Accuracy is critical and the work is time-sensitive.
This all means that it has been highly unusual if not non-existent – in our experience at least – for our larger clients to try to manage this work in-house, even during the Covid-19 pandemic.
Fighting for your rights
>With staff working from home, new cyber security risks are arising and the requirement to comply has not changed.
There were many predictions around this time two years ago that after the DPA 2018 and GDPR came into force, individuals would start to avail themselves of some of the new data rights afforded by the law and that individuals would start to exercise these new rights assertively at scale.
These new rights include the right to data portability (i.e. to move data in a structured form from one organisation to another) and the right to data correction (i.e. to have data corrected).
In reality, we have seen little evidence of these being asserted in any appreciable volume.
Individuals do make ‘subject access requests’ to request a copy of their personal data from organisations but this also happened under the old legislation, although requests were previously slightly curtailed by the frequent need to pay a modest fee.
It is no longer possible for organisations to charge a modest fee when responding to a request.
In the current circumstances of the Covid-19 pandemic and lockdown, a lot more personal data is being generated electronically and stored since staff are working from home communicating by email or via messaging platforms, rather than communicating in an office face-to-face.
This increase in the volume of personal data to be released means that subject access requests are requiring more time.
The future and next steps
With staff working from home, new cyber security risks are arising and the requirement to comply has not changed.
As a result of this, data protection policies and IT security risk assessments should be reviewed and updated to reflect the new status-quo and institutions may wish to take the time now to review their procedures for responding to a data breach.
Alex Matheson is an associate and Annette Fong is head of compliance services at Ince
