Addleshaw Goddard has reported on the UK’s recent decision regarding subject access requests. The UK’s High Court, in Ezsias v. Welsh Ministers, has clarified the lenghts to which companies must go in responding to a subject access request, requiring "reasonable and proportionate steps to identify and disclose the data[.]" The plaintiff here complained that the defendant had not undertaken a complete accounting of the data it held because it had only searched in certain departments. The court held that the search it had conducted was "reasonable and proportionate" under the circumstances.
Member state implementation of Article 12 of the EU data protection directive gives individuals the right of access to data an organization holds about them. In the UK, this has been implemented in Section 7 of the Data Protection Act 1998.
This case is the first in the UK to find that companies may restrict the scope of their search for data in response to a subject access request, although it may conflict with the Information Commissioner’s findings on the same issue — allowing for the production of the data in hard copy to be proportionate, not the search itself.