Appeal SAR?

[beardsince1978]

Hi,

I'm aware that you can appeal an ICO decision on an FOI request to the GRC but is there anything similar for the ICO's decision on an SAR request? I've tried a ICO review but got nowhere.

I'm trying to get at some redacted information which I suspect is defamatory and provably untrue. ICO has allowed the redaction even though IMO it is similar to page 14 of ICO's guide “s40 Access to information held in complaints files v3.0” (although this is not a complaint file, just a random email, but the principle should still hold). This is the letter from Mr B O’Dwyer to the supermarket which has a red section all about Mr Stevens. On page 15 the guidance says that if Mr Stevens makes an SA request then the supermarket must release the red section.

Thanks

[R0b]

Hello

the FOI is a different kettle of fish in relation to a SAR, namely that the SAR is personal data about you. Data controllers are well within their rights to redact parts of communications that refer to a third party because that doesn't belong to you and unless they have consented or there are other good reasons for doing so e.g. if that third party information has already been disclosed.

Not aware of any appeal stage you either have to make an application for judicial review in the High Court against the ICO's decision (hint: very expensive) or you can make an application in the County Court against the data controller and ask for a decision. Either way you will need to explain why that information relating to a third party should be unredacted given that the redacted information is not about you but someone else.

If you want full access to the document then you can submit a pre-action disclosure application for the document unredacted or you can make a similar application after legal proceedings have been issued. I would suggest you read into pre-action disclosure before going down this route as it can be difficult to obtain.

Having said all of that, if you intend to take legal action for defamation, that usual rules of disclosure would apply so following legal proceedings being issued, you can look at making a CPR 31.14 request for that document.

Sure you can glean from the communications it says XXXX said this or that which means you only need to know the name. If they have redacted the whole sentence rather than just the third party name, then there might be grounds to argue that the remainder of the redaction apart from the third party name should be unredacted, particularly if the statement being made is clearly about you.

[beardsince1978]

Thanks for the reply and info.

I know who sent the email as the name is unredacted. In the text of the email is:

"The current owner of XXX has, however, XXX-XXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX I am therefore keen to avoid anything that gives him ......."

The current owner of XXX refers to me by the other text in the document hence the redacted section, which I've made the same number of characters to show its size, would also seem to refer to me. The email was sent 2020 so out of time for defamation but I object to my council keeping defamatory statements on record. However, without know what was said I cannot ask for a correction to be attached.

Hence I think this information relates me and therefore should be disclosed.