NEWS25 June 2019

Met Police told to respond to subject access requests

News Privacy Public Sector UK

UK – The Metropolitan Police Service has been issued with two data protection enforcement notices for failing to deal with subject access requests (SARs) quickly enough.  

Met police officers_crop

The Information Commissioner’s Office (ICO), issuing the notices, said the Met Police has a backlog of around 1,100 open requests, with over 600 that are over three months old.

Under the Data Protection Act 2018, people have a right to find out what information an organisation holds on them and ask for a copy within one calendar month.

The enforcement notices, served under the 1998 and 2018 Data Protection Acts, mean that the Met must respond to all SARs by September.

The force has also been asked to change its internal processes to ensure people are kept up to date on any delays, the ICO said.

Police forces can limit the amount of information provided if it would prejudice an investigation or legal inquiry, however they must consider every request.

The Met said it receives 500 requests on average every month. 

Suzanne Gordon, director of data protection complaints and compliance at the ICO, said: "As people become more aware of their information rights, we recognise there has been a significant rise in SARs across all sectors, including to police forces and other law enforcement agencies. And we are also aware of the administrative impact of the increased workload on police forces in responding to these requests. But this should not come at a cost to people’s data rights."

The Met has informed the ICO of its plans to address the backlog and will provide fortnightly updates, it said in a statement. It is also planning to invest in a new data office in the longer term to help it deliver further improvements. 

Darren Curtis, head of information law and security at the Met, said: "We are taking the enforcement notices very seriously and regret failing to meet our obligations as we know it is frustrating for those requesting information from us which they have a right to access.

"Demand on the Met has increased considerably over the years, particularly since the General Data Protection Regulation came into force in May 2018, and this has impacted how quickly we deal with requests. We have already taken action to improve processes, including bringing in more staff to assist. This has helped us make good progress in reducing the oldest cases and managing more demand."