Action taken against Kent Police and Home Office for failing to respond to information access requests

The organisations “repeatedly failed” to meet the legal deadline to respond to the public when asked for personal information held about them, known as a Subject Access Request (SAR), said the ICO.

A SAR must be responded to within one to three months. But an ICO investigation found seven organisations, across the public and private sector, repeatedly failed to meet this legal deadline.

This resulted in regulatory action including reprimands as well as practice recommendations issued under the Freedom of Information Act 2000 (FOIA).

Information Commissioner John Edwards said: “SARs and requests made under FOIA are fundamental rights and are an essential gateway to accessing other rights.

“Being able to ask an organisation ‘what information do you hold on me?’ and ‘how it is being used?’ provides transparency and accountability and allows the person to ask for changes to be made or even for the information to be deleted.”

The seven organisations were identified following a series of complaints in relation to multiple failures to respond to requests for copies of personal information collected and processed by these organisations, either within statutory timeframes or at all. Information was also being withheld, breaching the UKGDPR and Data Protection Act, said the ICO.

From October 2020 to February 2021, Kent Police received more than 200 SARs, of which 60 per cent were completed during the statutory deadline.

“However, some of the remaining SARs are reported to have taken more than 18 months to issue a response,” said the ICO.

“As of May 2022, over 200 SARs remain overdue. A reprimand has been issued.

A reprimand has also been issued to the Home Office following investigations that showed between March 2021 and November 2021, it had a significant backlog of SARs, amounting to just under 21,000 not being responded to during the statutory timeframe.

Complaints to the ICO showed requesters suffered “significant distress” as a result. As of July 2022, there were just over 3,000 unanswered SARs outside of the legal time limit, said the ICO.

The other organisations issued with a reprimand were the Ministry of Defence, London Borough of Croydon, London Borough of Hackney, London Borough of Lambeth and Virgin Media.

Mr Edwards said: “We will continue to support organisations to meet their obligations to individuals. In addition to providing education to people about their rights. This includes developing a SAR generator to help people identify where their personal information is likely to be held and how to request it, at the same time as providing information to the organisation regarding what is required from them.

“We expect all information requests to be handled appropriately and in a timely way.

“This encourages public trust and confidence and ensures organisations stay on the right side of the law.”