When Can A Subject Access Request Be Regarded As Unfounded Or Excessive?

Under the Data Protection Act 2018 (DPA 2018), individuals have rights of access (commonly referred to as a Subject Access Request (SAR)). However, an organisation can refuse to respond to a SAR if it is manifestly unfounded or excessive. You must, however, be able to demonstrate why it is unfounded or excessive.

What does unfounded mean?

A request may be manifestly unfounded if the requester is simply using the request to harass an organisation and has no real purpose other than to cause disruption.

It must be obvious or clear that the SAR is unfounded. You should question whether the requester genuinely wants to exercise their rights. If so, you are going to find it difficult to prove that the request is manifestly unfounded.

What does excessive mean?

A request may be excessive if it repeats the substance of a previous SAR and a reasonable interval has not elapsed between the requests or there are overlaps with the requests.

In most cases, a request cannot be considered excessive simply because a requester has asked for a large amount of information.

A SAR is also not necessarily excessive just because a requester repeats the substance of a previous request. A requester may have legitimate reasons for making requests that repeat the contents of a previous request. For example, if an organisation has not handled the previous requests properly.

A repeat request may not be considered excessive if a reasonable amount of time has passed since the last request. The Information Commissioner’s Office (ICO) has set out what to consider when deciding whether a reasonable amount of time has passed:

1. Nature of the data – is it particularly sensitive?
2. Purpose of processing – would the processing cause harm to the requester if disclosed?
3. How often the data is altered – if information is unlikely to have changed between requests an organisation may decide that there is no need to respond to the same request twice.

What should you do if you think that a SAR is unfounded or excessive?

You have two options. You can either refuse to comply with a request or alternatively you may choose to still respond to the request but may charge a reasonable fee for the response.

If you do refuse to comply with a request you must let the requester know:

• The reasons why you have not complied with their request;
• Their right to make a complaint to the ICO; and
• Their ability to seek to enforce their right through a judicial remedy.

Can you charge a fee?

Part 3 of the DPA 2018 makes it clear that you can no longer request a fee for processing a SAR. However, the ICO have now confirmed that you can charge a reasonable fee if you consider that a SAR is manifestly unfounded or excessive but you still choose to respond.

It is important to note that you must be able to justify the fee in case the requester decides to raise a complaint with the ICO.