The Irish Data Protection Commission (DPC) has issued guidance on the implications of COVID-19 on Data Subject Access Requests (SARs) (see https://dataprotection.ie/en/covid-19-and-subject-access-requests).
While the statutory obligations to comply with SARs are not waived during the COVID-19 outbreak, organisations will take solace that the DPC will take into account the extenuating circumstances and the documented reasons for the delay should it receive a complaint from a data subject.
Specifically, the DPC issued the following advice:
- To data subjects – the DPC has asked them to appreciate that some organisation (such as healthcare providers and Government departments) may need to divert resources to priority work areas while others may be closed or have reduced capacity. This means that responding to SARs may be significantly delayed. The DPC has asked data subjects to take this into account should they experience any delay. It also reminded data subjects to be as specific as possible in relation to a SAR.
- To organisations - while appreciating the challenges facing organisations, the DPC has asked those experiencing difficulties in responding to SARs to communicate with the data subject about the request, including any extension to the period for responding and the reasons for the delay in responding. Where possible, it suggests that organisations consider responding to requests in stages. For example, if staff working remotely have difficulties in accessing hard copy records, it may be possible to provide the data subject with electronic records, with hard copies being provided at a later stage. The DPC also suggests that organisations engage with a data subject in order to ensure that the SAR is as specific as possible. If an organisation cannot respond to a SAR (whether in full or in part) within the statutory timelines because of COVID-19, the DPC points out that they still remain under a legal obligation to do so and the SAR should therefore be actioned as soon as possible. For accountability and transparency purposes, the DPC encourages organisations to document their reasons for not complying with the timelines and clearly communicate these reasons to the data subject.
For more information please get in touch with Maureen Daly (Data Protection).
To discuss any other COVID-19 related issues impacting your business, please get in touch with Barry Cahir (Litigation and Insolvency), Thomas O'Dwyer (Litigation), Sharon Delaney (Litigation), Dorit McCann (EU, Competition & Procurement), Damian Maloney (Corporate and Commercial), Aidan Marsh (Commercial Property), Gerry Gallen (Commercial Property), Sandra Masterson Power (Employment), Paul Gough (Employment), Edward Evans (Corporate & Commerical), Fidelma McManus (Housing) or your usual Beauchamps contact.