SAR Redaction?

[Jimbob4632]

Hi and thank you for letting me join the forum.
i have a question that I hope someone can help me with. I submitted a SAR to the governing body of my sport on 15/01/2018 (I am a full time athlete). I was told that there were numerous boxes relating to me, some information was where I was named in an email circular, hence so many boxes.
To date (04/04/2018) I have received 1 box of information, I have questioned where the remaining information is and have been told it is being redacted.
my question is, who has the right to access my personal data for redacting. It seems that anyone who can hold a black marker is being given access to redact and, is this data allowed to be taken home for redaction? (It’s my understanding that the people involved are doing it on their own time, I assume this means at home). Is this a data breach?
I suggested an extension on the 40 day period to supply my information as I was not contacted until day 36 after the initial submission and did not know that there was so much data to process but, to be honest this is now dragging on for months.

[jaguarsuk]

The Data absolutely should not be being taken home by the people redacting it as it could be copied by them before doing so, which would be a data breach.

It should be done either by the governing body's employees and with the supervision of their Data Protection Officer or by a specific contractor whom specialise in that sort of thing.

[Jimbob4632]

Thank you for the reply, I thought that myself, makes me a little uneasy thinking someone has my personal data with them in a private setting (at home).
the data was sent from head office to the centre I’m based at and to be honest, I don’t know what’s actually included but, it seems to be taking a very long time to get my data. As I said, I submitted the SAR on 15/01/18 and received around 10% of what I have been told is available, it’s now 04/04/18.
I raised the issue of this ‘possibly becoming the subject of a data breach’ with the information controller whilst asking for an update. I got what seemed quite a snippy email asking if I had any proof of a data breach.
Although the process of submitting a SAR is well documented, there seems to be little information on some of the finer points, exactly who should be redacting this information, where this should take place and whether I can actually ask who is doing this.
the one box of information I have to date has been massively informative and has cleared up some ‘misinformation’ which I would otherwise be struggling to prove without it.

[jaguarsuk]

This is all I could find with a quick google search: https://ico.org.uk/media/for-organis...ion-safely.pdf