Expert’s Blog: An Outbreak of SARS

June 20 13:56 2017 Print This Article

Are you expecting an increase in Subject Access Requests (SARs) after May 2018? You should be, but how big an increase? DAC Beachcroft, the legal firm acting for a number of Financial Services in London, estimate an increase of 25-40%.

That sounds reasonable for the year to May 2019, but I expect numbers of SARs to rise by a factor of ten in the five years to May 2023 – I wouldn’t be surprised to see the number of SARs to balloon by a factor of 20 in that time period. GDPR puts power into the hands of the people and they might not be aware of it initially, but knowledge will spread and use of the SAR will grow.

Several factors will fuel this explosive growth.

Firstly, Article 12.5 makes a SAR free for a data subject. This is a step change from the £10 fee chargeable under the Data Protection Act (DPA) in the UK. £10 doesn’t cover the business cost of complying with a SAR, but it does have a deterrent effect on punitive, speculative or frivolous requests. Making them free removes this deterrent.

Had a bad customer experience with a company? From May 2018 you can express your disapproval by giving them some work to do. A cursory scan of online review sites like Trustpilot will identify companies with poor CX scores, and these are the sites that will suffer from punitive use of SARs.

Secondly, Article 82 provides the right of compensation. No court case or judgement is required. If you’ve been wronged, you have the right to receive compensation.

Thirdly, Article 82.1 also refers to “material or non-material damage” being grounds for compensation. Legal guidance I’ve received suggests that data subjects may only have to prove ‘distress’ in order to claim compensation, which is a relatively low bar to clear.

So if your rights have been infringed you might get compensation, and it’s free to check. This reminds colleagues in the UK financial sector of the PPI mis-selling scenario. Speculative SAR anyone?

Lastly, frivolous requests. Submitting a SAR is time consuming right?

Well … there’s an app for that. Or there will be by next May. I’m aware of two mobile apps in development for submitting SARs. Article 12 requires controllers to provide modalities for the exercise of data subject rights. That should make it easier to submit them.

So to recap, SARs will be free, easy and data subjects might earn money from them. Expect a rash of them to treat.

  Article "tagged" as:
view more articles

About Article Author


View More Articles
write a comment


No Comments Yet!

You can be the one to start a conversation.

Add a Comment