Subject Access Requests: 3 Filed, 0 Responses

The Requests

Critical SAR-001 MDE-SAR-001

Recipient Chancery Division, HMCTS (Rolls Building) Date Filed 20 February 2025 Statutory Basis UK GDPR Article 15 Deadline One calendar month from receipt (UK GDPR Art 12(3)) Days Overdue 390 days

What Was Requested

All personal data held by the Chancery Division relating to the Claimant.
Internal correspondence mentioning the Claimant by name or case number.
Emails between court staff regarding the Claimant's cases.
Records of reasonable adjustment requests and how they were processed.
Notes, annotations, or comments on any filing or application by the Claimant.
Records of transcript requests and their disposition.

What Was Received

Nothing. No acknowledgement. No response. No extension requested under Art 12(3). No refusal under Art 15(4). Complete silence.

Legal Consequence

Failure to respond to a SAR within one calendar month is a breach of UK GDPR Art 12(3). The controller did not respond at all, did not request an extension, and did not provide reasons for refusal. This is not a late response. It is no response. The ICO Regulatory Action Policy provides for enforcement notices, assessment notices, and monetary penalties for systematic failures to comply with data subject rights.

Critical SAR-002 MDE-SAR-002

Recipient The Insolvency Service Date Filed 10 March 2025 Statutory Basis UK GDPR Article 15 Deadline One calendar month from receipt (UK GDPR Art 12(3)) Days Overdue 369 days

What Was Requested

All personal data held by the Insolvency Service relating to the Claimant.
Internal communications regarding case CR-2024-000527.
Contact records between the Insolvency Service and any third party regarding the Claimant.
Records of communications with or about Mr Wheeler, insofar as they reference the Claimant.
Bank statements or financial records obtained or generated in relation to the Claimant.
Records of any decisions made about the Claimant's case and the basis for those decisions.

What Was Received

Nothing. No acknowledgement. No response. No extension. No refusal. The documents requested include internal communications that would confirm or contradict statements made by Mr Wheeler in court proceedings.

Legal Consequence

The Insolvency Service is a public authority subject to the UK GDPR, DPA 2018, and the PSED. The requested data includes records that are directly relevant to ongoing court proceedings. Failure to disclose may constitute both a data protection breach and a failure to comply with the duty of candour. If the records contradict statements made to the court, their suppression engages the court's jurisdiction over contempt.

Critical SAR-003 MDE-SAR-003

Recipient Department for Work and Pensions (DWP) Date Filed 18 February 2026 Statutory Basis UK GDPR Article 15 Deadline One calendar month from receipt (UK GDPR Art 12(3)) Days Overdue 27 days

What Was Requested

All personal data held by DWP relating to the Claimant for the entire claim period (February 2024 to present).
Internal emails and communications regarding WCA referrals and blocks.
Mandatory Reconsideration records, including the MR 'cleared in error' for 5 months.
All records relating to case manager Conor, including complaints and conduct notes.
Reasonable adjustment requests and their disposition.
Sanctions records, claim review records, journal entries, and all audit trails.

What Was Received

Nothing. DWP deflected to a generic GOV.UK form rather than acknowledging the SAR. A SAR is valid in any format under UK GDPR. The 30-day deadline expired 18 March 2026 with no compliance.

Legal Consequence

DWP is a public authority subject to the UK GDPR, DPA 2018, and the PSED. The requested data would prove a 2-year WCA delay (costing 9,300 LCWRA arrears), a retaliatory claim review initiated within 24 hours of the Claimant asserting disability rights, and the MR 'cleared in error' for 5 months. Deflection to a GOV.UK form is not a valid refusal under Art 12(3). The ICO Regulatory Action Policy applies. This SAR is also directly relevant to the pre-action protocol for judicial review filed on the same date.

Legal Basis

The right of access is one of the core rights under the UK GDPR. It is not discretionary. It is not dependent on the controller's convenience. It is a statutory obligation with defined time limits and enforcement mechanisms.

UK GDPR Article 15 (Right of access by the data subject)

Article 15(1) provides that the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and specified supplementary information. The right is unconditional. It does not require the data subject to give reasons. The controller must respond within one calendar month (Art 12(3)) or, in complex cases, may extend by two further months with notice. Neither controller provided any response at all.

UK GDPR Article 12(3) (Time limits for response)

Article 12(3) requires the controller to provide information on action taken on a request without undue delay and in any event within one calendar month of receipt. Where the controller does not take action, it must inform the data subject without delay and at the latest within one month, giving reasons and informing the data subject of their right to lodge a complaint with the ICO. Neither controller met any of these obligations.

DPA 2018 s.45 (Law enforcement processing)

Section 45 of the Data Protection Act 2018 provides rights of access in the context of law enforcement processing. To the extent that any data held by the Insolvency Service constitutes law enforcement data, the rights under Part 3 of the DPA 2018 apply in addition to UK GDPR rights. The Insolvency Service exercises statutory functions that may involve law enforcement processing under s.31 DPA 2018.

ICO Enforcement (UK GDPR Art 77, DPA 2018 s.165)

Article 77 of the UK GDPR and s.165 of the DPA 2018 provide that the data subject has the right to lodge a complaint with the ICO. The ICO may issue assessment notices (s.146 DPA 2018), enforcement notices (s.149 DPA 2018), and monetary penalty notices (s.155 DPA 2018). Systematic failure to respond to SARs may also be raised as an additional ground in judicial review proceedings, demonstrating a pattern of institutional non-compliance with statutory obligations.

The Pattern

Three public authorities. Three formal requests under UK GDPR Article 15. Three statutory deadlines passed. Zero responses. Zero acknowledgements. Zero extensions requested. Zero reasons given.

This is not administrative delay. This is institutional non-compliance. The data requested includes internal communications that are directly relevant to ongoing court proceedings. The failure to disclose is not neutral. It prevents the Claimant from accessing evidence that may support his case and may contradict statements made by institutional actors in court.

For a disabled litigant in person with ADHD, the administrative burden of enforcing data protection rights through the ICO complaints process, while simultaneously managing six cases across multiple courts, while managing an arrest warrant, while managing an insolvency petition, while managing a disability that affects executive function, is itself a form of structural disadvantage.

The system creates obligations that it then fails to meet. When the individual tries to enforce those obligations, the system creates further administrative burdens. The net effect is that the right of access under UK GDPR Article 15 is, for this individual, a right that exists in law but not in practice.

Statement of Truth

I believe that the facts stated on this website are true. I understand that proceedings for contempt of court may be brought against anyone who makes, or causes to be made, a false statement in a document verified by a statement of truth without an honest belief in its truth.

Michael Darius Eastwood

Litigant in Person

ADHD + ASD (Equality Act 2010 s.6) | HMCTS RA Ref: 67862925

London, United Kingdom

Subject Access Requests

Contents

The Requests

What Was Requested

What Was Received

Legal Consequence

What Was Requested

What Was Received

Legal Consequence

What Was Requested

What Was Received

Legal Consequence

Legal Basis

UK GDPR Article 15 (Right of access by the data subject)

UK GDPR Article 12(3) (Time limits for response)

DPA 2018 s.45 (Law enforcement processing)

ICO Enforcement (UK GDPR Art 77, DPA 2018 s.165)

The Pattern

Statement of Truth