Denied Data Subject Access Request (DSAR) due to third-party information

Question

A while ago I made a data subject access request (DSAR, asking for personal information which is stored about me) which was part of an ongoing complaint. In a nutshell, I did a complaint to a company of sharing my data without consent and I explicitly instructed them not to share my data, which was on a recorded phone conversation. I have made an access request to listen to those phone calls but that was denied due to third-party information. In essence, any third-party information that was discussed was about insurance policies, i.e. anything that we did discuss could be found on the internet as well in policy documents but I don't recall discussing sensitive information about any third-party. Is the company within their rights to deny my DSAR for any potential third-party policy documents that were discussed or under what circumstances can they deny a DSAR (i.e. what level of third-party information must be shared in a conversation so that they can withhold such a request)? If it makes a difference, this is under UK law.

Answer 1

The GDPR allows the right to access to be limited if this access would “adversely affect the rights and freedoms of others” (Art 15(4) GDPR). However, access to the recording would not give you more information than you've already received during the phone call, so this exemption is quite unlikely to apply in any case.

UK data protection law also has a large list of additional exceptions, as summarized here by ICO guidance. These exemptions also cover some aspects of trade secrets, and even mention insurance examples. However, not such exemption is likely to apply in your case: the recording would not give you more information than you already have.

If the data controller is concerned about some parts of the conversation, they should provide a redacted copy and explain why the redactions were performed. They should not reject the request outright.

If the data controller wants to reject the request entirely, they must do so within the time frame for the DSAR (one month), must explain their reasons, and must inform you that you're allowed to lodge a complaint with your supervisory authority or to sue them. However, ICO guidance is flexible on how detailed the reason for refusal can be:

Where an exemption applies, the reasons you give to an individual for not complying with a request may depend upon the particular case. For example, if telling an individual that you have applied a particular exemption would prejudice the purpose of that exemption, your response may be more general. However, where possible, you should be transparent about your reasons for withholding information.

Here, I don't see any reason why full transparency would be a problem, so I would expect that the data controller can point to a specific exemption in UK data protection law.

If you are unsatisfied with the data controller's response, please consider lodging a complaint with the supervisory authority. In the UK, this is the ICO. On the ICO complaints page, you can fill out the online form about “your personal information concerns”.