Outcomes - Selected Case Summaries
Categories
Limitations to the right to access one’s own data
Informal Resolution | 29 March 2022
A complainant was dissatisfied with the response to a subject access request, i.e. a request for the individual’s own personal data. Under the DPA individuals have the right to access their own data, except where an exemption applies. In its response the data controller, a therapeutic services provider, had refused to provide the complainant with the requested information on the basis that it would require the disclosure of the personal data of another person, and in reliance on the medical exemption.
Discussions with the complainant and data controller led us to confirm that the response to the request was appropriate in the circumstances of the case, and that the refusal to comply was valid. The claimed exemption applied and the complainant was correctly denied access to the information requested.