Via email:
Case Reference Number
Dear Sir/Madam,
Thank you for your recent correspondence, received 8 March 2019, with regard
to the data protection complaint that has been raised with the ICO about how
has handled an
information rights request submitted by .
Your organisation’s response
In your reply, you have provided the ICO with a full chronology showing how this
request has been dealt with.
Following ’s chaser emails of 5 January and 15 January 2019, you have
stated that liaised internally after having noted that had yet to
complete the necessary identification verification checks.
approached via email on 23 January and later via email and phone on 31
January in order to pursue this matter further.
Unfortunately, it would seem that these emails were sent to ’s spam
folder and were not seen for some time. only confirmed his identity via
phone on 6 February, more than one month after he was initially asked to do so.
Upon its receipt of this, your organisation escalated his request promptly and
supplied him with an encrypted file containing his personal data via email on 15
February. A decryption password was sent separately to him on 28 February after
he confirmed that he would be happy to receive this to the same email address.
Our view
I have considered the information available in relation to this data protection
complaint and I am of the view that has complied with its obligations
under data protection law in this instance.
Page 1 of 2
I believe it would have been better practice for your organisation to have given
the option of confirming his identity via email when
acknowledged his right of access request on 4 January, rather than directing him
towards . However, the ICO recognises that
proceeded to contact again shortly after it received his second chaser
email of 15 January and responded well within the statutory calendar-month
timeframe once the required identity checks had been completed.
Consequently, we do not propose to take any further regulatory action on this
matter.
Thank you for your assistance in addressing this data protection complaint.
Should you wish to discuss this case any further, or require any clarification,
please do not hesitate to contact me.
To correspond with me via email, you can forward any messages to our
[email protected] email address with the above case reference in this format
[ ] in the subject line.
Yours faithfully,
Case Officer
Information Commissioner’s Office
Direct dial number:
You should be aware that the Information Commissioner often receives requests for
copies of the letters we send and receive when dealing with casework. Not only are we
obliged to deal with these in accordance with the access provisions of the data protection
framework and the Freedom of Information Act 2000, it is in the public interest that we
are open and transparent and accountable for the work that we do.
For information about what we do with personal data see our privacy notice at
www.ico.org.uk/privacy-notice .
Page 2 of 2