ICO issues guidance on handling growing number of AI-generated subject access requests

The guidance says people are "increasingly" using AI to generate such requests under Article 15 of the UK GDPR, and covers whether AI-assisted SARs are valid, what to do if such requests contain inaccurate information, and how to respond if AI is used to deliberately create false or misleading information, among other things.

According to the document, both requesters and organisations can find AI-assisted SARs harder to understand, as they may be lengthy, repetitive, broad or unclear, making it difficult to identify exactly what information the requester wants.

They may also be overly wide in scope or focused on information of limited value, or be inaccurate or confusing, it says.

On this point, the guidance notes that some AI-assisted requests can include misleading information, irrelevant legal references, laws from other jurisdictions or combine several different rights requests or service complaints.

The guidance also touches on practical steps for handling AI-generated requests.

It says: "Most people make SARs because they genuinely want to obtain their personal information. They may use AI because they think the request needs to be formal or that you’ll take it more seriously if they include legal references. They may also not know how to make a SAR.

"SARs should be straightforward. Making the process simple and clear can reduce the likelihood of receiving overly complex or wordy SARs that are difficult for you and the requester to understand. While you can’t discourage people from using AI if they want to, you can offer to help them with their request."

The list of practical steps includes providing clear guidance on how to make a SAR and a point of contact for people who want advice or help; training staff so they understand the legal requirements and “aren’t intimidated by lengthy and complex requests”; and explaining that clear specific requests make it easier to identify and locate the requested information.

It also recommends that organisations publish optional example prompts or templates that people can adapt, while making it clear that they are not required to use them – and to remind people to review any AI-assisted SAR before sending it.

Organisations should also explain their obligations, including their response times, to help manage the requester's expectations, it says.

The guidance foreword says: "The right of access is a fundamental right that allows people to access and obtain a copy of their personal information. People are increasingly using artificial intelligence (AI) to help them make subject access requests (SARs).

"This guidance outlines how to handle SARs generated using AI (AI-assisted SARs). It shows how you can apply existing data protection rules to respond efficiently and effectively and sets out practical steps for you to consider.

"You may also find it helpful to refer to our detailed right of access guidance, which provides further explanation of each topic. Links to the relevant sections are included throughout this guidance."

Adam Carey