The short answer is no.
The UK General Data Protection Regulation (UK GDPR) gives an individual the right to obtain confirmation of whether a controller is processing their personal data and if so, to obtain copies of their personal data and certain information about how the controller handles their personal data. Therefore, even if you do not hold an individual’s personal data, you cannot ignore the SAR – you need to inform the individual that you don’t process their personal data.
You also cannot ignore a SAR just because you are in the middle of, or anticipate, a dispute with the individual (for example an employment dispute), even if you think the making of the SAR is a tactic to get information ‘via the back door’ or to tie up your resources. The right to access personal data is a statutory right and needs to be dealt with separately to the dispute, however frustrating this might be.
If your intention is to refuse to comply with a SAR because it is manifestly unfounded or excessive then this still doesn’t mean you can ignore it as you are obliged under the UK GDPR to let the individual know:
- the reasons why you are refusing to deal with their SAR
- that they have a right to make a complaint to the Information Commissioner’s Office (ICO)
- that they can seek to enforce the right of access through the courts
What are the potential consequences of ignoring a SAR?
The individual may make a complaint to your organisation about the failure to deal with their SAR. If you continue to ignore the SAR, then the individual can complain to the ICO. The ICO publishes such complaints (even if they are ultimately unfounded) on its website.
The ICO is likely to require you to respond to the SAR and resolve the complaint directly with the individual. If you continue to ignore the SAR and the ICO, then the ICO may take enforcement action against you and issue, for example, a warning, reprimand, enforcement notice (requiring you to take action to comply within a prescribed time) or a penalty notice (a fine).
In addition, the individual may apply for a court order that you comply with the SAR or to seek compensation for damage or distress arising from your failure to comply with the SAR.
Disclaimer
This information is intended for general informational purposes only and does not constitute legal advice. We recommend seeking professional advice before taking any action on the information provided. If you would like to discuss your specific circumstances, please feel free to contact us on 0800 2800 421.
