2

When making a Subject Access Request to GCHQ I was told that I would have to pay a fee for this Request. The GDPR does not allow for such a fee, while the UK Data Protection Act does(Part 4 – Chapter 3 - Section 94). My Subject Access Request concerns the website of the GCHQ, and not the GCHQ's surveillance activities. Does the GDPR supersede the UK Data Protection Act in this case?

Improve this question
1

1 Answer 1

Reset to default
2

The GDPR does not allow for such a fee

Article 12(5) GDPR contains:

Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge.

But Article 23 GDPR contains:

  1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

    (a) national security;

So basically, the GDPR would allow a fee if there is specific legislation (the DPA2018) and it is considered necessary and proportionate for national security.

My Subject Access Request concerns the website of the GCHQ, and not the GCHQ's surveillance activities.

I would agree it is hard to believe that asking a fee to get information concerning the GCHQ website, would increase national security. But I am afraid you would have to go to court to change that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .