Under the Data Protection Act 1998, data subjects have a right of access to their personal data. If a valid data subject access request is made, the data controller has to provide the individual with a copy of their personal data in permanent form unless supplying a copy would involve "disproportionate effort". The meaning of "disproportionate effort" was the subject of two Court of Appeal decisions earlier this year, in Dawson-Damer v Taylor Wessing LLP and Deer v University of Oxford.
The ICO has now updated its Subject Access Code of Practice (the Code) in light of those decisions. The earlier version of the Code said "We stress that you should rely on the disproportionate effort exception only in the most exceptional of cases. The right of subject access is central to data protection law and we rarely hear of instances where an organisation could legitimately use disproportionate effort as a reason for denying an individual access to any of their personal data. Even if you can show that supplying a copy of information in permanent form would involve disproportionate effort, you must still comply with the request in some other way".
The Code now confirms that the disproportionate effort exemption applies where supplying a copy of data would result in so much work or expense that this outweighs the data subject's right of access. Data controllers can also take into account difficulties in locating the requested information in assessing whether disproportionate effort is involved. However, the burden of proof remains on the data controller to show that it has taken all reasonable steps to comply with a subject access request, and that it would be disproportionate in all the circumstances to take any further steps.
The Code recommends engaging with the data subject to discuss the information that they require in order to reduce the costs and effort involved in searching for information. Willingness to engage with the data subject could be taken into account if the data subject complains to the ICO about a breach of their subject access rights.