the watchdog’s head of enforcement at the ICO, described the breach as “entirely avoidable”.

“It would not have happened if the individuals dealing with the request had been given proper training and the necessary levels of support,” he added. “The fact that the information released included sensitive information relating to an individual, who wasn’t directly involved in the original request, could have caused a great deal of embarrassment and distress.”

Portsmouth’s chief executive, David Williams has signed a formal undertaking ensuring that all relevant staff are fully trained in how to handle subject access requests and that checks are put in place to ensure that third-party data is dealt with in accordance with the Act’s requirements.

The council has also agreed that "in future any individuals tasked with redacting material from subject access requests will either be employed by the council directly, or otherwise enter into a formal contract to provide the service".