Last updateTue, 24 Feb 2015 5pm

DATA PROTECTION: Show and tell

03 June 2016  

Charles Wynn-Evans reviews the use of subject access requests in light of a recent High Court decision

Under s7 of the Data Protection Act 1998 (DPA), individuals are entitled to ask their current or former employer to provide them with the ‘personal data’ which it holds on them. This is called a subject access request (SAR). To paraphrase, under the SAR regime, the employer (as a ‘data controller’ for the purposes of the DPA) can require a maximum fee of £10 for compliance with the request and has 40 days to provide the information. The employer can require the individual to provide evidence of their identity if it ‘reasonably requires further information’ on this, and is entitled to require clarification on the scope of the request. Time runs from receipt of that evidence or of the requisite fee (if required), whichever is later.

Additional Info

  • Case(s) Referenced:

    Dawson-Damer v Taylor Wessing LLP [2015] EWHC 2366 (Ch)

    Dunn v Durham County Council [2012] EWCA Civ 1654

    Durant v Financial Services Authority [2003] EWCA Civ 1746

    Gurieva & anor v Community Safety Development (UK) Ltd [2016] EWHC 643 QB

    In Re Southern Pacific Loans Ltd [2013] EWHC 2485 Ch

    R (Lord) v Secretary of State for the Home Department [2003] EWHC 2073 (Admin)

Last modified on 06 June 2016