GDPR18 or Business as Usual - non compliance

[Scrumpy11]

Dear Sir/Madam,

I am seeking help regarding Subjucrlt Access Request ("SAR"), which I submitted to my Housing Assosiation under the General Data Protection Regulations 2018, ("GDPR18")..

On the 18th of April 2023, I submitted my SAR's request to my Hoising Association for all documents pertaining to Servce Charges, which were unlawfully taken, dating back to when my tenancy started, 04 December 1995. I received a reply requesting for proof of identification, which I submitted on the 20th of April 2023.

On the 2nd of June 2023, i chased this up as I had heard nothing since the request for ID. I was informed that my request was not treated as a SAR's request, but instead its been treated as a Business as Usual request ("BAU").

Is this legal? What is a BAU? or are my landlord now in breach if the GDPR18.

I require this information as my landlord has alrrady admited liability by stating they never consulted me as stated they should have done in my tenancy. However, my landlord has only gone back 6 years. I intend to fight this in court with the hope of displacing the Limitations Act. I require the information to see how muge has been unlawfully taken.

Kind regards,

Stevieb

[PallasAthena]

See below the ICO's explanation of "BAU", although they don't actually use that expression, they call it 'normal business processes'. Essentially it is when someone request information as an SAR but it is the type of information which the business regularly provides anyway. So in principle your HA is entitled to treat your request as a "BAU" instead of an SAR. But they aren't supposed to do that if it makes them exceed the time scales that would apply to a SAR.



Can we deal with a request in our normal course of business?


It is important to draw a practical distinction between formal requests for information and routine verbal enquiries and correspondence that you can deal with in the normal course of business. You can respond to an enquiry in the normal course of business if you provide such information routinely, and can respond quickly. However, the SAR process may be appropriate where an individual requests a high volume of information and you need to conduct a time-consuming search of your records in order to comply with the request.

For example, if an individual requests copies of letters which you have sent to them previously, it is unlikely that you need to deal with this as a formal SAR. You should consider these enquiries on a case by case basis. However, you should not use your normal business processes to restrict or delay an individual’s right of access to their information.

[Scrumpy11]

Pallasathena, thank you. This clarrifies matters. I will raise the complaint with my HA,esculating it if necassary