Dealing with data requests

Com­pa­nies of all sizes have been deal­ing with Data Sub­ject Access Requests (DSARs) since the intro­duc­tion of the Data Pro­tec­tion Act in 1998. These allow an indi­vid­ual to request a copy of any per­son­al data that an organ­i­sa­tion holds on them, but since May the Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) has made some sig­nif­i­cant changes, espe­cial­ly on how busi­ness­es must respond.

Before the new GDPR regime came into force, busi­ness­es had 40 days to com­ply with requests, which has now been reduced to one month, and com­pa­nies can no longer charge a £10 fee for each DSAR. Most impor­tant­ly, from a finan­cial per­spec­tive, the fines for fail­ure to com­ply with a request have increased sub­stan­tial­ly.

“If an organ­i­sa­tion fails to com­ply with a DSAR, then they could be fac­ing steep fines. The fines should be imposed on a case-by-case basis and take into con­sid­er­a­tion what each case involves, but they must be ‘effec­tive, pro­por­tion­ate and dis­sua­sive’,” explains Mark Ander­son, senior project con­sul­tant at lead­ing end-to-end eDis­cov­ery com­pa­ny Com­plete Dis­cov­ery Source (CDS).

Under GDPR, penal­ties can be as much as €20 mil­lion or 4 per cent of annu­al turnover, whichev­er is greater. In cer­tain cas­es there can also be crim­i­nal lia­bil­i­ty and rep­u­ta­tion­al dam­age for being named as one of the first com­pa­nies to fall foul of the rules. Yet, accord­ing to Mr Ander­son, not enough busi­ness­es know the ins and outs of DSARs until they actu­al­ly receive one.

For exam­ple, firms should be able to allow DSAR requests elec­tron­i­cal­ly and have pro­ce­dures in place to act on a request almost imme­di­ate­ly. “As there is only a one-month turn­around, every day real­ly counts. You don’t want to be spend­ing the first week of a request work­ing out how to deal with it or under­stand­ing what one is,” says Mr Ander­son.

Organ­i­sa­tions should be proac­tive­ly prepar­ing for receiv­ing a DSAR, and get a clear sight and an in-depth knowl­edge of their sys­tems. There should also be work­flows in place that can quick­ly iden­ti­fy per­son­al data and answer ques­tions like “Is HR using a doc­u­ment man­age­ment sys­tem that stores data?” and “Could employ­ees have been tex­ting each oth­er per­son­al infor­ma­tion on busi­ness devices?”

Mr Ander­son says: “It’s quite sur­pris­ing how many busi­ness­es don’t know exact­ly where their emails are stored or what sys­tems they use inter­nal­ly. So hav­ing a spe­cif­ic per­son such as a com­pli­ance offi­cer or IT spe­cial­ist with­in the organ­i­sa­tion who can say ‘we have this num­ber of sys­tems and this is where data is stored’ is key.”

Organ­i­sa­tions should be proac­tive­ly prepar­ing for receiv­ing a DSAR and get a clear sight and an in-depth knowl­edge of their sys­tems

Even for organ­i­sa­tions with strong IT resources, it often proves dif­fi­cult to cre­ate a DSAR frame­work from scratch or reply to an unex­pect­ed request with­in the dead­line. But com­pa­nies such as CDS are able to sup­port busi­ness­es through the DSAR process by employ­ing advanced ana­lyt­ics to look at the tex­tu­al con­tent of all poten­tial doc­u­ments that may need to be dis­closed and there­by reduce the amount of infor­ma­tion that has to be reviewed.

“We start by work­ing with clients to iden­ti­fy, col­lect and extract rel­e­vant per­son­al data through a process called data-map­ping. Once this data is extract­ed, we then process the data to make the required doc­u­ments search­able and run a process called de-dupli­ca­tion, so we only pro­vide one copy of each doc­u­ment. We then utilise ana­lyt­i­cal tools to reduce the doc­u­ment pop­u­la­tion by remov­ing fur­ther duplica­tive data,” says Mr Ander­son.

The risks of going it alone when deal­ing with a DSAR need to be con­sid­ered. Not hav­ing the right tools in place to dis­cov­er which doc­u­ments need to be pro­vid­ed can lead to either an under-dis­clos­ing or over-dis­clos­ing of per­son­al data.

“One of the com­pli­ca­tions with a DSAR is that you can’t dis­close anoth­er individual’s per­son­al data to the requester. By using our redac­tion tool kit, we allow a com­pa­ny to redact a user’s per­son­al infor­ma­tion elec­tron­i­cal­ly, either man­u­al­ly or through auto­mat­ed tools. This helps to stream­line the entire process to meet the tight time­frame,” Mr Ander­son con­cludes.

For more infor­ma­tion please vis­it cdslegal.com