The Dirty Tactics Data Controllers Use to Undermine Your Rights as a Data Subject

Introduction

Data Subject Access Requests (DSARs) are a cornerstone of data protection and privacy under the General Data Protection Regulation (GDPR). They empower individuals to understand what personal data is held about them, how it is being processed, and to ensure its accuracy and legality. However, the ideal of transparency and accountability often clashes with the reality of how data controllers and data protection officers (DPOs) manage these requests. This article delves into the numerous tactics employed by data controllers and DPOs to withhold information, the legal loopholes they exploit, and the often slow and ineffective response from the Information Commissioner’s Office (ICO).

Selective Responses by Data Controllers

Data controllers frequently adopt selective responses to DSARs, providing incomplete or carefully curated data sets. This selective disclosure can significantly undermine the transparency and trust that GDPR aims to establish.

Common Tactics:

• Partial Disclosure: Only a portion of the requested data is provided, often omitting sensitive or incriminating information.
• Delays: Procrastination in response times, pushing the limits of the one-month deadline stipulated by GDPR, often with requests for extensions.
• Technical Complexity: Citing technical difficulties as a reason for incomplete data provision.

Example: A financial institution receives a DSAR from a customer but omits transaction details that indicate mishandling of funds, citing “system limitations” as the reason.

Hiding Disclosures and Heavy Redaction

Another prevalent tactic involves the heavy redaction of information. While redactions are sometimes necessary to protect third-party privacy, they are often used excessively to obscure critical details.

Analysis:

• Third-Party Privacy: Legitimate concerns about disclosing third-party information are sometimes overstated to hide relevant data.
• Legal Privilege: Information is redacted under claims of legal privilege, which can be over-applied to avoid disclosing potentially damaging information.

Example: A company responds to a DSAR but redacts significant portions of internal emails, citing third-party privacy and legal privilege, leaving the data subject with a largely unintelligible document.

Involvement of Law Firms

To further complicate matters, data controllers may delegate DSAR processing to law firms. This transfer often occurs without the knowledge of the data subject and lacks a proper data privacy agreement.

Impact:

• Transparency Issues: Data subjects are often unaware that their data is being handled by an external party.
• Timeliness: The involvement of law firms can introduce additional delays due to the legal review processes.
• Lack of Agreement: Absence of a clear data privacy agreement between the data controller and the law firm can lead to misuse or mishandling of data.

Case Study: A technology company passes a DSAR to its legal team without informing the data subject. The response, delayed and heavily redacted, raises suspicions but offers no clarity.

Narrowing the Scope of DSARs

Data controllers frequently exploit certain provisions of the Data Protection Act to limit the scope of DSARs, thereby evading full compliance.

Common Excuses:

• Data Protection Act Provisions: Citing specific clauses that allow for exclusions or limitations in the scope of the data provided.
• Scope Definition: Narrowly defining the scope of the request to exclude broader data sets or historical data.

Effects: This narrowing significantly diminishes the data subject’s ability to fully understand the breadth of data held about them and its usage.

Example: A DPO responds to a DSAR by only providing the last three months of emails, despite the data subject requesting all information held over the past two years.

Claims of Manifestly Unfounded or Excessive Requests

The argument that a DSAR is “manifestly unfounded or excessive” is another tactic used to dismiss requests altogether.

Analysis:

• Frequent Use: How often this claim is made and under what circumstances.
• Impact: The outright dismissal of legitimate requests based on this claim can leave data subjects without recourse.

Example: A multinational corporation dismisses a DSAR from a former employee, claiming it is manifestly excessive due to the volume of data requested, despite the request being well within reasonable bounds.

Other Tactics to Hide Information

In addition to the aforementioned strategies, data controllers employ various other methods to avoid full disclosure.

Overview:

• Data Destruction: Conveniently timed data destruction policies that erase relevant data just before a DSAR is received.
• Overwhelming Data Dumps: Providing an overwhelming amount of irrelevant data to obfuscate pertinent information.
• Technical Barriers: Providing data in formats that are difficult to access or interpret.

Specific Examples:

• A social media company responds to a DSAR with thousands of pages of logs, making it nearly impossible to find the relevant information.
• An organisation provides data in an outdated or proprietary format that the requester cannot easily open or understand.

The Role of the Information Commissioner’s Office (ICO)

The ICO is tasked with overseeing compliance with GDPR and handling complaints related to DSARs. However, its effectiveness is often questioned.

Critique:

• Response Time: The ICO often takes months to investigate complaints, which can delay justice and resolution.
• Thoroughness: Investigations can be superficial, failing to address the core issues raised by complainants.
• Perceived Bias: There is a perception that the ICO sides with data controllers, further eroding trust in the process.

Examples: A data subject reports a non-compliant response to the ICO, only to receive a generic reply after several months, suggesting no further action will be taken.

Conclusion

The tactics employed by data controllers and DPOs to obfuscate, delay, or deny DSAR responses significantly undermine the rights of data subjects under GDPR. Transparency and accountability are essential, yet often elusive.

Key Issues Summarised:

• Selective responses and incomplete disclosures.
• Heavy redaction and hiding behind legal privilege.
• Involvement of law firms without proper agreements.
• Narrowing the scope of DSARs.
• Dismissal of requests as manifestly unfounded or excessive.
• Other underhanded tactics to evade full compliance.

Suggestions for Individuals:

• Be specific and precise in DSAR requests.
• Follow up persistently and document all communications.
• Seek legal advice if necessary.
• Report non-compliance to the ICO with detailed evidence.

Call to Action for Regulatory Bodies:

• Enhance oversight and enforcement of GDPR compliance.
• Improve response times and the thoroughness of investigations.
• Ensure impartiality and transparency in handling complaints.

References

• General Data Protection Regulation (GDPR) EUR-Lex
• Information Commissioner’s Office (ICO) DSAR guidelines ICO.org.uk
• Data Protection Act 2018 Legislation.gov.uk

#DataProtection #GDPR #DSAR #PrivacyRights #DataPrivacy #ICO #LegalCompliance #DataSecurity #Transparency #ConsumerRights

Public Interest Disclosure Statement

This statement outlines the principles guiding disclosures made in my articles, which aim to serve the public interest by promoting transparency and accountability.

Guiding Principles

• Public Interest: Disclosures are made to serve the public interest, inspired by the principles underlying the Public Interest Disclosure Act 1998.
• Ethical Reporting: I strive to adhere to ethical reporting practices to the best of my ability as a non-professional writer.
• Factual Accuracy: All information disclosed is factual and evidence-based to the best of my knowledge.
• Good Faith: Disclosures are made without malice and with a genuine belief in their truth and public importance.
• Proportionality: The extent of disclosure is proportionate to the perceived wrongdoing or risk.
• Confidentiality: Sources and sensitive information are protected where appropriate.

Legal Considerations Disclosures are made with consideration of:

• Data Protection Act 2018 and GDPR: Personal data is processed in compliance with data protection principles.
• Defamation Act 2013: Truth: Factual statements are true to the best of my knowledge. Honest Opinion: Opinions are clearly identified and based on facts. Public Interest: Publication is believed to be in the public interest.
• Human Rights Act 1998: Disclosures exercise the right to freedom of expression, balanced against other rights.

Ethical Standards

While not a professional journalist, I strive to maintain high ethical standards in my reporting, including:

• Verifying information to the best of my ability
• Seeking comment from those involved where possible
• Being transparent about my methods and limitations

Disclaimer

This statement does not claim legal protections specific to employee whistleblowers or professional journalists. While every effort is made to ensure accuracy and ethical compliance, this is not legal advice. I am not a legal professional or a qualified journalist. Legal and ethical advice will be sought in cases of uncertainty.

By adhering to these principles, I aim to make responsible disclosures that serve the public interest while respecting legal and ethical obligations.