The Information Commissioner’s Office (ICO) has taken action against six public sector organisations that have failed to respond to subject access requests (SARs) within the statutory timeframe.
It has named the Ministry of Defence, the Home Office, Kent Police and the London Boroughs of Croydon, Hackney and Lambeth – along with Virgin Media – as having broken the rules in not responding to a requests from a member of the public for personal information on them within one to three months.
An ICO investigation found that the organisations repeatedly failed to meet the legal deadline, prompting reprimands and practice recommendations under the Freedom of Information Act (FoIA).
Information Commissioner John Edwards said: “SARs and requests made under FoIA are fundamental rights and are an essential gateway to accessing other rights. Being able to ask an organisation ‘What information do you hold on me?’ and ‘How it is being used?’ provides transparency and accountability and allows the person to ask for changes to be made or even for the information to be deleted.”
The organisations were identified following a series of complaints in relation to multiple failures to respond to requests for copies of personal information collected and processed by these organisations, either within statutory timeframes or at all.
Source of complaints
The complaints resulted from original requests for information on issues such as adoption and care records and asylum applications.
In response, the organisations have been given between three and six months to make improvements or face further enforcement action.
Details of the failings were that:
- the Ministry of Defence has allowed a backlog of around 9,000 SARs to build up, with people typically waiting over 12 months for their information;
- the Home Office developed a backlog of just under 21,000 SARs between March and November 2021, although this had been reduced to just over 3,000 by July 2022;
- Kent Police failed to deal with a third of its requests from October 2020 to February 2021, and was reported to take over 18 months to respond to some;
- Croydon responded to less than half of the requests it received between April 2020 and April 2021, leading the ICO to issue 27 decision notices against it under the FoIA;
- Hackney did not respond to over 60% submitted between April 2020 to February 2021, with one SAR being unanswered for 23 months;
- and Lambeth responded to just over half its requests within one month between August 2020 and August 2021.
Support and education
Edwards added: "We will continue to support organisations to meet their obligations to individuals. In addition to providing education to people about their rights. This includes developing a SAR generator to help people identify where their personal information is likely to be held and how to request it, at the same time as providing information to the organisation regarding what is required from them.
“We expect all information requests to be handled appropriately and in a timely way. This encourages public trust and confidence and ensures organisations stay on the right side of the law.”
