Subject Access Request Refused

[kiasian]

Hi, I am a foster carer who has tried to obtain information held about me from a local authority, that was used to prevent me adopting a child that was in my care. Two local authorities and the MPS were involved and all are withholding the vast majority of information, despite the ICO agreeing with me that they are withholding information. I want to force the three data* controllers to comply with the ICO, and want to get a court order to make this happen. It* has taken 6 months for me to get to this point. How do I obtain a court order? I live in London*

[Law Student 2]

Hi, sorry to hear about this!

When you say the ICO agreed with you that they are withholding information do you mean you asked the ICO for a compliance assessment?*
*If so, and the ICO have found that the data controllers are not complying with the DPA, they may ask the data controllers themselves to comply and in some cases may order the organisation to do so. So it is worth asking the ICO for a compliance assessment if you have not already done so and seeing if they can take any action before you proceed with a court order.

However, even though the ICO can enforce a SAR they cannot award compensation for non-compliance. Only a court order can do this. so if you are seeking compensation as well as compliance a court order would be the route to take.

Have you checked that the data controllers are not subject to any exemptions which would allow them to refuse the SAR? As one of the exemptions relates to social work, so I am not sure if this would apply or relate to your situation. *This is worth double checking before going to court. It is important to note that just because the ICO agrees does not mean the court will enforce a SAR.

You can make an application to the court pursuant to s7(9) DPA alleging breach of the subject access rules and seeking an order for compliance.

The courts have said they will consider a range of factors including:
 the nature and gravity of the data controller’s breach of its s7 obligations;
 the general principle of proportionality;
 balancing the fundamental right of the individual right of
subject access with the interests of the data controller;
 prejudice to the individual’s rights;
 whether there is a more appropriate route to disclosure (note
that this does not affect the obligation of the data controller to make disclosure in response to a SAR, but may have an impact on the use of the court’s discretion); and
 where there is an abuse of process or a conflict of interest, this may influence the court not to make an order.

So it would be wise to consider how these factors would relate to your case.

Hope this helps!


*