ACME Inc. Receives a subject access request from Bob, and fails to respond to it for 5 months. What are the likely sanctions faced by ACME, in case this was the:
- or 3rd
Such incident of not complying with the data protection legislation?
As a data protection professional, I have personally observed an organisation in the UK fail to comply fully with a subject access request for more than two years. It faced no formal enforcement action from the ICO, but the data subject did invoke their complaints procedure, and a case officer was trying to get some traction with the organisation.
The ICO is quicker to turn around complaints now, but appears softer on (UK GDPR) enforcement. When I personally had an issue with a tardy DSAR, I used the ICO's new complaints interface, which suggested I should wait a certain amount of additional time for the controller to respond, beyond the statutory deadline, before making a complaint.
That being said, technically they could be fined, publicly reprimanded, etc. for their noncompliance. And the data subject will still have the right to (a) request compensation in case the noncompliance causes them damage; and/or (b) a judicial remedy where they believe their rights have been infringed.