Guide
When a subject access request can be refused or cut down
Updated
Most responses that feel like a refusal are not one. They are a controller applying a specific exemption to part of the material and not saying which. Knowing the small number of routes available makes it much easier to tell an honest redaction from an unexplained one.
Manifestly unfounded or excessive
Article 12(5) makes free of charge the default. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either charge a reasonable fee taking into account the administrative costs, or refuse to act.
The sentence that follows is the one that matters: "the controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request". Demonstrating is a higher bar than asserting, and a response that says a request is excessive without saying why has not met it. Note also that the threshold is manifestly, not merely: a large request is not automatically an excessive one.
Other people's data
Article 15(4) provides that "the right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others". That is where redaction of colleagues' names, other customers' details and third-party correspondence comes from.
It is a balancing provision rather than a blanket one. It does not entitle a controller to withhold a whole document because somebody else is mentioned in it, and it does not extend to redacting the identity of people acting in a professional capacity as a matter of routine. The useful question to ask of a heavily redacted response is which right or freedom of which other person each redaction protects.
Confidential references
Schedule 2 paragraph 24 of the Data Protection Act 2018 disapplies the listed GDPR provisions for personal data consisting of a reference given, or to be given, in confidence for the purposes of the data subject's education, training or employment, their placement as a volunteer, their appointment to any office, or their provision of any service. Prospective cases are covered in every limb.
The exemption travels with the reference rather than with the organisation, so requesting it from the recipient instead of the author does not get round it. What it does not cover is the material around the reference: the decision, the correspondence about the process, and the fact that a reference was sought are not the reference.
The exemptions in the Act
Schedules 2 to 4 of the Data Protection Act 2018 carry the rest, and they are specific rather than general: crime and taxation, legal professional privilege, management forecasts, negotiations with the data subject, confidential references, and a long list of regulatory functions.
The important structural point is that they are exemptions from particular provisions for particular data, not permissions to ignore a request. A controller relying on one is still answering the request, still inside the deadline, and still obliged under Article 12(4) to tell you the reasons if it is not acting.