What is a manifestly unfounded or excessive SAR?

[garbage46]

Is there any guidance or case law on what is a manifestly unfounded or excessive subject access request?

 

Thoughts on what is excessive in terms of number of documents and emails to refuse a non-vexatious SAR.... 10,000 emails? 25,000? 100,000?

 

Are there any examples you have found that establish criteria for refusal to comply with SAR unless the scope is reduced?

[synaesthesia]

I've not seen any guidelines and I suspect it may be a matter of percentages; i.e. if you're part of a large trust or school with plenty of staff or dedicated staff for data protection & administration, you may be expected to go to more trouble than a standalone 1 form entry primary school where everything is done by a business manager for example. Yes they'd still have a DPO usually outsourced to a 3rd party, but I wouldn't have thought they would be responsible for the redaction of data...

[dmj]

A sensible email deletion policy helps here. If you don't keep the data you can't release it - saves everyone a lot of time.

[localzuk]

A sensible email deletion policy helps here. If you don't keep the data you can't release it - saves everyone a lot of time.

Aye, but at the same time you have a legal duty to retain certain types of information, so you have to pair that deletion policy with a policy to make sure you're not deleting stuff you should keep.

[steveg]

I think it has to be really over the top to be considered excessive. The biggest one we dealt with here (Large ish Primary school) cost us around £4500 in labour to complete.

[dmj]

Aye, but at the same time you have a legal duty to retain certain types of information, so you have to pair that deletion policy with a policy to make sure you're not deleting stuff you should keep.

 

The legal stuff should really be kept out of the email system (or at least the important bits should be copied out ) into a dedicated child protection or SEN database. Ideally the MIS should do this role, but they rarely do a decent job IMO.

[synaesthesia]

I think it has to be really over the top to be considered excessive. The biggest one we dealt with here (Large ish Primary school) cost us around £4500 in labour to complete.

 

In the grand scheme of thins that's not a huge amount, but who was involved in that? Anyone from the school itself to determine what is suitable? As that takes them off their own job... (asking as it may be relevant to something else )

[steveg]

In the grand scheme of thins that's not a huge amount, but who was involved in that? Anyone from the school itself to determine what is suitable? As that takes them off their own job... (asking as it may be relevant to something else )

 

We buy an advisory service from the LEA, who oversaw the process, but all of the actual work collating and redacting the information was done by staff from the school. Other staff had to accept a reduction in IT and admin services while it was completed.

[synaesthesia]

We buy an advisory service from the LEA, who oversaw the process, but all of the actual work collating and redacting the information was done by staff from the school. Other staff had to accept a reduction in IT and admin services while it was completed.

 

Aye, that's where the real "cost" is

[GrumbleDook]

Aye, but at the same time you have a legal duty to retain certain types of information, so you have to pair that deletion policy with a policy to make sure you're not deleting stuff you should keep.

 

Roughly translated ...

 

Have a records management and retention policy, which makes sure you store information in the relevant system and it is then removed from the 'transitory / transport' mechanism (email, memo, hard copy of letter, etc.)

[localzuk]

I'm sure you realise that many schools use their email solution as that "relevant system" also? I don't think I've ever been in a school where admin/management staff don't have a million folders in their email client, with stuff carefully sorted into it.

[MartinT]

I'm sure you realise that many schools use their email solution as that "relevant system" also? I don't think I've ever been in a school where admin/management staff don't have a million folders in their email client, with stuff carefully sorted into it.

 

Our retention policy allows for a maximum retention of 7 years in any folder. Only contacts last longer at 15 years.