Data Protection Complaints and DSARs

This Q&A pulls together questions asked at our recent webinar ‘Data subject right to complain – managing in an employment context’ which provided practical guidance on the new statutory right to complain in data protection law, as well as wider issues arising from data subject access requests (DSARs).

This new right to complain introduces into law a right for any data subject to complain to a controller processing their personal data at any time, and for any valid reason. In turn, organisations must have a way of receiving and managing those complaints, providing an acknowledgement and outcome in the required timescales.

We predict that this will be another weaponised method of leveraging data protection rights against organisations to further the data subject’s issue, whether that be an employment complaint, a consumer issue or other challenge.

We focus below on the applicability to the employment relationship but the right and our advice around it applies to all circumstances.

Q&A

Data Protection Complaints: geographical applicability and legal position

add

Does the new right to complain about data protection apply only to DSARs made in the UK, or does it extend to DSARs made in EU jurisdictions?

It is in UK law only but there is not a strict geographical limit to the UK for the reasons below. In brief, it covers UK-located entities and people, but can cover non-UK registered entities if a test is met. It applies to any data protection complaint as well, not just DSARs.

The right to complain applies in UK law only (s164A of the Data Protection Act 2018 ("DPA")) and covers the UK GDPR (general data processing) and Part 3 of the DPA (law enforcement processing - i.e. the police and courts, for example). However, s4 of the DPA states that the DPA supplements and must be read with the UK GDPR. Our interpretation is that the right to complain therefore applies to all processing covered by the UK GDPR. In turn, the UK GDPR applies to all processing for entities with an establishment in the UK as well as those who are not established in the UK but offer goods or services (even free ones) or monitor individuals located in the UK. Therefore, some overseas entities will be caught, but it is unlikely that individuals making DSARs in EU jurisdictions will be covered by the new right to complain.

What is the difference between the new statutory right to complain and the previous right to complain?

Data subjects and their representatives have long complained about data protection issues, on a more informal basis – initially via the organisation in question, often with escalation to the ICO. The new right to complain brings the right to complain to organisations on a statutory footing, with specific investigation requirements and response timescales.

A future activation of part of the Data (Use and Access) Act by the Secretary of State would mean all controllers also have to report on the number of complaints received. We therefore recommend that you start to do this now in your systems or logs by way of best practice.

What are the penalties for non-compliance with the complaints process?

ICO: the usual investigation process would apply through letter questions, escalating through Information Notices, Assessment Notices, Interview Notices, Enforcement Notices and Penalties (to the usual data protection cap, but very unlikely to reach it). However, in line with DSARs, we would only expect this to take place for the most extreme examples of non-compliance. An additional action the ICO more often takes is the issue of a public Reprimand setting out (by way of publication) why a particular organisation must do better.
Employment Tribunal: the failure to operate the complaints process properly could be referenced, but the Tribunal does not have the jurisdiction to assess this.

Court: Court proceedings could be threatened, and such matters are sometimes settled, or strongly defended. A court could review the operation of the complaints process in the same way that they can now do so for a DSAR.

In summary, we'd primarily expect the complaints process to provide additional data subject leverage.

Data Protection Complaints: sequencing of complaints to controller and ICO

add

Data Protection Complaints: intake route

add

Can the right to complain be incorporated into an existing compliance speak-up line?

The intake can be done that way in terms of your preferred process, but you do need to ensure complaints can come through any route (as it may not be someone who knows about that) and that the speak up process incorporates the "must" requirements in the ICO's complaints guidance, along with the "shoulds" and "coulds" that you wish to adopt. The ICO's complaints guidance is on this and following pages: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/ It is our view that the ICO is likely to assess the operation of the complaints process against its guidance for simpler tests of whether that process has operated in accordance with its guidance.

Should the complaints process sit within the grievance policy or the privacy policy?

It can certainly be referenced in the grievance policy, but we would recommend it is referenced in all privacy policies, as you may receive complaints from individuals who are not employees.

The complaints process itself would then be a standalone document. The ICO guidance notes that there can be a publicly available version but also a more detailed operational internal version.

Does an existing grievance procedure or speaking-up policy satisfy the requirement for a data protection complaints process?

See answer above.

Is it acceptable to add “complaint” as an option on an existing DSAR request platform (e.g. OneTrust)?

That would be a valid intake route, but noting again that the complaints could come in via any route and it should be set out in all your privacy policies.

Is a monitored email address in the HR privacy policy sufficient for receiving complaints?

See answer above.

Are organisations required to have an electronic form for complaints, or are other methods (e.g. email) sufficient?

You must have some way of making complaints, but it does not need to be an electronic form - it can be by email, form, phone, online portal, live chat, in person etc. There just needs to be a publicised route to make a complaint.

Is it sufficient to provide an email address, postal address, and telephone line for complaints without a dedicated electronic form?

See answer above.

Do organisations with existing grievance and data management policies still need to update their processes for DSARs and complaints?

See above. In addition, your DSAR response letters are referenced in ICO guidance as needing to be amended to reference the right to complain to you.

Does an electronic complaint form need to be publicly available (e.g. linked from the privacy policy), or can it be provided upon receipt of a complaint?

You can choose to have an electronic form, and it can be public or provided on request, but you must facilitate the complaint coming in as explained in the answers above.

Data Protection Complaints: complaints process management

add

Who should investigate and respond to a data protection complaint — can the employment lawyer handling DSARs deal with it, or should it go to the DPO?

In terms of who reviews the complaint, this will depend on the process you have or put in place. Whilst the ICO's guidance doesn't say that the complaint is reviewed independently or at least by a different person or team, it would be logical for the DPO or other legal advisers familiar with data protection issues to review the complaint. We will be assessing complaints too in the same way that we conduct investigations, reviews, DSARs and other advice requirements for clients.

If the in-house legal or compliance team handles DSARs, who should handle the data protection complaint to avoid conflicts of interest?

Please see our answer above.

Is the DPO best placed to investigate complaints, and are there any conflict-of-interest concerns?

Please see our answers above. The DPO isn't conflicted as such as there are no independence requirements - but we would suggest that this is good practice.

If the complaint relates to the work of the person who would normally handle it (e.g. a one-person data protection team), who should investigate?

Please see our answers above.

If a grievance includes a complaint about a DSAR, can it be dealt with entirely as a grievance, or does the DSAR complaint need to be separated out?

We would recommend these being split out - the ICO's guidance refers to this taking place.

Does the right to complain apply only in the employment context, or can clients and other data subjects also use it?

Independent data controllers - Yes, any data subject can make a complaint to any organisation which is a data controller.

Processors - It may be that complaints are also received by organisations who are acting as processors (for example hosting providers/SaaS providers) - in which case they should forward the complaint received to the relevant controller in line with the obligations regarding data subject requests which should be in their controller-processor agreement.

Joint controllers should have an arrangement between them already setting out who is responsible for data subject requests, but this may need adjusting (in that arrangement and affected privacy policies) if this allocation is to change for complaints.

Grievances - AI impacts

add

Data Subject Access Requests (DSARs): reasonable and proportionate search and scope generally

add

What guidance is available on what constitutes a "reasonable and proportionate" search when responding to a DSAR?

The ICO sets out the test as follows in its guidance:

"To determine whether searches may be unreasonable or disproportionate, you should consider:

the circumstances of the request;
the volume of information you may need to search in order to respond;
any difficulties involved in finding the information; and
the fundamental nature of the right of access.

You must be able to show why a search is unreasonable or disproportionate."

We recommend conducting this assessment in real time (particularly taking account of the circumstances and data search size), documenting it via mapping it to the available evidence and justifications, and then playing back a summary of it to the data subject either during the DSAR timescales or certainly in the end covering letter.

How should organisations document what is "reasonable and proportionate" in terms of DSAR search scope?

See answer above.

How should organisations handle DSAR requests where the individual’s personal data appears in conversations between other people?

If this was in the form of recorded conversations e.g. transcripts of calls/teams messages etc. then they should be located, but subject to the above "reasonable and proportionate" search. The test will then be to apply the guidance on mixed personal data - i.e. the ICO sets it out here. We'd recommend assessing it (in summary form) for each redaction - though of course the third party's consent / refusal can be applied across all documents/redactions.

If a DSAR set of search results includes an email where the individual’s name is mentioned but it also contains unrelated business information, how should this be handled?

In this case we would recommend saying that what has been asked for is not his personal data and they are not entitled to request it. This can either be done during the process, as part of scoping, or at the end. We'd recommend doing so during the process unless there are specific reasons with that particular person as to why not.

Where there are ongoing internal processes (e.g. a whistleblowing investigation, grievance, or redundancy appeal), how risky is it to withhold documents that the individual has not yet seen?

If the reasons for holding the documents back can be validly applied to an exemption, then there is a risk of complaint but there should not be an underlying data protection compliance risk.

However, if the reason for holding them back cannot be validly applied to an exemption, then there is the risk of a successful complaint, with the complaint then providing additional leverage for the employee.

Are organisations using AI and automation to assist with DSAR responses, for example for large-scale redaction?

In part - the technology is developing and we often use AI for cross-checking consistency where we are dealing with multiple related DSARs at the same time. There is some redaction technology available, but it is not sufficiently mature to rely on it - redactions are an art not a science given the discretion you have in applying them. What we do see AI used for by some clients is deduplication and email threading, for example, to reduce the review bundle size and focus the review on key elements (again in line with the "reasonable and proportionate" search scope referred to above.

When should routine requests for personal data (e.g. copies of performance reviews) be logged as formal DSARs?

It is acceptable to deal with routine requests such as requesting a copy of performance reviews, employment contracts and payslips as non-DSARs. Here we would suggest you expressly say that you are dealing with them outside the scope of a DSAR process and as a routine employment support matter.

We would therefore agree with your logging of DSARs for the non-routine requests, as long as you apply the above.

Does any request for personal information have to be treated as a DSAR, or can it come only through specific channels such as the ICO?

Any request for personal information to a controller is to be taken as a DSAR, except where it can be categorised as a routine request as noted in the answer above.

Most DSARs do not come from the ICO, they can come in via any route – to any person in any form in your organisation. The ICO does operate a form for people to complete to then submit a DSAR but in our experience this tends to be the minority of requests received.

As referenced above, if you are acting as a processor for the personal data in question then you’d need to forward the request to the controller in question for them to deal with, and likely seek your assistance.

DSARs - review and redaction approach

add

DSARs - court scrutiny

add

DSARs - exemptions

add

DSARs - withdrawals of them prior to settlement agreements

add

Compensation for low-level data protection issues

add

Q&A

Data Protection Complaints: geographical applicability and legal position

Does the new right to complain about data protection apply only to DSARs made in the UK, or does it extend to DSARs made in EU jurisdictions?

What is the difference between the new statutory right to complain and the previous right to complain?

What are the penalties for non-compliance with the complaints process?

Data Protection Complaints: sequencing of complaints to controller and ICO

Can data subjects still complain directly to the ICO, or must they complain to the controller first?

Data Protection Complaints: intake route

Can the right to complain be incorporated into an existing compliance speak-up line?

Should the complaints process sit within the grievance policy or the privacy policy?

Does an existing grievance procedure or speaking-up policy satisfy the requirement for a data protection complaints process?

Is it acceptable to add “complaint” as an option on an existing DSAR request platform (e.g. OneTrust)?

Is a monitored email address in the HR privacy policy sufficient for receiving complaints?

Are organisations required to have an electronic form for complaints, or are other methods (e.g. email) sufficient?

Is it sufficient to provide an email address, postal address, and telephone line for complaints without a dedicated electronic form?

Do organisations with existing grievance and data management policies still need to update their processes for DSARs and complaints?

Does an electronic complaint form need to be publicly available (e.g. linked from the privacy policy), or can it be provided upon receipt of a complaint?

Data Protection Complaints: complaints process management

Who should investigate and respond to a data protection complaint — can the employment lawyer handling DSARs deal with it, or should it go to the DPO?

If the in-house legal or compliance team handles DSARs, who should handle the data protection complaint to avoid conflicts of interest?

Is the DPO best placed to investigate complaints, and are there any conflict-of-interest concerns?

If the complaint relates to the work of the person who would normally handle it (e.g. a one-person data protection team), who should investigate?

If a grievance includes a complaint about a DSAR, can it be dealt with entirely as a grievance, or does the DSAR complaint need to be separated out?

Does the right to complain apply only in the employment context, or can clients and other data subjects also use it?

Grievances - AI impacts

What impact is generative AI having on the volume of DSARs and grievance complaints?

Data Subject Access Requests (DSARs): reasonable and proportionate search and scope generally

What guidance is available on what constitutes a "reasonable and proportionate" search when responding to a DSAR?

How should organisations document what is "reasonable and proportionate" in terms of DSAR search scope?

How should organisations handle DSAR requests where the individual’s personal data appears in conversations between other people?

If a DSAR set of search results includes an email where the individual’s name is mentioned but it also contains unrelated business information, how should this be handled?

Where there are ongoing internal processes (e.g. a whistleblowing investigation, grievance, or redundancy appeal), how risky is it to withhold documents that the individual has not yet seen?

Are organisations using AI and automation to assist with DSAR responses, for example for large-scale redaction?

When should routine requests for personal data (e.g. copies of performance reviews) be logged as formal DSARs?

Does any request for personal information have to be treated as a DSAR, or can it come only through specific channels such as the ICO?

DSARs - review and redaction approach

When extracting personal data from documents for a DSAR response, is there a requirement to identify the source document, and what is the best way to do this?

DSARs - court scrutiny

Does the court’s power to scrutinise DSAR compliance extend to legally privileged material?

DSARs - exemptions

What are examples of DSARs that may be considered "manifestly unfounded” or “excessive”?

DSARs - withdrawals of them prior to settlement agreements

Should the withdrawal of a DSAR be documented separately from the settlement agreement?

In the context of a settlement agreement, what form should a request to withdraw a DSAR take?

Compensation for low-level data protection issues

Are there examples of compensation being awarded for lower-level data protection issues such as DSAR breaches, failures in impact assessments, or defective privacy notices?

Loading component...

Authors

Q&A

Data Protection Complaints: geographical applicability and legal position

Does the new right to complain about data protection apply only to DSARs made in the UK, or does it extend to DSARs made in EU jurisdictions?

What is the difference between the new statutory right to complain and the previous right to complain?

What are the penalties for non-compliance with the complaints process?

Data Protection Complaints: sequencing of complaints to controller and ICO

Can data subjects still complain directly to the ICO, or must they complain to the controller first?

Data Protection Complaints: intake route

Can the right to complain be incorporated into an existing compliance speak-up line?

Should the complaints process sit within the grievance policy or the privacy policy?

Does an existing grievance procedure or speaking-up policy satisfy the requirement for a data protection complaints process?

Is it acceptable to add “complaint” as an option on an existing DSAR request platform (e.g. OneTrust)?

Is a monitored email address in the HR privacy policy sufficient for receiving complaints?

Are organisations required to have an electronic form for complaints, or are other methods (e.g. email) sufficient?

Is it sufficient to provide an email address, postal address, and telephone line for complaints without a dedicated electronic form?

Do organisations with existing grievance and data management policies still need to update their processes for DSARs and complaints?

Does an electronic complaint form need to be publicly available (e.g. linked from the privacy policy), or can it be provided upon receipt of a complaint?

Data Protection Complaints: complaints process management

Who should investigate and respond to a data protection complaint — can the employment lawyer handling DSARs deal with it, or should it go to the DPO?

If the in-house legal or compliance team handles DSARs, who should handle the data protection complaint to avoid conflicts of interest?

Is the DPO best placed to investigate complaints, and are there any conflict-of-interest concerns?

If the complaint relates to the work of the person who would normally handle it (e.g. a one-person data protection team), who should investigate?

If a grievance includes a complaint about a DSAR, can it be dealt with entirely as a grievance, or does the DSAR complaint need to be separated out?

Does the right to complain apply only in the employment context, or can clients and other data subjects also use it?

Grievances - AI impacts

What impact is generative AI having on the volume of DSARs and grievance complaints?

Data Subject Access Requests (DSARs): reasonable and proportionate search and scope generally

What guidance is available on what constitutes a "reasonable and proportionate" search when responding to a DSAR?

How should organisations document what is "reasonable and proportionate" in terms of DSAR search scope?

How should organisations handle DSAR requests where the individual’s personal data appears in conversations between other people?

If a DSAR set of search results includes an email where the individual’s name is mentioned but it also contains unrelated business information, how should this be handled?

Where there are ongoing internal processes (e.g. a whistleblowing investigation, grievance, or redundancy appeal), how risky is it to withhold documents that the individual has not yet seen?