The Dirty Secret Behind How Companies Respond to Your GDPR Subject Access Requests

I. Introduction

A. The concept of data controllers and data processors under GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that governs the collection, processing, and storage of personal data within the United Kingdom (UK) and the European Union (EU). Under the GDPR, organisations are classified as either data controllers or data processors, each with distinct roles and responsibilities.

Data controllers are entities that determine the purposes and means of processing personal data. They are responsible for ensuring that personal data is processed in compliance with the GDPR principles, such as lawfulness, fairness, transparency, and data minimisation. Examples of data controllers include companies, government agencies, and non-profit organisations that collect and process personal data from individuals.

On the other hand, data processors are organisations or individuals that process personal data on behalf of the data controller. They act as third parties, carrying out specific data processing activities as instructed by the data controller. Data processors may include cloud service providers, payroll companies, marketing agencies, or any other entity that handles personal data on behalf of a data controller.

B. The situations when data controllers may outsource SARs to data processors

In certain situations, data controllers may choose to outsource Subject Access Requests (SARs) to data processors. SARs are requests made by individuals (data subjects) to access their personal data held by an organisation. The GDPR grants data subjects the right to obtain a copy of their personal data, as well as information about how their data is being processed.

Data controllers may consider outsourcing SARs to data processors for various reasons, such as:

1. Lack of internal resources or expertise to handle complex SARs efficiently.
2. Concerns about potential legal liability or disclosure of sensitive information that could arise from mishandling SARs.
3. A desire for an impartial third-party review to ensure objectivity and compliance with data protection regulations.

II. Reasons for Outsourcing SARs

A. Lack of internal resources or expertise

Managing SARs can be a complex and resource-intensive process, particularly for organisations with large volumes of personal data or complex data processing operations. Data controllers may lack the necessary expertise, staffing, or technology to handle SARs efficiently and accurately. In such cases, outsourcing SARs to a specialised data processor can be a viable solution.

Data processors, such as law firms or dedicated SAR service providers, often have the necessary resources, expertise, and infrastructure to handle SARs in a timely and compliant manner. They can leverage their experience and specialised knowledge to navigate the complexities of data protection laws and ensure that SARs are processed correctly.

B. Concern about potential liability or disclosure of sensitive information

In some instances, data controllers may be concerned about the potential legal liability or reputational damage that could arise from disclosing certain types of sensitive information in response to an SAR. For example, a company may hold personal data related to ongoing legal disputes, trade secrets, or confidential business information that could be requested as part of an SAR.

By outsourcing SARs to a data processor, such as a law firm, the data controller can benefit from legal expertise and guidance in navigating potential disclosure risks. Data processors can review the requested information, identify potential areas of concern, and provide recommendations on how to handle sensitive information while complying with the GDPR’s requirements.

C. Need for an impartial third-party review

In certain situations, data controllers may wish to have an impartial third-party review of the SAR process to ensure objectivity and compliance. This could be particularly relevant in cases where there may be potential conflicts of interest or when the data controller wants to demonstrate transparency and accountability to data subjects or regulatory authorities.

By outsourcing SARs to an independent data processor, the data controller can benefit from an objective and unbiased assessment of the data processing activities. The data processor can review the SAR, evaluate the completeness and accuracy of the response, and provide impartial recommendations to the data controller.

III. Mechanisms and Requirements

A. Informing the Data Subject

1. Transparency about outsourcing the SAR

When outsourcing SARs to a data processor, data controllers have an obligation to inform the data subject about this arrangement. Transparency is a fundamental principle of the GDPR, and data subjects have the right to know how their personal data is being processed and by whom.

Data controllers should clearly communicate to the data subject that their SAR will be handled by a third-party data processor. This information should be provided in a concise and easily accessible manner, such as in the organisation’s privacy policy or through a specific notification when the SAR is received.

2. Providing contact details of the data processor

In addition to disclosing the outsourcing arrangement, data controllers should also provide the data subject with the contact details of the data processor handling their SAR. This ensures that the data subject has the necessary information to communicate directly with the data processor if needed.

The contact details should include the name of the data processor, the contact person or department responsible for handling SARs, and their contact information (e.g., email address, phone number, or mailing address).

B. Data Protection Agreement

1. Defining roles and responsibilities

When outsourcing SARs to a data processor, it is crucial to have a comprehensive data protection agreement in place. This agreement should clearly define the roles and responsibilities of both the data controller and the data processor, ensuring a clear understanding of their respective obligations under the GDPR.

The agreement should specify that the data controller remains ultimately responsible for ensuring compliance with data protection laws, while the data processor is responsible for following the instructions of the data controller and implementing appropriate technical and organisational measures to protect the personal data.

2. Specifying data processing instructions

The data protection agreement should provide detailed instructions on how the data processor should handle and process the personal data in relation to SARs. This includes specifying the scope and purpose of the data processing, the types of personal data involved, and any specific requirements or limitations regarding the processing of sensitive or special categories of personal data.

The agreement should also outline the procedures and timeframes for responding to SARs, as well as the format and level of detail required in the response.

3. Ensuring adequate safeguards and security measures

To ensure the protection of personal data, the data protection agreement should require the data processor to implement appropriate technical and organisational measures to safeguard the personal data being processed. This may include measures such as data encryption, access control mechanisms, secure storage and transmission protocols, and regular security audits.

The agreement should also specify the data processor’s obligations regarding data breach notification and incident response procedures, ensuring that any potential breaches are addressed promptly and in compliance with the GDPR’s requirements.

4. Addressing data breach response procedures

In the event of a data breach involving personal data processed by the data processor, clear procedures and responsibilities should be outlined in the data protection agreement. This includes mechanisms for the data processor to promptly notify the data controller of any suspected or confirmed data breaches, as well as the steps to be taken to mitigate the breach and minimise the potential impact on data subjects.

The agreement should also specify the roles and responsibilities of both parties in conducting incident investigations, notifying relevant authorities (if required), and communicating with affected data subjects.

C. Due Diligence and Vetting

1. Assessing the data processor’s expertise and capabilities

Before engaging a data processor to handle SARs, data controllers should conduct thorough due diligence to assess the data processor’s expertise, capabilities, and commitment to data protection compliance. This may involve evaluating the data processor’s track record, industry experience, technical infrastructure, and data handling procedures.

Data controllers should ensure that the data processor has the necessary knowledge and resources to handle SARs in accordance with the GDPR’s requirements, including the ability to locate and retrieve relevant personal data, redact or pseudonymize sensitive information, and provide comprehensive and accurate responses to data subjects.

2. Evaluating their data protection practices and compliance

As part of the due diligence process, data controllers should evaluate the data processor’s data protection practices and compliance measures. This may involve reviewing the data processor’s policies, procedures, and technical and organisational safeguards for protecting personal data.

Data controllers should also assess the data processor’s ability to demonstrate compliance with the GDPR’s principles, such as data minimisation, storage limitation, and data subject rights. This can be achieved through reviews of the data processor’s documentation, certifications, and independent audits or assessments.

IV. Ensuring GDPR Compliance and Transparency

A. Upholding the Spirit of GDPR

1. Respecting data subject rights

When outsourcing SARs to data processors, it is crucial to uphold the spirit of the GDPR by respecting the rights of data subjects. The GDPR grants individuals various rights, including the right to access their personal data, the right to rectification, the right to erasure (also known as the “right to be forgotten”), and the right to object to certain types of data processing.

Data controllers and data processors must ensure that SARs are handled in a manner that fully respects and upholds these rights. Responses to SARs should be comprehensive, accurate, and provided in a timely manner, allowing data subjects to exercise their rights effectively.

2. Promoting transparency and accountability

Transparency and accountability are fundamental principles of the GDPR. When outsourcing SARs to data processors, both parties should strive to promote transparency and accountability throughout the process.

Data controllers should be transparent about their data processing activities, including the use of third-party data processors to handle SARs. This information should be clearly communicated to data subjects through privacy notices, policies, and other appropriate channels.

Additionally, data controllers should maintain accountability by implementing appropriate governance and oversight mechanisms. This may include regular audits, monitoring, and reviews of the data processor’s activities to ensure compliance with the data protection agreement and the GDPR’s requirements.

B. Maintaining Control and Oversight

1. Regular monitoring and audits

Even when outsourcing SARs to a data processor, data controllers retain overall responsibility for ensuring compliance with data protection laws. To maintain control and oversight, data controllers should implement regular monitoring and auditing processes to evaluate the data processor’s performance and adherence to the agreed-upon procedures and safeguards.

This may involve conducting periodic audits, reviewing sample SAR responses, and assessing the data processor’s security measures, incident response procedures, and overall data handling practices. Data controllers should also have mechanisms in place to address any identified issues or non-compliance promptly.

2. Ensuring proper handling of SARs by the data processor

Data controllers should have processes in place to ensure that the data processor is handling SARs properly and in accordance with the data protection agreement and GDPR requirements. This may include regularly reviewing SAR logs, response times, and the quality and completeness of the responses provided to data subjects.

Data controllers should also establish clear communication channels with the data processor to address any questions, concerns, or escalations that may arise during the SAR handling process.

C. Addressing Potential Conflicts of Interest

1. Mitigating risks of bias or undue influence

When outsourcing SARs to a data processor, there is a potential risk of bias or undue influence, particularly if the data processor has existing relationships or conflicts of interest with the data controller. For example, if a law firm is engaged as a data processor to handle SARs for one of its clients (the data controller), there may be concerns about objectivity and impartiality.

To mitigate these risks, data controllers should implement measures to ensure the independence and objectivity of the data processor’s SAR handling processes. This may involve establishing clear protocols for managing potential conflicts of interest, such as requiring disclosure of any relevant relationships or interests, implementing robust ethical walls or information barriers, and providing ongoing training and guidance on maintaining impartiality.

2. Ensuring impartial and objective SAR processing

In addition to mitigating potential conflicts of interest, data controllers should ensure that the data processor has established processes and procedures to ensure impartial and objective SAR processing. This may involve implementing quality assurance mechanisms, such as peer reviews or independent audits, to verify the accuracy and completeness of SAR responses.

Data processors should also have in place measures to prevent any undue influence or pressure from the data controller or other parties that could compromise the integrity of the SAR handling process.

V. Best Practices and Recommendations

A. Clear communication with data subjects

Effective communication with data subjects is essential when outsourcing SARs to data processors. Data controllers should provide clear and concise information about the outsourcing arrangement, the role of the data processor, and the data subject’s rights and options for communicating with the data processor.

Data controllers should also ensure that data subjects receive timely and comprehensive responses to their SARs, even when outsourced to a data processor. Regular updates and clear communication channels should be established to address any questions or concerns that may arise during the process.

B. Robust data protection agreements

As discussed earlier, having a robust and comprehensive data protection agreement in place is crucial when outsourcing SARs to data processors. The agreement should clearly define the roles, responsibilities, and obligations of both parties, as well as specific instructions and procedures for handling SARs.

Data controllers should carefully review and negotiate the terms of the data protection agreement to ensure that it aligns with their data protection requirements and the GDPR’s principles. Regular reviews and updates of the agreement may be necessary to reflect any changes in data processing activities or regulatory requirements.

C. Ongoing training and awareness

Both data controllers and data processors should prioritise ongoing training and awareness programs to ensure that their respective teams are knowledgeable about data protection laws, best practices, and the specific procedures and protocols related to handling SARs.

Data controllers should provide training to their employees on the importance of data protection, the rights of data subjects, and the processes for responding to SARs, including the use of third-party data processors.

Similarly, data processors should invest in comprehensive training programs for their staff, covering topics such as data handling procedures, security measures, incident response protocols, and maintaining impartiality and objectivity when processing SARs.

D. Regular reviews and updates of processes

Data protection laws and best practices are constantly evolving, and organisations should regularly review and update their processes and procedures to ensure ongoing compliance and effectiveness. This includes reviewing and updating data protection agreements, SAR handling protocols, and any related policies or documentation.

Data controllers and data processors should also stay informed about any changes or updates to relevant data protection laws, guidance, or regulatory interpretations, and adapt their processes accordingly.

VI. Conclusion

A. The importance of proper mechanisms and safeguards

Outsourcing SARs to data processors can be a viable option for data controllers seeking specialised expertise, resources, or impartial third-party reviews. However, it is crucial to have proper mechanisms and safeguards in place to ensure compliance with the GDPR and protect the rights and interests of data subjects.

Implementing robust data protection agreements, conducting thorough due diligence and vetting of data processors, maintaining control and oversight, and addressing potential conflicts of interest are essential steps in ensuring the proper handling of SARs by third-party processors.

B. The need for transparency and GDPR compliance

Ultimately, outsourcing SARs to data processors should not compromise the fundamental principles of the GDPR, such as transparency, accountability, and the protection of data subject rights. Data controllers and data processors must work together to uphold the spirit of the GDPR and maintain the trust and confidence of data subjects.

By implementing best practices, ongoing training and awareness programs, and regularly reviewing and updating processes, organisations can effectively outsource SARs while ensuring compliance with data protection laws and promoting transparency and accountability throughout the process.

#GDPR #DataPrivacy #DataProtection #SubjectAccessRequests #SARs #DataControllers #DataProcessors #Compliance #Transparency #GDPRBestPractices #ICO

Public Interest Disclosure Statement

This statement outlines the principles guiding disclosures made in my articles, which aim to serve the public interest by promoting transparency and accountability.

Guiding Principles

• Public Interest: Disclosures are made to serve the public interest, inspired by the principles underlying the Public Interest Disclosure Act 1998.
• Ethical Reporting: I strive to adhere to ethical reporting practices to the best of my ability as a non-professional writer.
• Factual Accuracy: All information disclosed is factual and evidence-based to the best of my knowledge.
• Good Faith: Disclosures are made without malice and with a genuine belief in their truth and public importance.
• Proportionality: The extent of disclosure is proportionate to the perceived wrongdoing or risk.
• Confidentiality: Sources and sensitive information are protected where appropriate.

Legal Considerations Disclosures are made with consideration of:

• Data Protection Act 2018 and GDPR: Personal data is processed in compliance with data protection principles.
• Defamation Act 2013: Truth: Factual statements are true to the best of my knowledge. Honest Opinion: Opinions are clearly identified and based on facts. Public Interest: Publication is believed to be in the public interest.
• Human Rights Act 1998: Disclosures exercise the right to freedom of expression, balanced against other rights.

Ethical Standards

While not a professional journalist, I strive to maintain high ethical standards in my reporting, including:

• Verifying information to the best of my ability
• Seeking comment from those involved where possible
• Being transparent about my methods and limitations

Disclaimer

This statement does not claim legal protections specific to employee whistleblowers or professional journalists. While every effort is made to ensure accuracy and ethical compliance, this is not legal advice. I am not a legal professional or a qualified journalist. Legal and ethical advice will be sought in cases of uncertainty.

By adhering to these principles, I aim to make responsible disclosures that serve the public interest while respecting legal and ethical obligations.