The Ministry of Justice has become the first central government department to be served with an enforcement notice by the Information Commissioner’s Office (ICO). It was rapped over the knuckles last month for delays in responding to ‘subject access requests’ - inquiries by individuals on data held about them. The Data Protection Act 1998 requires data controllers to respond to such requests 'without undue delay’.
According to the notice, dated 21 December, the information commissioner has considered 'a large number’ of complaints about the department’s handling of subect access requests. 'On 28 July 2017, the data controller had a backlog of 919 subject access requests from individuals, some of which dated back to 2012,’ the notice states. While progress had been made towards eliminating the backlog by October 2018, on 10 November 2017 the MoJ had 793 cases over 40 days old.
'The commissioner takes the view that damage or distress to individuals is likely as a result of them being denied the opportunity of correcting inaccurate personal data about them, which may be processed by the data controller, because they are unable to establish what personal data are being processed within the statutory timescale.’
The notice also cites article 8 of the European Convention on Human Rights, stating that the 'right to respect for private and family life, home and correspondence… has been unlawfully interfered with by reason of the failure of the data controller to respond to subject access requests in compliance with the DPA’.
Among other measures, the notice requires the secretary of state for justice to inform the individuals with outstanding requests by 31 October 2018 whether any personal data about them has been processed and to supply each of them with a copy of any such personal data so processed. The secretary of state must also provide the commissioner with a monthly progress report.
The serving of an enforcement notice on Whitehall is the latest indication of a tough approach by Elizabeth Denham, who took up the position of information commmissioner in July 2016. Over the past decade the ICO has issued some 155 enforcement notices, the largest number against marketing businesses. While 19 have been served on local authorities, this is the first against central government.
In a formal statement, the MoJ said: 'We have left no stone unturned in ensuring the historical backlog in responding to special access requests from offenders is addressed. The Information Commissioner has recognised our plan is robust and it is delivering results at pace and ahead of schedule.
'Given the marked improvements already brought about by our urgent action in this area, we are very disappointed the Information Commissioner has decided to take formal action at this time.
'We are committed to transparency and improving understanding of how the justice system works but the information we handle is often highly sensitive and we must weigh these interests with our responsibility never to put children, vulnerable victims, witnesses, staff or criminal investigations at risk.'