Principle 8 Data must be disclosed to the data subject on request, and corrected or destroyed where they so request
Individuals, including employees, are entitled to make an access request to a company in respect of personal data held by the company on them. There are detailed requirements set out in sections 3 to 5 of the Acts for handling access requests from individuals. Strict time limits apply so it is important that you have appropriate procedures in place to deal with access requests promptly. Staff should be trained in these procedures.
If you restrict the individual’s right of access, you must be entitled to do so under the Acts. In such an instance you must notify the individual within the relevant time limit, including reasons for the refusal and advising them of their right to complain to the Data Protection Commissioner. Limited restrictions include disclosure of medical data under certain circumstances, and the disclosure of opinions given with the intention that they be kept confidential.
Complaints about failures to comply with access requests have dominated complaints made to the Data Protection Commissioner in recent years. The Commissioner has enforced the rights of individuals to access requests in respect of their personal data on a number of occasions. Examples can be found in the form of case studies in the Commissioner’s annual reports or at www.dataprotection.ie and include the names of the companies responsible for the breaches.
Example Case Study - Case Study 7/2010
Complaints concerning access requests constituted 48% (or 562) of complaints received by the Data Protection Commissioner in 2011. 39% of complaints in 2010 concerned access requests. These statistics are high by historical standards reflecting a growth in awareness of consumers of the right to make access requests. The Data Protection Commissioner has shown on a number of occasions that he will not tolerate failures to comply with access requests and has used his statutory powers to secure compliance by firms. This has included the appointment of authorised officers to conduct unannounced inspections of business premises’ on behalf of the Commissioner for the purpose of obtaining information as to whether an access request has been fully complied with or not.
This case study concerned a company’s failure to fully comply with an access request made by one of its employees. The company also failed to respond appropriately to the Data Protection Commissioner when his Office investigated the complaint in respect of the failure to comply with the access request. The Commissioner concluded that the company was not respecting the data protection rights of the complainant and he appointed authorised officers under section 24 of the Acts to enter and inspect the company’s premises. Documents that were not provided to the complainant under the access request were found, examined and confirmed to contain personal data relating to the complainant. The company remained uncooperative when asked to furnish the remaining documents to the complainant causing the Commissioner to issue an Enforcement Notice on the company to supply all outstanding personal data to the complainant. The Commissioner confirmed that his Office would not hesitate to use its statutory powers to enforce an individual’s data protection rights.
Further information and example case studies can be found at www.dataprotection.ie
Please wait...