Unreasonable SAR requests

[PotNoodleTech]

Hi All

 

How do you deal with totally unreasonable SAR requests I.e someone just wants all data , no date range, no reason or specific information required - just everything.

 

Asking for a friend who's Business Manager is off.

 

Thanks

[haci]

https://ico.org.uk/for-organisations/foi-eir-and-access-to-information/guide-to-freedom-of-information/refusing-a-request/?q=Section%2B14

 

I would suggest that requesting all data that the school has would fall under It would cost too much or take too much staff time to deal with the request.

[mavhc]

"you can charge a 'reasonable fee' for the administrative costs of complying with a request if it is manifestly unfounded or excessive"

 

"You should make reasonable efforts to find and retrieve the requested information. However, you are not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to the information."

 

"Can we ask for ID?

Yes. You need to be satisfied that you know the identity of the requester (or the person the request is made on behalf of). If you are unsure, you can ask for information to verify an individual’s identity"

 

"What about requests for information about children?

Before responding to a SAR for information held about a child, you should consider whether the child is mature enough to understand their rights. If the request is from a child and you are confident they can understand their rights, you should usually respond directly to the child. You may, however, allow the parent or guardian to exercise the child’s rights on their behalf if the child authorises this, or if it is evident that this is in the best interests of the child. If a child is competent, they may authorise someone else, other than a parent or guardian, to make a SAR on their behalf."

 

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/when-can-we-refuse-to-comply-with-a-request/

[HC_Netman]

I would usually respond to the person and ask if there is something particular that they are looking for, or a time period, that might help narrow down the search and enable you to get back to them quicker.

 

I don't think it is unreasonable for the person to ask for everything - they are entitled to know what data you hold on them but sometimes a quick email can help narrow things down. Having a good data map should help make it less painful to supply the information.

[PotNoodleTech]

Thanks all this is just what we need.

[enjay]

My immediate reaction is that a request like this in the final week of term sounds like someone stirring trouble. They're possibly hoping to inconvenience you over the summer break or maybe even hoping you'll miss the deadline. Or they have something brewing but don't want to tip their hand. I'd start with a conversation with tutor/Head of Year/pastoral/SLT to see if the person has a particular grievance, then contact them to see if they can narrow down the request to specifically what they're looking for.

[Olliedawg]

We had one recently where the subject requested "Everything" we had on the subject, and her two children (both ex students) in paper format!.. Our DPO contacted them and as someone above said, mentioned costs due to the massive scale of the amount of admin work. Subject then narrowed down her request.