Information Security and Data Protection Newsletter - September 2015
Published 14 September 2015
Employers are often vexed at the prospect of undertaking the time-consuming and costly exercise of searching for documents containing an individual's personal data in response to a subject access request, particularly where the request is being made in the context of some broader dispute between the parties. Guidance from the ICO is clear that the right of subject access is a distinct and separate right, and just because a data subject is in the process of legal proceedings with the data controller, this does not give a data controller the right to refuse to respond to a subject access request. The exemptions should be applied on a case by case, document by document basis.