ICO Issues Enforcement Notice to Wirral Company

The UK’s regulator of data protection, the Information Commissioner’s Office (ICO) has served an enforcement notice on the Wirral based finance Company Hudson Bay Finance Limited of Stadium Court (Hudson) for failing to respond to a subject access request (SAR) on time.

Facts

The complainant made the SAR in writing to Hudson by recorded delivery on 18 May 2018. By 21 September 2018, Hudson (known in this context as the data controller) had not responded and the complainant contacted the ICO.

The ICO wrote to Hudson in December 2018 and the letter was returned. The letter was again sent to Hudson in January 2019.

When the complainant still hadn’t received a response, the ICO telephoned Hudson on three occasions during March 2019. The ICO again wrote to Hudson in March 2019 and four telephone calls were made in June 2019.

The ICO issued a preliminary enforcement notice on 26 June 2019 and by 26 July 2019 Hudson had not responded.

Discussion

Usually we think of the General Data Protection Regulation or GDPR as it is known when talking about data protection law. The GDPR came into force on 25th May 2018 so this subject access request pre-dated the GDPR by a week and therefore the old Data Protection Act 1998 (DPA98) is applicable in this scenario. If you’d like to read more about the position under the GDPR take a look at our subject access FAQ page here.

To be clear under the DPA98 the data controller, in this case Hudson, should have responded “without undue delay„ or at least within 40 days of the SAR. Under the GDPR the position would have been slightly different in that the complainant would expect to receive a response “without undue delay„ or within 30 days of the SAR subject to some exceptions.

In this case the complainant hadn’t received a response in more than a year and therefore on any assessment, there was a delay in responding to the SAR.

Within the enforcement notice the ICO said:

“The Commissioner takes the view that damage or distress is likely as a result of the complainant being denied the opportunity of properly understanding what personal data is being processed about her by the data controller.„

The ICO has instructed Hudson to inform the complainant if the data that is being processed is personal data and to provide copies of the data.

Hudson were given 28 days to appeal the decision.

Delayed SAR response?

Under either the DPA98 for older SAR’s and the GDPR for SAR’s made after 25th May 2018 an individual may be entitled to compensation for the distress caused by a delayed response to a SAR. If you have experienced a delayed response, an inadequate response or no response at all to a SAR you may be able to claim compensation from the data controller you can contact the Data Law team at JMW Solicitors on 0345 872 6666 to discuss your case.