EU proposed data protection Regulation. Unregulated access - The expanded right of access under the proposed Regulation

Transcription

1 In focus EU proposed data protection Regulation Unregulated access - The expanded right of access under the proposed Regulation The right of access is at the heart of data protection legislation. The Data Protection Act 1998, implementing Article 12 of Directive 95/46/EC, gives individuals the right to be told what personal data an organisation is processing about them and to receive a copy of that information by making what is referred to by those in the trade as a subject access request. In most cases, a data controller must respond to a valid subject access request within 40 calendar days of receiving it. Compliance with such requests can require businesses to undertake searches of large volumes of data, including correspondence, which can result in huge costs running in some cases to tens of thousands of pounds in respect of a single request. Requests are often received in connection with employee disputes, customer complaints or litigation with third parties. The right of access will be strengthened under the proposed Regulation. This article looks at the key changes and examines the practical consequences for businesses in receipt of such requests under the proposed Regulation.

2 2 Unregulated access. The expanded right of access under the proposed Regulation March 2012 What happens today? The right of access is set out in Article 12 of the Directive and Section 7 of the Data Protection Act Under the Directive data subjects are entitled, without restraint, at reasonable intervals and without excessive delay or expense, to obtain from the data controller: (i) (ii) (iii) (iv) confirmation as to whether data relating to him are processed; information as to the purposes of the processing, the categories of data concerned and the categories of recipients to whom data are disclosed; a communication of the data processed, in an intelligible form, together with available information as to the source of the data in many member states this was translated into a right to be provided with a copy of information; and in relation to automatic processing, information as to the logic involved (at least in relation to automatic decisions which produce legal effects concerning him, or which significantly affect him, and which are based on automated processing of data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc). Member states are empowered to adopt exemptions and restrictions to the application of Article 12 (and certain other articles), in accordance with Article 13. These include exemptions where necessary: (i) to safeguard national security, defence, public security, or the prevention, investigation, detection and prosecution of criminal offences; (ii) to safeguard important economic or financial interests; (iii) to safeguard a monitoring, inspection or regulatory function; or (iv) to protect the data subject or the rights or freedoms of others. In the, a nominal fee of 10 can be charged in relation to most subject access requests. Failure to deal with a subject access request will typically lead to a complaint to the Information Commissioner, who has the power to issue a fine in the case of serious breach of the Act of up to 500,000.

3 3 Unregulated access. The expanded right of access under the proposed Regulation March 2012 How does the proposed Regulation change this? The right of access is to be expanded under the new Regulation. The provisions reflect a general strengthening of the rights of data subjects and a focus on informing data subjects of their rights Information The information to which the data subject is entitled has been expanded to include the following additional information: the period for which personal data will be stored; the existence of the right to request from the controller rectification or erasure of personal data concerning the data subject or to object to the processing of personal data; the right to lodge a complaint to the supervisory authority and the contact details of the supervisory authority; and the significance and envisaged consequences of processing. In addition, in relation to the recipients to whom personal data is to be disclosed, greater emphasis has also been added in relation to recipients in third countries. It is possible that data controllers will have to draw specific attention to this, or provide specific information (eg the countries involved). If refusing to respond, data controllers must inform the data subject of the reasons for the refusal.

4 4 Unregulated access. The expanded right of access under the proposed Regulation March 2012 Abolition of nominal fee The right of data controllers to charge a nominal fee for responding to subject access requests will be abolished. Although this will have minimal impact on the balance sheet of most data controllers, it is expected to lead to an increase in the number of requests in particular sectors where it currently acts as a helpful disincentive to vexatious requests. In its response to the Ministry of Justice s Call for Evidence on the proposed Regulation, the CBI has expressed concerns in relation to the abolition of the right to charge a nominal fee, as anecdotal evidence from businesses suggests the fee is usually sufficient to deter those customs whose intention in making a SAR is simply to cost the business time and money (Data Protection in the EU: The case for a re-think, CBI Response, February 2012). The British Bankers Association echoed these concerns in its response to the Call for Evidence: Members question the withdrawal of a charge for exercising their subject access rights, given the high volume of requests they receive and the significant cost to them in responding to such requests (Letter to the Ministry of Justice, 6 March 2012). Helpfully for data controllers, where requests are manifestly excessive, in particular because of their repetitive character, the data controller may charge a fee for providing the information or taking the action requested, or the data controller may not take the action requested (Article 12(4)). This provision may assist data controllers that are faced with unreasonably broad requests, which is common where requests are made in the context of litigation, although the data controller will bear the burden of proving the manifestly excessive character of the request. The CBI noted the following example: One insurer reported that a recent SAR resulted in 3000 pages of A4 all of which need to be checked and where necessary have information redacted (Data Protection in the EU: The case for a re-think, CBI Response, February 2012). Right to a communication of the data The right of the data subject to receive a communication of the data processed has been preserved. An earlier draft of the proposed Regulation referred to the provision of a copy (a term used in national implementing legislation, including the Data Protection Act), so this may signal potentially more relaxed requirements as to the manner in which data can be provided (eg to communicate the data in non-permanent form rather than as a permanent hard or electronic copy, or by granting access via a computer terminal at the offices of the data controller, or via a website). However, the Commission will be empowered to adopt delegated acts to further specify the criteria and requirements for the communication to the data subject. Additionally, requests made in electronic form must be answered in electronic form, unless otherwise requested by the data subject. Data controllers must put in place procedures for dealing with, and mechanisms for facilitating compliance with, subject access requests (Article 12).

5 5 Unregulated access. The expanded right of access under the proposed Regulation March 2012 Reduced response period The time period for responding to requests will be just one month (compared to 40 days at present in the ). An additional month will be allowed if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller. Speaking at the Westminster eforum in February 2012, Deputy Information Commissioner for Data Protection, David Smith, said of the reduced time period that it was much more reasonable in this day and age. However, many have expressed concern with this change. For example, the British Bankers Association responded: If the request involves restoring back up data and searching through potentially tens of thousands of s, this can take considerably longer than the forty day timescale in place at the moment (Letter to the Ministry of Justice, 6 March 2012). Standard forms The Commission will have a new power to specify standard forms and procedures for requesting and granting access to information, including for verification of the identity of the data subject, taking into account the specific features and necessities of various sectors and data processing situations. Exemptions Member states continue to be empowered to introduce exemptions, the permitted scope of which is now set out in Part IX (Provisions Relating to Specific Data Processing Situations) and are broadly similar to the existing exemptions. These include exemptions where processing is carried out for journalistic purposes or for the purpose of artistic or literary expression, for health purposes (eg preventative medicine, public health, social protection), in the employment context, for historic, statistical and scientific research purposes, where data is secret, or in other circumstances in the public interest. There is likely to be a continued lack of harmonisation of the exemptions to the right of access, with member states continuing to be empowered to introduce specific exemptions, within the scope of the framework of exemptions set out in the Regulation. Sanctions The Regulation provides for the imposition of fines up to EUR 500,000, or in the case of an enterprise up to 1% of its worldwide turnover, in relation to a data controller who does not provide access for the data subject in accordance with Article 15.

6 6 Unregulated access. The expanded right of access under the proposed Regulation March 2012 So what does this mean? Data controllers are likely to face increased costs associated with compliance with the expanded right of access. The new right to information concerning the significance and envisaged consequences of processing will place a greater burden on data controllers to document and explain their processes. It will require data controllers to provide better information, some of which may be difficult to maintain for example, assessing the significance of processing may be challenging and may in some cases require a response tailored to the individual. The ICO has welcomed the expanded set of information that must be provided to individuals making subject access requests (ICO: initial analysis of the European Commission s proposals for a revised data protection legislative framework. 27 February 2012). The right of access already places a huge and costly burden on data controllers, who can be forced to incur significant costs, due to the burden of searching for, evaluating and providing copies of the relevant information. The CBI has said this risks costing businesses dearly, and may also impact on taxpayers (Data Protection in the EU: The case for a re-think, CBI Response, February 2012). Failure to review and evaluate information properly before handing it over to a data subject can result in information being provided even where an exemption applies (eg in relation to legally privileged documents), or worse an actionable breach of confidence or unlawful processing (eg where information includes references to third parties). It is a great shame that the proposed Regulation has failed to address the rampant abuse of the right of access by individuals, or more often the law firms they instruct, making subject access requests in connection with actual or threatened litigation, using the right to carry out a fishing expedition to supplement the process of discovery and to apply pressure to data controllers to reach a settlement. The reduction of the time period for responding to requests to just one month, compared to 40 days currently in the, will make it all the more important for data controllers to set up procedures to enable them to quickly recognise and deal with requests. Data controllers will also be required to devote substantially greater resources to dealing with requests, particularly given the threat of potential fines of up to 1% of annual worldwide turnover. Nigel Parker is a Senior Associate in the London office of Allen & Overy. Nigel Parker Tel nigel.parker@allenovery.com

7 FOR MORE INFORMATION, PLEASE CONTACT: Belgium Germany Luxembourg Romania Tom De Cordier Counsel, Brussels Tel tom.decordier@allenovery.com Bettina Enderle Counsel, Frankfurt bettina.enderle@allenovery.com Cyril Pierre-Beausse Counsel, Luxembourg cyril.pierre-beausse@allenovery.com Radu Diaconu Associate, Bucharest radu.diaconu@rtprallenovery.com Czech Republic Hungary Netherlands Spain Prokop Verner Senior Associate, Prague prokop.verner@allenovery.com Balázs Sahin-Tóth Counsel, Budapest balazs.sahin-toth@allenovery.com Hendrik Jan Biemond Partner, Amsterdam hendrikjan.biemond@allenovery.com Rafael Beneyto Associate, Madrid rafael.beneyto@allenovery.com France Italy Poland Slovakia Ahmed Baladi Partner, Paris ahmed.baladi@allenovery.com Lydia Mendola Senior Associate, Milan lydia.mendola@allenovery.com Magdalena Bartosik Senior Associate, Warsaw magdalena.bartosik@allenovery.com Zuzana Hecko Associate, Bratislava Tel zuzana.hecko@allenovery.com Jane Finlayson-Brown Partner, London Tel jane.finlayson-brown@allenovery.com Mark Mansell Partner, London Tel mark.mansell@allenovery.com Nigel Parker Senior Associate, London Tel nigel.parker@allenovery.com Charlotte Mullarkey Senior PSL, London Tel charlotte.mullarkey@allenovery.com This note is for general guidance only and does not constitute definitive advice. In this document Allen & Overy means Allen & Overy LLP and/or its affiliated undertakings. Any reference to a partner is used to refer to a member of Allen & Overy LLP or an employee or consultant with equivalent standing and qualifications or an individual with equivalent status in one of Allen & Overy LLP s affiliated undertakings. Allen & Overy LLP or an affiliated undertaking has an office in each of: Abu Dhabi, Amsterdam, Antwerp, Athens (representative office), Bangkok, Beijing, Belfast, Bratislava, Brussels, Bucharest (associated office), Budapest, Casablanca, Doha, Dubai, Düsseldorf, Frankfurt, Hamburg, Hong Kong, Jakarta (associated office), London, Luxembourg, Madrid, Mannheim, Milan, Moscow, Munich, New York, Paris, Perth, Prague, Riyadh (associated office), Rome, São Paulo, Shanghai, Singapore, Sydney, Tokyo, Warsaw, Washington, D.C. I CS1203_CDD-2498_ADD