Neil Wilby Media

On 9th June, 2023, the author of this article, Neil Wilby, exercised his prerogative under an individual’s General Data Protection Rights (GDPR) and made a request to Oldham Metropolitan Borough Council (OMBC) for disclosure of information they hold about him.

What is a Data Subject Access request?

A Data Subject Access Request (usually shortened to ‘SAR’) is a legal right granted to individuals under data protection laws, such as GDPR, or the Data Protection Act, 2018. It allows individuals, referred to as data subjects, to request access to the personal data that organisations hold about them.

These are the key aspects of a SAR:

Request for Personal Data: A SAR is a formal request made by an individual to an organisation asking for access to their personal data. Personal data includes any information that can directly or indirectly identify an individual, such as names, addresses, email addresses, financial information, health records, and more.

Legal Right: Data protection laws, including GDPR, grant individuals the legal right to make SARs. Organisations are obligated to fulfil these requests in a timely and transparent manner.

Request Process: Generally, individuals submit SARs in writing to the organisation that holds their data. The request should specify the data they are seeking and include enough information to verify their identity.

Response Time: Data protection laws stipulate a specific time frame within which responses to SARs are made. In England and Wales they have one month to respond, although this can be extended in certain cases to three months.

Access to Data: Upon receiving a SAR, the organisation is required to provide the requested personal data to the individual. This may include information on how the data is being processed, who it is shared with, and the purpose of processing.

Exceptions: There are exceptions to SARs, such as when disclosing the requested information would infringe upon the rights and freedoms of others or reveal confidential business information.

No Charge: In most cases, organisations cannot charge individuals for fulfilling SARs. However, they may charge a reasonable fee for excessive or repetitive requests.

Complaints: If an individual is dissatisfied with the response to their SAR or believes their rights have been violated, they can file a complaint with the relevant data protection authority, in this case the Information Commissioner’s Office, or take legal action in the county court.

SARs are essential for individuals to have control over their personal data and to ensure that organisations are processing their data lawfully and responsibly. They are legally obligated to handle these requests promptly and in compliance with data protection regulations to protect individuals’ privacy rights.

Request made by Neil Wilby in June, 2023

In the interests of proportionality, and in order to simplify the process, restrain cost and manpower, the request excluded emails sent to, or received from, OMBC. That would account for a high percentage of the data that would have been necessary for the Council to deal with as part of the SAR finalisation, otherwise.

Notification of extension of time to respond

An email from Lewis Greenwood, at the time Assistant Director Policy, Performance and Corporate Leadership, was received by Neil Wilby on 4th July, 2023 in these terms:

“I just wanted to write to you with an update on your subject access request. The target date for response is 9 July 2023.

“However, following an ICT search a large number of records have been obtained and we are working through those individually to ensure that we meet the scope of your request. For an example – there are email trails where your name has been mentioned as part of a Council question amongst others, but the subsequent responses to not mention yourself and therefore some information needs redacting. We are therefore in a position where we need to extend the time limit and under the ICO guidance the Council may extend the time limit by a further two months – with the timescale for replying is now the 9th September. We will however endeavour to respond to your request much sooner than this date [emphasis added] but I wanted to flag the latest position with you.”

There were several other emails exchanged between the two on the following day, the upshot being that Lewis agreed that the SAR output would be provided in pdf format with a separate document for each Council Department.

It also emerged that individual officers started to undertake searches on 12th June 2023. Primarily focused on the Cabinet and Senior Officers where support arrangements are in place and, therefore, easier for the Council, they say, to undertake searches that way. Rather downplaying the ‘marking one’s own homework’ element.

The broader search which the IT department undertook was not instigated until 21st June, 2023. At that point, the Council say, it is when the search returned a large number of records and results. Since then, they ‘have been working through the individual emails and it became clear this week that this wouldn’t be completed within the original target date of 9th July’.

Lewis left OMBC at the end of July, 2023 to take up a similar senior role with Wigan Council.

Chasing up the response

On 15th August, 2023, Lewis was contacted at Wigan to try and give a steer on who would have taken over from him in dealing with the SAR at senior management level and what was the likely date disclosure would be made by his former employer

Typically and, taken at its face, helpfully, he replied on the same day in these terms:

“I’m sorry the team at Oldham haven’t been in contact with an update for you on your SAR. I’d suggest contacting [redacted] who will be able to provide you with an update on the status and likely date of providing you with the information.”

The officer suggested as a replacement contact is Head of Communications and Strategy at OMBC. Part of her portfolio is the running of the press office to where journalists’ requests for comment or statement from such as the Leader, Cabinet Members or chief executive are directed. It is pot luck whether they are ignored, the response unreasonably delayed or, if one is provided, the level of obfuscation or apparent deceit inherent within it.

Across a very broad estate, Oldham Council’s press office is ranked by Neil Wilby in the bottom two. For that reason, amongst others, no contact was made with her about the SAR. It would have been a pointless exercise and one almost guaranteed to increase the levels of stress and anxiety this process was already causing.

Instead, an email was sent to the generic Information Management address on 15th August, 2023, as follows:

“There has been no update since 5th July, 2023 (see below email).

“Lewis Greenwood has now left OMBC, of course.

“Please advise when I am likely to receive the requested information.”

A reply from OMBC, without identifying the sender, came two days later:

“Thank you for your email regarding your Subject Access Request this is currently being worked on and will be with you on or before the 9^th September 2023.

“Once the pdf documents have been collated we will contact you further to confirm how you would like these to be sent over to you”.

The intimation given, believed to be in good faith by Lewis Greenwood, that ‘disclosure would be made well before 9th September’ had, in his absence, simply fallen by wayside.

An anonymous tip-off

On Wednesday 6th September, 2023 an anonymous tip-off was received. It was surprising to say the least: Most of all because of the very few people, if any, outside of those involved within OMBC (and Lewis Greenwood, of course) that knew of the existence of the SAR:

These are the significant strands of that message:

– you won’t receive it [the SAR] by the due date

– when you do get it there’ll be blacking out that shouldn’t be there

– even then some of your data has been withheld

– it is embarrassing to a number of top management and councillors

So far, the message has proved prescient. The rest, given OMBC’s history in other business areas, is fairly predictable.

Notification of further delay

The afternoon following the revelations in the anonymous message, this email was duly received from OMBC’s Information Management address. The sender is not identified:

“In relation to your SAR [reference number] 4440 unfortunately due to periods of summer leave there will be a slight delay to the disclosure of the information.

“We apologise for this delay and confirm that the information will be sent over to you in a series of numbered emails by the end of next week”.

Apart from the obvious distress and anxiety caused by such flagrant disregard of the law of the land, this latest Council email has the hallmarks of one calculated to vex, annoy and harass. Traits not unique to Oldham, one has to say: It is a well-rehearsed technique deployed by other public authorities, most notably police forces. Hoping it will provoke an intemperate response.

What next?

A requirement before taking a complaint further, externally, is to give Oldham Council the opportunity to explain themselves, rather more convincingly than so far is the case, in terms of a deliberate and calculated breaking of the law.

There are two avenues of further complaint: one via the statutory regulator and the other via a tortious claim in the county court. Lengthy past experience has demonstrated that the Information Commissioner simply inserts more delay into the process and its findings can, usually and most kindly, be characterised as less than robust.

Conversely, court action is where remedy is best obtained. Neil Wilby has, in the past and as a lay litigant, defeated both Durham Constabulary and North Yorkshire Police, fully armed with solicitors and specialist barristers, in similar circumstances where the Data Protection Act was breached.

Findings by a district judge of such law-breaking is very damaging to public confidence. No less so than to a large metropolitan council, such as Oldham. Particularly, where faith in the organisation – and staff morale – is already at rock bottom

The same judge also gets to consider the SAR materials disclosed by the Council in redacted and un-redacted form – and decides whether any obscuring of data is unlawful. She, or he, also has to decide, after hearing submissions from both parties and on the balance of probabilities, whether the Council has disclosed all the relevant materials.

As most readers will have worked out for themselves, this is a story with some way to run, yet.

UPDATE: A Pre-Action Protocol letter before claim was served on Oldham Council this morning (12th September, 2023). Full details here.

Follow Neil Wilby on Twitter (here) and Neil Wilby Media on Facebook (here) for signposts to any updates.

Page last updated: Tuesday 12th September, 2023 at 15h25

Thank you for reading and a polite request: If you feel this article is of value and in the public interest, and wish to make a contribution to the running costs of this website, it would be very much appreciated. Donations can made securely (and anonymously if required), via Buy Me A Coffee at this link or via PayPal at this link.

Corrections: Please let me know if there is a mistake in this article. I will endeavour to correct it as soon as possible.

Picture credit: Oldham Council

Right of reply: If you are mentioned in this article and disagree with it, please let me have your comments. Provided your response is not defamatory it will be added to the article.

© Neil Wilby 2015-2023. Unauthorised use, or reproduction, of the material contained in this article, without permission from the author, is strictly prohibited. Extracts from, and links to, the article (or blog) may be used, provided that credit is given to Neil Wilby Media, with appropriate and specific direction to the original content.