The UK’s Labour Party has been issued a reprimand by the Information Commissioner’s Office (ICO) for failing numerous times to respond to requests from people seeking their personal information under the subject access request (SAR). In November 2022, 78% of the Labour Party’s 352 SAR requests received missed the maximum three-month time limit for a response, and over half of those requests were significantly delayed by over a year. The backlog of requests ensued after a cyber attack on the party in October 2021 led to an increase in public requests.
The ICO’s investigation followed over 150 complaints received regarding the Labour Party’s management of SARs between November 2021 and November 2022. Under data protection law, individuals have the right to ask organisations whether they are storing or using their personal information and to receive a copy of any personal information held. They also have the right to ask organisations to ensure accurate and up-to-date information and in certain cases, delete it.
The ICO’s investigation revealed that since November 2021, the Labour Party’s ‘privacy inbox’ had remained unmonitored, and approximately 646 additional SARs and 597 requests regarding personal information deletion remained unresolved. The Labour Party had not responded to any of these requests.
However, the Labour Party reported progress since the ICO’s engagement and took steps to address its backlog. It allocated more funds, assigned temporary staff members to tackle outstanding requests and implemented an action plan. According to Stephen Bonner, Deputy Commissioner at the ICO, organisations must respond to SARs within one month, which may be extended by two months in complex cases.
The ICO has advised the Labour Party to maintain adequate staffing levels to ensure timely SAR responses in the future and comply with data protection law. The ICO’s reprimand highlights the Labour Party’s failure to comply with legal obligations regarding SARs. The ICO recommends the Labour Party to follow the action plan to achieve compliance with the law. The Labour Party is expected to clear its SAR backlog and ensure prompt response to future SARs.
