The DPC received a complaint from an individual regarding the withholding of records containing personal data in response to an access request. The individual had made an access request under Article 15 of the GDPR to a financial service provider, following the sale of the individual’s mortgage to the organisation. 

The organisation advised that personal data was being withheld from the customer in line with Section 60(3)(b) of the Data Protection Act 2018 (DPA 2018). The organisation stated that “securitisation documents did not constitute [the complainant’s] personal data”. 

The DPC informed the organisation as to the definition of personal data under Article 4(1) of the GDPR and that if any of the stated documents being withheld contained the individual’s personal data, clarification would be required as to the reliance on the restrictions applied. The DPC received a response from the organisation confirming that no personal data existed in the securitisation documents with additional reference to a “final response letter” that it issued to the individual. Subsequently, the DPC requested a copy of this “final response letter” and requested a list of alleged outstanding personal data or any further information as to the location of records containing personal data from the individual. The DPC also requested the organisation to outline specifically each record containing personal data being withheld and the legislative basis for  doing so. 

The organisation initially advised it was relying on sections 60(3) and 60(7) of the DPA 2018 for not releasing the documents. The DPC further probed the restrictions being applied by the organisation. On foot of this engagement, the organisation confirmed to the DPC that it would no longer be relying on any part of Section 60 of the DPA 2018 to withhold the individual’s personal data. In light of the DPC’s intervention, the organisation furnished the individual with their personal data, which had previously been restricted.  Following this release of documents, the individual specified the existence of additional personal data and requested copies of mortgage statements from a specific year. The DPC queried this with the organisation, which then released this further personal data to the individual. The DPC determined that the organisation had failed to respond to the access request within the specified timeline under Article 12(3) of the GDPR. 

The DPC received a complaint from an individual in relation to an access request made to an internet service provider. According to the individual, they rang the company regarding the possibility of switching broadband services and considered that the level of service received from the customer service agent was unsatisfactory. As a result, they made an access request for a copy of their personal data processed by the company.  

 
In response to the individual’s access request, the company sought further information from the individual including an account number.  The individual informed the company they could not supply an account number, as they were not a customer, merely a potential customer enquiring about switching their broadband service. In their response, the company advised the individual that without an account number they could not process the access request. On foot of this response, the individual proceeded to make a complaint to the DPC. Following receipt of this complaint, the DPC corresponded with the internet service provider to ascertain why the access request could not be processed without an account number, and to comply with the individual’s access request. 

The company promptly responded to the DPC accepting that the agent who responded to the individual should not have informed them that they could not process the access request. They also outlined that the agent involved did not follow the correct process for dealing with access requests from non-customers, and advised that additional data protection training would be provided to the agent. The company also provided the individual with a copy of their personal data. The individual confirmed that while they did receive a copy of their personal data, the matter was only resolved following the DPC’s intervention.

An individual contacted the DPC inquiring about how to access the medical records of their late sibling, who had tragically passed away as an infant many
years previously. Since both parents had also passed away several years ago, the individual was unable to obtain information about the circumstances surrounding the death of their sibling.

The DPC recognises the sensitive nature of such queries and always responds with empathy and respect. In this instance, the individual was informed that, as per Article 4(1) of the GDPR, personal data is defined as “any information relating to an identified or identifiable natural person (data subject).” However, as also outlined in Recital 27 of the GDPR, the law does not apply to the personal data of deceased persons. Notwithstanding the sensitive nature of the query raised, the DPC advised that while the organisation may choose to release the data they were seeking, unfortunately as outlined above, the DPC could not compel them to do so as there was no obligation on the organisation to do so under the GDPR. As a result, the DPC advised that data protection law could not be engaged in relation the issue in question, meaning the concerns raised were beyond the DPC’s remit. Unfortunately, this meant the Office could not assist the individual further in this matter.

The DPC received a complaint with regard to an individual who made an access request under Article 15 of the GDPR to a public/state hospital for a copy of all personal information held concerning them. The response from the hospital remained outstanding after more than a month, whereas information provided to the DPC indicated that due the health of the individual this matter required urgent attention.  

The DPC contacted the Data Protection Officer for the Hospital Group by phone and email to inform them of the urgency of the complaint, and requested they respond to the individual’s representatives promptly, providing them with a copy of the individual’s personal information as part of the engagement. The hospital followed the instructions from the DPC.

Whilst the hospital acknowledged receipt of the request within one month of its receipt, the personal data the individual was entitled to was only provided to the individual following the intervention of the DPC.   

The complainant in this case was an employee who was the subject of disciplinary proceedings by their employer. An aspect of those proceedings concerned the complainant’s time keeping, and the employer sought to rely on swipe-card data derived from the complainant’s entry into and exit from the workplace during the relevant period. As a result of an internal appeal process, the employer subsequently agreed not to use the data for this purpose and removed it from the complainant’s disciplinary record. However, the complainant asked the DPC to continue its investigation of the complaint.

The DPC’s investigation focused on the data protection principle that data must be obtained and processed fairly . This includes an obligation to give data subjects’ information including the purpose or purposes for which the data are intended to be processed .

In this case, the employer had not informed the complainant of the use of swipe-card data for the purpose of disciplinary proceedings . (During the investigation, the employer informed the DPC that the complainant’s case was the only one in which it had used swipe-card data for disciplinary purposes .) Similarly, the employer had not informed the complainant or other employees that swipe-card data collected in the workplace was intended to be used for time-keeping purposes .

The employer had failed to inform the complainant about the use of swipe-card data for time-keeping and disci- plinary purposes . The DPC therefore concluded that the employer had not obtained and processed that data fairly .

This case demonstrates the importance of fairness and transparency in protecting data protection rights . Controllers such as employers may have valid legal bases for processing personal data, whether on grounds of performance of contract, legitimate interest or otherwise . However, the principles of data protection set out in Article 5 of the GDPR must be observed regardless of the legal basis that is relied on .