In May 2009 we received a complaint from an individual concerning the alleged failure of his employer, Company X (accountants), to comply in full with an access request he submitted in February 2009. In support of his complaint, the data subject provided copies of documents that contained his personal data and that appeared to have been generated on the company’s computer system. These documents were not provided to him in response to his access request.
We commenced an investigation by writing to Company X informing it that we had received a complaint from one of its employees in relation to an alleged failure to comply with an access request. We received a reply from the company’s solicitors who informed us that their client had furnished the data subject with his personal file. The letter sought clarification and guidance on the type of documentation sought by the data subject. We informed the solicitors for Company X of the type of information the data subject was requesting and we reminded them of the obligation to comply fully with the access request. Following protracted correspondence with the solicitors, we did not receive confirmation of full compliance with the access request. Therefore we issued a final warning letter informing them that enforcement proceedings would commence if their client did not respond in full to the data subject's access request. Prior to commencing enforcement proceedings, we received some personal data relating to the data subject from the solicitors for Company X. However, having compared this data to the data previously supplied to us by the complainant, it appeared that all the personal data to which the data subject was entitled had still not been furnished to him. In order to progress the matter and to ensure compliance with the Acts, we provided the solicitors with a list of the documentation which had been provided to us by the data subject and we requested that it comply with the access request within one week. Despite our best efforts, Company X failed to provide the data subject with all of his personal data within that timeframe.
In view of this unsatisfactory situation and the failure of Company X to meet its statutory obligation to respond in full to the complainant's access request, we concluded that the company appeared to be paying insufficient attention to the data protection rights of the individual concerned. Accordingly, authorised officers, using the powers conferred on them by Section 24 of the Data Protection Acts, entered and inspected the company’s premises for the purpose of obtaining information that was necessary for the investigation of this complaint. During the unannounced inspection they found all but three of the documents which had been identified by the data subject as missing from the response to his access request. In the course of the investigation the data subject had provided us with some documents which he had received from Company X as part of his access request. It appeared that parts of these documents had been redacted and the data subject believed that the redacted parts contained his personal data. The authorised officers examined these documents during the inspection at the company’s premises and found that the redacted parts of these documents did contain the personal data of the data subject and should have been provided to him in unedited form as part of his access request. The documents in question were emails sent between senior managers in the company and contained personal data concerning the data subject. We also found a further six documents containing personal data relating to the data subject which had not been released under the access request, the existence of which were unknown to the data subject.
At the end of the inspection, Company X gave the authorised officers a verbal undertaking that copies of all of the documents would be forwarded to the data subject within the following days. Despite this undertaking and despite numerous communications between our Office and this company, the documentation was not voluntarily supplied to the data subject. We therefore served an Enforcement Notice requiring the company to supply the outstanding personal data to the data subject. The Enforcement Notice was complied with within days of being served.
The events leading to instructions to authorised officers to conduct an inspection of the premises of Company X suggested that the company had a limited understanding of its duties under data protection law. When an individual makes an access request to a data controller there is a statutory obligation on the data controller to provide that individual with all of his/her personal data, subject to limited exceptions. In this case Company X failed to provide the data subject with some of his personal data without providing him with any reason for this decision. Our approach to complaints, as provided for under the Acts, is to try to reach an amicable resolution. However, as demonstrated in this case, if a data controller fails to cooperate fully with an investigation we will not hesitate to use our statutory powers.