ICO issues enforcement notice against council over subject access request backlog

The Information Commissioner’s Office has issued an enforcement notice under the Data Protection Act 1998 requiring the London Borough of Lewisham to clear a backlog of subject access requests by 15 October.

The ICO said its move came after the council had failed to meet agreed deadlines.

The enforcement notice, which can be viewed here, states that on 29 March 2018 Lewisham had a backlog of 113 SARs. The oldest dated back to 2013.

The council’s recovery plan involved eliminating this backlog by 31 July 2018. However, it admitted to the ICO on 25 July that this deadline would not be met. There were 19 outstanding SARs that were received before 25 May 2018.

The Commissioner said she “remains concerned by the data controller’s failure to both adhere to deadlines set for clearing old cases, and for identifying subject access requests more generally”.

The notice requires Lewisham to: “By Monday 15 October at the latest, inform the 19 individuals who submitted subject access requests before 25 May 2018, whether the personal data processed by it includes personal data of which those individuals (or any of them) are the data subjects and shall supply each of them with a copy of any such personal data so processed in accordance with the requirements of section 7 of the DPA and the sixth data protection principle in that respect, subject only to the proper consideration and application of any exemption from, or modification to, section 7 of the DPA provided for in or by virtue of part IV of the DPA which may apply”.

An ICO spokesperson said: “A significant part of the ICO’s work is offering guidance and support to help ensure organisations are able to meet their statutory obligations. However, we will take formal enforcement action in cases where we believe it is necessary to ensure that the legal rights of individuals are upheld.”

A Lewisham Council spokesperson said: “We’ve increased the number of staff dealing with subject access requests so we can process them in a timely manner. Our efforts are focused on clearing the backlog by mid-October and meeting the deadline set by the Information Commissioner’s Office. We are sorry for the delay in giving 19 people access to their data.”