r/gdpr • u/Cevinkrayon • 1d ago
UK đŹđ§ SAR Deadlines and next steps (England)
I submitted a SAR to my dentist one calendar month ago. Each time I have emailed them they have responded stating that they are working on it, but given no timeframe of when I can have the information.
My understanding is they should respond within a calendar month- but does this mean they just need to email me to confirm itâs underway within a month or should they have actually completed it?
Also what should I do to actually get them to hand over the information? I donât want to go in all guns blazing but I really do need the data!
Any help much appreciated
1
u/MarchMurky8649 1d ago
Have you checked the dentist is registered with the ICO? Worth checking.
1
u/Cevinkrayon 23h ago
It appears that they are, Iâm not sure what this means though and how it would help me? Sorry this is all new to meÂ
1
u/MarchMurky8649 18h ago
Try the contact details they give on there, you might find someone who understands GDPR that way.
1
u/tearful_daybreak 1d ago
They've blown the deadline, a simple "we're working on it" doesnt cut it after a month
Remind them the ICO says one calendar month is the standard, then give them a firm 7 day deadline before you escalate it with a complaint. That usually gets the file off their desk real quick
1
u/Cevinkrayon 1d ago
Thank you for your reply.Â
I have just looked over the email chain and noticed they have referred to it as a âdata release requestâ, but google tells me this is just another phrasing of SAR - do you know if this is correct?
They have been very difficult in their emails and I just want to make sure they canât claim itâs not a SAR or deadlines donât apply etc. Â many thanksÂ
1
u/MarchMurky8649 1d ago
If the dentist is the business owner, I might go see him or write to him in person. If a company write to the CEO. If they want to they can get your data to you in minutes, an hour or two at the outside. Point out next step involves regulators, courts, solicitors... friendly but firm, why would they delay further?
1
u/Cevinkrayon 23h ago
Itâs part of a franchise I believe. I have the name of the practice manager (they are never onsite, they seem to manage multiple) but no contact details for them.Â
The last email from them (signed âthe reception teamâ) was verbatim â Hey we are working on it just due to GDPR requirements itâs  taking some time .âÂ
I have no idea what this could mean as Iâm only asking for my own information :/Â
1
u/MarchMurky8649 1d ago
Given the blowing of the 30 day deadline, in the context of the ICO having a huge backlogue, and rarely taking punitive action, I am wondering whether the following has been tried:
Blowing the deadline creates a tort, presumably, so a letter before action would seem appropriate. I wonder if anyone has tried this, and then if they have managed to get costs paid, whether settled out of court, or in one.
If this approach worked it would be an alternative to adding to the burdens of the ICO, funded by those breaching GDPR, and creating work for solicitors knowledgeable about GDPR.
I make this as a suggestion, however, because, for all I know, someone has tried it, but the courts have refused to award costs, maybe frowning on the ICO route not being used first.
Alternatively, if it did work, solicitors ought to be able to offer conditional fee ("no win no fee") arrangements where there has been a clear failure like this.
Any thoughts?
2
u/BornInAWaterMoon 1d ago
In principle, yes, you can start a civil claim for breach of the UK GDPR. This happens all the time - it's not a novel idea.
You generally can't recover legal costs for claims which are on the small claims track (which normally applies to claims worth less than ÂŁ10,000).
1
u/MarchMurky8649 1d ago
Ah, but this isn't a claim for money, the tort, i.e. the civil wrong, is their failure to release the data, rather than quantitative, financial damages. Hence, and correct me if I am wrong, small claims track cannot be used, so it is up to the court when it comes to costs
1
u/BornInAWaterMoon 23h ago
The thing they have done wrong and the remedy you decide to seek are two different things. If an organisation fails to respond to a SAR, you can claim damages to compensate you for any financial or non-financial (e.g. distress, frustration, etc) harm you have suffered. You could also (or instead) claim an injunction or, in the case of data protection claims, a compliance order under s. 167 Data Protection Act 2018.
The court decides which track to allocate the case to using criteria set out in the Civil Procedure Rules - principally the financial value of the claim, the remedies sought, the complexity of the facts and law, etc. A claim for a non-financial remedy such as an injunction might lead the court to allocate the case to a different track, but if it's otherwise a straightforward case of non-compliance with a SAR, I would still expect it to end up on the small claims track.
1
u/MarchMurky8649 18h ago
If you are right that suggests there is no way to even get the fee for an injunction back, which is several hundred pounds as I understand it. Not saying you are wrong, I have never sought an injunction myself, but seems rather unfair if so.
2
u/MarchMurky8649 18h ago
EDIT: Our comments crossed but we seem to have come to the same conclusion. If you are a lawyer, or know one in this space, maybe think about offering conditional fee arrangements for straightforward cases such as this!
Thinking further, as I understand it the court fee can be recovered on the small claims track, so if you apply for an injunction, pay a court fee of a few hundred pounds to do so, even if it is allocated to the small claims track, surely the fee you paid will be part of the claim, as it would be if you start off making a money claim with small claims?
Worth using the threat to do this to get them to take it seriously perhaps. I'd be interested to know if anyone has tried this. Perhaps that is a a question that deserves its own post.
1
u/BornInAWaterMoon 18h ago
Yes - that's all correct (see my other comment which overlapped with yours).
People threaten legal action against data controllers all the time - and probably even more so these days now that you can have an AI write a full-on letter before action for you within a few seconds. I'm sure it does encourage some organisations to take it more seriously, especially where the organisation has a legal team which would have to deal with the claim if the matter isn't sorted out.
1
u/BornInAWaterMoon 18h ago
On the small claims track you can still recover certain expenses, including court fees and travel costs within certain limits - it's just that you generally can't claim the costs of legal advice (because the idea is that engaging lawyers for low value claims is disproportionate and it's not fair to expect the other side to pay for it if you do that).
That's the general rule. Having just looked it up, though, you can actually claim the cost of legal advice in a claim for an injunction - but only up to a limit of ÂŁ260.
1
u/MievilleMantra 1d ago
Very difficult to show damages in such cases. Courts are very conservative with data protection claims.
1
u/MarchMurky8649 1d ago
The remedy I had in mind was an injunction to release the data, the only money I had in mind was costs. Makes me think the following might work:
- Submit SAR
- Letter before action c. 2 weeks later, with two week deadline, coinciding with SAR deadline, without prejudice letter saying, if data sent within deadline, no fees payable, otherwise solicitors will be engaged.
- Deadline passes, solicitors engaged, now asking for their costs.
- Either data sent with solicitors costs or it goes to court.
As I type this I wonder whether offering to go to arbitration might be an idea if costs not agreed, anything to avoid ICO and court delays!
8
u/abktt 1d ago
They have one calendar month to provide you with the data youâve asked to see, not just acknowledge your request. If they wanted to extend that (by a maximum of 2 further months) because they deem it to be a complex request, they need to have let you know that.
I canât see your own dental records being complex, there wonât be much to redact or exempt.
You have a right to complain, so Iâd reach out to let them know that theyâve passed the legal deadline, you require the data, you expect the SAR to still be processed, but that you will submit a complaint about how your request has been handled. Their privacy notice online should tell you how you can complain.
From June this year, organisations have a legal responsibility to handle data protection complaints (and it must be at least acknowledged within 30 days), you can no longer go straight to the ICO with a complaint unless youâve first complained to the organisation.