ICO raps two police forces over SAR backlogs
The Information Commissioner’s Office (ICO) has issued reprimands to Dorset Police and Devon and Cornwall Police over their failure to respond to a “large number” of subject access requests (SARs) within the legislative timeframe.
The ICO criticised both forces for having had a subject access request backlog since 2018.
Dorset Police formed an alliance with Devon and Cornwall Police in April 2017, known as the Devon and Cornwall Police & Dorset Police Alliance.
From the information provided by the Alliance during the course of the investigation, it was found that Dorset Police have “continuously infringed” Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the DPA 2018 for over four years, said the ICO.
As of November 2023, Dorset Police had 140 subject access requests awaiting a response. Of these 140 subject access requests, 85% (120) of the subject access requests were older than one calendar month, and 9% (13) were older than four months.
“This evidences Dorset Police’s failure to respond to subject access requests in accordance with Article 12(3) of the UK GDPR and Part 3, Chapter 3, Section 54 of the DPA 2018”, said the ICO.
The commissioner recommended the following further steps for Dorset Police to ensure its compliance with the UK GDPR and the DPA 2018:
- Dorset Police should continue to ensure that it has adequate staff resources in place to process and respond to subject access requests;
- Dorset Police should ensure they continue to take the steps outlined in their action plan to ensure that subject access requests are responded to within statutory deadlines.
In its reprimand to Devon and Cornwall Police, the watchdog noted that as of November 2023, Devon and Cornwall Police had 347 subject access requests awaiting a response. Of these 347 subject access requests, 83% (287) of the subject access requests were older than one month, and 22% (78) were older than four months.
The Commissioner also recommended adequate staff resources and to ensure that subject access requests are responded to within the legislative timeframe of one or three (where extension is appropriately applied) calendar months.
Mike Stamp, Director of Legal Services for Devon and Cornwall Police and Dorset Police said: “Since 2017 Devon & Cornwall Police and Dorset Police have been working together under an Alliance data protection function and the number of SARs has increased each year after new data protection legislation came into effect in 2018.
“Executives for both forces continue to receive regular reports on SAR compliance and we acknowledge that we must undertake further work to make the improvements that are needed. This work remains a priority and we are committed to achieving full compliance with the legislation.”
Lottie Winson
