• United States



UK Editor

UK ICO reprimands 7 organisations for failing to adhere to UK GDPR Subject Access Request laws

Sep 29, 20222 mins

The Ministry of Defence, Home Office and Virgin Media among the organisations which have failed to respond to Subject Access Request in time, if at all.

compliance compliant regulation rules stamp gdpr
Credit: Aquir Getty Images

The UK’s Information Commissioner’s Office (ICO) has announced that it has acted against seven UK organisations for failing to respond to the public when asked for personal information held about them. Organisations must respond to a Subject Access Request (SAR) under Article 15 of the UK GDPR within one to three months, but an ICO investigation found seven organisations across the public and private sectors repeatedly failed to meet this legal deadline. This has resulted in regulatory action including reprimands as well as practice recommendations issued under the Freedom of Information Act 2000 (FOIA).

MoD, Home Office, Virgin Media among reprimanded UK organisations

In a posting on its website, the ICO stated that the seven organisations were identified following a series of complaints in relation to multiple failures to respond to requests for copies of personal information collected and processed, either within statutory timeframes or at all, breaching the UK GDPR and Data Protection Act. The seven organisations the ICO has reprimanded are:

The ICO has ordered these organisations to make improvements in between three and six months or face further possible enforcement action.

ICO will “continue to support” organisations to meet data privacy obligations

Information Commissioner John Edwards said, “SARs and requests made under FOIA are fundamental rights and are an essential gateway to accessing other rights. Being able to ask an organisation “What information do you hold on me?” and “How it is being used?” provides transparency and accountability and allows the person to ask for changes to be made or even for the information to be deleted.”

Edwards said that the ICO will continue to support organisations to meet their obligations to individuals. “This includes developing a SAR generator to help people identify where their personal information is likely to be held and how to request it, at the same time as providing information to the organisation regarding what is required from them. We expect all information requests to be handled appropriately and in a timely way. This encourages public trust and confidence and ensures organisations stay on the right side of the law.”

UK Editor

Michael Hill is the UK editor of CSO Online. He has spent the past five-plus years covering various aspects of the cybersecurity industry, with particular interest in the ever-evolving role of the human-related elements of information security. A keen storyteller with a passion for the publishing process, he enjoys working creatively to produce media that has the biggest possible impact on the audience.

More from this author