HM Courts and Tribunals Service
Chancery Division, Rolls Building
Tracking all Subject Access Requests filed under UK GDPR Article 15. Every request, every deadline, every non-response. Public bodies have 30 calendar days to respond. None have complied.
| Body | Date Filed | Deadline | Status | Days Overdue |
|---|
The right of access under UK GDPR Article 15 is a fundamental data protection right. It is not discretionary. It is not dependent on the controller's convenience. It is a statutory obligation with defined time limits and enforcement mechanisms.
Article 15(1) provides that the data subject has the right to obtain from the controller confirmation as to whether personal data concerning him are being processed, and where that is the case, access to the personal data and specified supplementary information. The right is unconditional. The controller must respond within one calendar month (Article 12(3)). If the controller does not take action, it must inform the data subject without delay, giving reasons, and informing the data subject of their right to lodge a complaint with the ICO.
The controller must provide information on action taken without undue delay and in any event within one calendar month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. But the controller must inform the data subject of any such extension within one month of receipt, together with the reasons for the delay. None of the controllers below met any of these obligations.
Section 45 of the Data Protection Act 2018 provides rights of access in the context of law enforcement processing. To the extent that any data held by the Insolvency Service constitutes law enforcement data (given its exercise of statutory investigative functions), the rights under Part 3 of the DPA 2018 apply in addition to UK GDPR rights.
UK GDPR Article 77 and DPA 2018 s.165 provide that the data subject has the right to lodge a complaint with the ICO. The ICO may issue assessment notices (s.146 DPA 2018), enforcement notices (s.149), and monetary penalty notices (s.155). Systematic failure to respond to SARs may also be raised as an additional ground in judicial review proceedings, demonstrating a pattern of institutional non-compliance with statutory obligations. The ICO Regulatory Action Policy identifies repeated or wilful non-compliance as an aggravating factor.
For a disabled litigant in person, the SAR process serves a dual purpose. It is both an exercise of the fundamental right of access under data protection law and a reasonable adjustment under EA 2010 s.20. Access to institutional records enables a disabled litigant to understand what decisions were made about his cases and why, reducing the substantial disadvantage that arises from having to litigate against institutions that hold all the records. The failure to respond to SARs therefore engages both data protection and equality law.
The Information Commissioner's Office (ICO) is the independent authority responsible for enforcing data protection law in the United Kingdom. Where a public body fails to respond to a SAR, the following enforcement pathway is available.
I believe that the facts stated on this website are true. I understand that proceedings for contempt of court may be brought against anyone who makes, or causes to be made, a false statement in a document verified by a statement of truth without an honest belief in its truth.
Michael Darius Eastwood
Litigant in Person
ADHD + ASD (Equality Act 2010 s.6) | HMCTS RA Ref: 67862925
London, United Kingdom