Subject Access Rights

Bookmark and Share
23 November 2007

In the case of Ezsias v Welsh Ministers, the court considered how far organisations must go when complying with subject access requests. Upon receipt of a request for personal data, a data controller must take reasonable and proportionate steps to identify and disclose the data he is bound to disclose. 

This differs significantly from the ICO's approach that only provision of a document need be proportionate, not the search for data. This decision will now allow organisations to justify limiting their search for personal data to that which is reasonable and proportionate.

Search news archive