The ICO makes the point that the number of SARs is bound to go up so get your house in order now…:
Anyone in the UK has the legal right to find out what information is held about them by organisations and ask for a copy free of charge within one calendar month. This is known as a subject access request (SAR).
Accessing personal data in this way has always been a cornerstone of data protection, strengthened last year by the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA2018).
As people become more aware of their information rights, we recognise there has been a significant rise in SARs across all sectors, including to police forces and other law enforcement agencies. And we are also aware of the administrative impact of the increased workload on police forces in responding to these requests. But this should not come at a cost to people’s data rights.
Most recently, the ICO has been working with the Metropolitan Police Service (MPS) to address its large SARs backlog. However, in a recent report to us the MPS indicated it had more than 1,100 open requests – with nearly 680 over three months old, this is a cause for concern.
In short, the MPS has failed in its data protection obligations by not responding to SARs within a calendar month and we have issued two enforcement notices ordering the MPS to respond to all requests by September 2019.