1

ACME Inc. Receives a subject access request from Bob, and fails to respond to it for 5 months. What are the likely sanctions faced by ACME, in case this was the:

  • 1st,
  • 2nd,
  • or 3rd

Such incident of not complying with the data protection legislation?

Improve this question
1
  • 1
    What has Bob been doing about it, if anything? If Bob has done nothing, then the likely penalty is nothing.
    – Lag
    Nov 21 at 17:38

1 Answer 1

Reset to default
0

As a data protection professional, I have personally observed an organisation in the UK fail to comply fully with a subject access request for more than two years. It faced no formal enforcement action from the ICO, but the data subject did invoke their complaints procedure, and a case officer was trying to get some traction with the organisation.

The ICO is quicker to turn around complaints now, but appears softer on (UK GDPR) enforcement. When I personally had an issue with a tardy DSAR, I used the ICO's new complaints interface, which suggested I should wait a certain amount of additional time for the controller to respond, beyond the statutory deadline, before making a complaint.

That being said, technically they could be fined, publicly reprimanded, etc. for their noncompliance. And the data subject will still have the right to (a) request compensation in case the noncompliance causes them damage; and/or (b) a judicial remedy where they believe their rights have been infringed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .