Restriction of Individual Rights in certain circumstances

The right to data protection is not an absolute right. It must always be balanced against other values, fundamental rights, human rights, or public and private interests and there may be circumstances under which an organisation may have grounds to refuse to grant an individual’s request to exercise their data protection rights.

There are certain limitations contained within the data protection rights set out under the GDPR. For example, your right to access your data should not adversely affect the rights and freedoms of others. Certain data protection rights only apply in certain circumstances. The right to erasure (‘right to be forgotten’), for instance, only applies under certain conditions, such as the personal data no longer being required for the purpose it was collected. In certain very limited cases the GDPR allows organisations to charge a reasonable fee for responding to a request, or even to refuse to act on a request, if the request is manifestly unfounded or excessive.

The GDPR allows for further restrictions on data protection rights in national law, but these restrictions must adhere to an exhaustive list of requirements, respect the essence of the fundamental rights and freedoms of individuals, and be necessary and proportionate to safeguard certain objectives of societal or general public interest. Some of the restrictions contained in the Data Protection Act 2018 relate to processing carried out for electoral purposes or by the Referendum Commission, the safeguarding of cabinet confidentiality, the administration of tax and duties, the exercise or defence of legal claims, and personal data relating to an opinion given in confidence.

In any case, an organisation must always respond to your requests within one month, even if they believe they have grounds to refuse it. Where an organisation refuses or partly refuses your request, their response must set out clearly which limitation or restriction they are relying on to refuse to act on the request, their reasons for not taking action, and informing you of the possibility of lodging a complaint with the DPC or seeking a judicial remedy.