Data watchdog says it is naming and shaming seven organisations for failing to share information.
Image source, Getty ImagesThe Ministry of Defence and the Home Office are among seven organisations that have failed to respond to personal information requests.
The Information Commissioner’s Office (ICO) says it is “calling them out” for ignoring the public when asked questions about the data they hold.
A Subject Access Request (SAR) must be responded to within three months.
The government departments repeatedly missed that deadline.
The ICO is an independent watchdog – its aim is to promote openness by public bodies and data privacy for individuals.
Other organisations that did not respond to requests were Kent Police, Virgin Media and the London boroughs of Croydon, Hackney and Lambeth.
This resulted in regulatory action including reprimands as well as practice recommendations issued under the Freedom of Information Act 2000.
Information Commissioner John Edwards told the BBC naming and shaming organisations that fail to comply is a new proactive way for the ICO to work.
“It’s going to become more common – it’s really important that people can have confidence in the administration of their information rights,” he said.
“That’s why we are publicly notifying these organisations that they have to bring themselves into compliance.
“Being able to ask an organisation ‘what information do you hold on me’ and ‘how it is being used’ provides transparency and accountability.
“These are fundamental rights – these are not optional.”
The seven organisations were identified following a series of complaints related to their failure to respond within set timeframes, or failing to respond at all, as well as information being withheld, in breach of the UKGDPR and Data Protection Act.
‘Emotional abuse’
Some of the complaints included requesting access to adoption papers where the person was told “no one seems to know where these are”.
The person, who was anonymous, said: “I am upset and angry and just want my files.”
Another related to an asylum application involving a child.
The complainant said: “All we need is the asylum transcript so we can submit a humanitarian application. However, we can do nothing without those transcripts.
“I have chased this matter for seven months and have received nothing. My client’s child is constantly at risk so long as he stays in the home country.”
And one example given was about access to files for someone who spent many years in care.
“The original paper file was destroyed previously so I cannot access any of my personal data relating to my childhood,” the complainant said.
“The file contained sensitive details of trauma I suffered, and I feel now this emotional abuse cannot be answered for.”
The ICO said it took regulatory action over infringements across 2020 and 2021 including:
- Ministry of Defence – 9,000 requests yet to be responded to. People were typically waiting over 12 months for their information.
- Home Office – just under 21,000 requests not being responded to. Complaints to the ICO showed complainants suffered significant distress as a result.
- Kent Police – some requests are reported to have taken over 18 months to issue a response.
- Virgin Media – over a six-month period in 2021, 9,500 requests were made and 19% were not responded to.
The organisations have between three and six months to make improvements or further enforcement action could be taken.
The BBC has contacted the seven organisations for comment.
A Croydon Council spokesperson said: “We apologise for any delays in our handling of Freedom of Information or Subject Access Requests and fully take on board the comments and feedback from the ICO.
“The council remains committed to high quality information governance and is currently rolling out an improvement plan to strengthen how we respond to requests under data protection law.”
Follow Shiona McCallum on Twitter @shionamc