ICO criticises public bodies over mishandled subject access requests

The Information Commissioner has sharply criticised public bodies and companies for the high number of mishandled subject access requests.

Complaints about such requests accounted for more than a third (38%) of the Information Commissioner’s Office’s data protection specific casework in the last financial year.

Speaking last week, Christopher Graham, said: “Organisations that handle personal information need to remember that customer records are not simply their property - the individuals who do business with them also have rights. We are seeing far too many complaints that could easily have been avoided if they’d been given serious and timely consideration.

“The result of mishandling requests is not simply a blip on customer service satisfaction levels, it can cause individuals a great deal of upset. The people who are making these requests are not doing it for fun; the vast majority are seeking resolutions to real problems – such as being refused credit or making important decisions about their health.”

The ICO has launched an awareness-raising campaign – called Access Aware – on the issue.

It said health bodies and banking and finance companies had been identified as the worst performing sectors in relation to handling subject access requests. “A more general problem around access to employee records has also been noted across all sectors,” the watchdog said.

The ICO said health bodies and policing and crime organisations continued to generate a high level of subject access related complaints.

According to the ICO, almost half (45%) of data protection specific complaints about health bodies in 2010/11 concerned mishandled requests. “In the same year, 34% of data protection specific complaints in the policing and criminal justice sector were about subject access,” it added.