Data sharing: MoD and Home Office ignored people's data requests - ICO

The Ministry of Defence and the Home Office are among seven organisations that have failed to respond to personal information requests.

The Information Commissioner's Office (ICO) says it is "calling them out" for ignoring the public when asked questions about the data they hold.

A Subject Access Request (SAR) must be responded to between one and three months.

The government departments repeatedly missed that deadline.

The ICO is an independent watchdog - its aim is to promote openness by public bodies and data privacy for individuals.

Other organisations that did not respond to requests were Kent Police, Virgin Media and the London boroughs of Croydon, Hackney and Lambeth.

This resulted in regulatory action including reprimands as well as practice recommendations issued under the Freedom of Information Act 2000.

Information Commissioner John Edwards told the BBC naming and shaming organisations that fail to comply is a new proactive way for the ICO to work.

"It's going to become more common - it's really important that people can have confidence in the administration of their information rights," he said.

"That's why we are publicly notifying these organisations that they have to bring themselves into compliance.

"Being able to ask an organisation 'what information do you hold on me' and 'how it is being used' provides transparency and accountability.

"These are fundamental rights - these are not optional."

The seven organisations were identified following a series of complaints related to their failure to respond within set timeframes, or failing to respond at all, as well as information being withheld, in breach of the UKGDPR and Data Protection Act.

'Emotional abuse'

Some of the complaints included requesting access to adoption papers where the person was told "no one seems to know where these are".

The person, who was anonymous, said: "I am upset and angry and just want my files."

Another related to an asylum application involving a child.

The complainant said: "All we need is the asylum transcript so we can submit a humanitarian application. However, we can do nothing without those transcripts.

"I have chased this matter for seven months and have received nothing. My client's child is constantly at risk so long as he stays in the home country."

And one example given was about access to files for someone who spent many years in care.

"The original paper file was destroyed previously so I cannot access any of my personal data relating to my childhood," the complainant said.

"The file contained sensitive details of trauma I suffered, and I feel now this emotional abuse cannot be answered for."

The ICO said it took regulatory action over infringements across 2020 and 2021 including:

• Ministry of Defence - 9,000 requests yet to be responded to. People were typically waiting over 12 months for their information.

• Home Office - failed to meet the deadline for responding to just under 21,000 requests. Complaints to the ICO showed complainants suffered significant distress as a result.

• Kent Police - some requests are reported to have taken over 18 months to issue a response.

• Virgin Media - over a six-month period in 2021, 9,500 requests were made and 14% were not responded to.

The organisations have between three and six months to make improvements or further enforcement action could be taken.

A Government spokesperson said: "We take our obligations under the Data Protection Act 2018 and UK General Data Protection Regulation very seriously, and we are working hard to remove delays to Subject Access requests identified by the Information Commissioner's Office.

A spokesperson for the MOD added: "Action is being taken to remove those delays through a significant increase in resources, but in the meantime urgent applications are being prioritised."

Meanwhile, a Virgin Media spokesperson told the BBC: "We apologise that our handling of subject access requests last year was not to the standard it should have been. We have since put measures in place which have significantly improved our performance and will continue to carefully monitor this."

A Croydon Council spokesperson said: "We apologise for any delays in our handling of Freedom of Information or Subject Access Requests and fully take on board the comments and feedback from the ICO.

"The council remains committed to high quality information governance and is currently rolling out an improvement plan to strengthen how we respond to requests under data protection law."

Kent Police told the BBC: "Kent Police is committed to discharging its responsibilities under the Data Protection Act and strives to ensure that all Subject Access Requests (SAR) are dealt with in a timely way.

"Recognising this as an area of business that needed improvement Kent Police requested that the Information Commissioner's Office (ICO) include a review of this area of business as part of the consensual audit which will be undertaken in early October 2022."

And a spokesperson for Hackney Council said: "Hackney is committed to transparency and ensuring we respond promptly to Freedom of Information requests and Subject Access Requests (where people request copies of information that the Council holds about them) is a priority for us.

"The Council has been working with the Information Commissioner's Office to keep them informed of the work we are doing. The recommendations that they have provided are in line with our existing action plans and we will review their advice carefully to identify where we might take additional steps to make sure we are achieving the level of performance that our residents rightly expect."

Follow Shiona McCallum on Twitter @shionamc