Repeat Subject Access Requests are limited in frequency by the Manifestly unfounded and excessive requests rules. The critical bit seems to be "A request may be excessive if it: repeats the substance of previous requests and a reasonable interval has not elapsed". This is clarified "how often the data is altered – if information is unlikely to have changed between requests, you may decide you do not need to respond to the same request twice." The actual legislation says even less, but does say that it up to the controller to show that it is excessive.
I was in the process of setting up a cron job to make an SAR to the DVLA requesting a list of organisations that have received my data. This is to know about claims such as parking fines being made under the Protection of Freedoms Act 2012 when something goes wrong with the letters sent. I thought I had read that every 3 months was considered "not excessive" but I cannot find that now.
I can think of 2 ways to make this decision, depending on what factors are important in the definition:
If the important factor is the use to which the data is to be put, then there is timing defined by the act, and this gives 14 days for a letter to be posted, received, acted upon than the response posted and received. I would say in this context 7 days would not be excessive for a process that could be completely automated.
If the important factor is "information is unlikely to have changed between requests" then I would take the distribution of information sharing events in the response to the 1st request, put them into a bayesian model and make requests at the frequency of the low end of the 95% credible interval of getting a change in the time period. It is quite possible, depending on the frequency of information sharing events , the time period for which information is provided as well as the model and prior, that this would be less than 7 days.
I either case I would provide this rational in the initial data request, as well as informing them of my intention to make these follow up requests. It would then be up to the data controller to demonstrate that my rules are manifestly excessive.
As well as the DVLA, a similar argument could be made for many other organisations such as credit reference agencies. Many people may be interested in making these requests if it was demonstrated useful.
As a data subject, what aspects should be considered when making these decisions?