DATA PROTECTION ACT 2018 AND UK GENERAL DATA
PROTECTION REGULATION
REPRIMAND
The Information Commissioner (the Commissioner) issues a reprimand to
Norfolk County Council (the Council) in accordance with Article 58(2)(b)
of the UK General Data Protection Regulation in respect of certain
infringements of the UK GDPR.
The reprimand
The Commissioner has decided to issue a reprimand to the Council in
respect of the following infringements of the UK GDPR:
• Article 12 (3) which states ‘the controller shall provide information
on action taken on a request under Articles 15 to 22 to the data
subject without undue delay and in any event within one month of
receipt of the request. That period may be extended by two further
months where necessary, taking into account the complexity and
number of the requests. The controller shall inform the data subject
of any such extension within one month of receipt of the request,
together with the reasons for the delay. Where the data subject
makes the request by electronic form means, the information shall
be provided by electronic means where possible, unless otherwise
requested by the data subject’.
• Article 15 (1) which states ‘the data subject shall have the right to
obtain from the controller confirmation as to whether or not
personal data concerning him or her are being processed, and,
where that is the case, access to the personal data’.
• Article 15 (3) which states ‘the controller shall provide a copy of the
personal data undergoing processing’.
The reasons for the Commissioner’s findings are set out below.
Based on the findings of the investigation, the Council has only responded
to 260 out of 511 SARs within the statutory period of one or three months
during the period of 6 April 2021 to 6 April 2022. This could have had a
significant impact on the data subjects affected and we expect the Council
to take steps to improve its compliance in this area.
Mitigating factors
1
In the course of our investigation we have noted that the Covid – 19
pandemic has impacted the Council’s ability to access manual records due
to the lack of access to buildings which contributed to the backlog as staff
couldn’t access physical records when they formed part of a request.
Remedial steps taken by the Council
The Commissioner has also considered and welcomes the remedial steps
taken by the Council in the light of this incident. In particular it has taken
steps to increase its staff working on SARs and consolidated them into a
single, dedicated team which is solely focussed on SAR responses and
closing the backlog.
Decision to issue a reprimand
Taking into account all the circumstances of this case, including the
mitigating factors and remedial steps, the Commissioner has decided to
issue a reprimand to the Council in relation to the infringements of Article
12 (3), Article 15 (1) and Article 15 (3) of the UK GDPR set out above.
Further Action Recommended
The Commissioner recommends that the Council should take certain steps
to ensure its compliance with UK GDPR. With particular reference to
Articles 12(3) and 15 (1) and (3) of the UK GDPR, the following steps are
recommended:
1. The Council should take steps to ensure that SARs are responded to
within statutory deadlines.
2. The Council should ensure it has adequate staff resources in place
to process and respond to SARs. The ICO notes that the Council has
taken steps to ensure it has adequate staffing levels to manage its
SAR intake; however it considers the Council should continue to
review and monitor this.
3. The Council should ensure it continues to implement effective
measures to address its backlog.
The Commissioner requires the Council to provide details of the actions
taken to address the above recommendations within six months of receipt
of this reprimand, and by no later than Monday 6 November 2023.
2