Subject Access Rights
23 November 2007
In the case of Ezsias v Welsh Ministers, the court considered how far organisations must go when complying with subject access requests. Upon receipt of a request for personal data, a data controller must take reasonable and proportionate steps to identify and disclose the data he is bound to disclose.
This differs significantly from the ICO's approach that only provision of a document need be proportionate, not the search for data. This decision will now allow organisations to justify limiting their search for personal data to that which is reasonable and proportionate.