Can An Association Be A Data Subject?

In this case, the Applicant lost access to the email address associated with their social media account. They notified the platform provider of this and asked them to change the email address on the account. The request was denied.

As a result, the Applicant sent a Data Subject Access Request to the provider on 17 January 2024. The provider responded to the request on 18 January 2024 and confirmed that they could only discuss matters with the email address associated with the account. The Applicant therefore submitted a second request on 22 January 2024 through the Information Commissioner’s website.

On 27 January 2024, the Applicant lodged a complaint with the Information Commissioner. The Information Commissioner responded to the complaint and confirmed that it would not be something they could assist with, as it centred around the confusion over an email address and was therefore a service matter that needed to be resolved between the Applicant and the platform directly. The Commissioner therefore took no further action, and the case was closed.

Unhappy with the Commissioner’s response, the Applicant applied to the First Tier Tribunal. The parties did not agree upon which basis the application was brought. The Applicant argued that the application was brought under Section 163 of the Data Protection 2018 (DPA), whereas the Commissioner argued that it was an application brought under Section 166 of the DPA.

Section 163 of the DPA confirms that a person can appeal to the Tribunal if they have been given a notice, such as an enforcement notice, a penalty notice, etc. In this case, the Commissioner did not issue the Applicant a notice.

Section 166 of the DPA 2018 applies in circumstances where a data subject makes a complaint and the Commissioner fails to:

(1) take appropriate steps to respond to the complaint;

(2) fails to provide the complainant with information about progress on the complaint or the outcome of the complaint within 3 months; or

(3) if the consideration of the complaint is not concluded within 3 months, fails to provide the complainant with the necessary information during a subsequent period of 3 months.

The Tribunal decision

The Tribunal agreed with the Commissioner that Section 166 of the DPA 2018 applied in this case rather than Section 163. Section 166 of the DPA gives the Tribunal the power to require the Commissioner to respond to a complaint.

The issues for the Tribunal to determine were:

The Tribunal referred to the definition of a data subject as set out in Section 3(5) of the DPA, which confirms that it is an:

The Applicant argued that the Tribunal should interpret the definition of data subject to include any entity, regardless of legal form. The Tribunal disagreed and confirmed that the definition within the DPA is clear and that, if the intention was to include any entity, this would have been reflected in the wording.

As the Tribunal concluded that the Applicant was not a data subject, Section 166 of the DPA did not apply. The application was dismissed on this basis. The Tribunal confirmed that even if Section 166 did apply, the Commissioner had responded to the complaint and therefore the application would have failed.

Comment

The above is a useful reminder that a data subject is a living individual. Associations, companies, and other legal entities are not data subjects. The right of access under the UK GDPR/DPA only applies to data subjects and therefore, can only be exercised by living individuals.