The Court of Appeal has given its verdict on how far a data controller needs to go to comply with a data subject access request. The answer: pretty far. The impact: the motive of the data subject in making the request is irrelevant; the legal privilege exemption is not a catch all exemption; evidence must be put forward to rely on "disproportionate effort". The slight benefit: contrary to the Information Commission's Subject Access Code of Practice, the disproportionate effort ground may apply to searches for personal data, not just providing copies of data.
Over the past year or so, there’s been a decided upswing in the number of subject access requests made by individuals to organizations that crunch their data. There are a number of reasons for this,