Complaint to the Information Commissioner’s Office about the Labour Party’s chronic failure to respond to Subject Access Requests
Below is the text of my latest complaint to the Information Commissioner’s Office (ICO) about the Labour Party’s chronic failure to respond to Subject Access Requests (SARs). It is my fourth SAR to the Labour Party in four years and follows my third suspension by the party.
SAR 1 — Made August 12 2016; apology for delay on September 22; fulfilled on October 11; SAR 2 — Made April 6 2017; apology for delay on June 7; fulfilled on August 4; SAR 3 — Made December 8 2017; never fulfilled; SAR 4 — Made July 21 2020; not yet fulfilled.
My previous articles about the Labour Party’s chronic failure to fulfil SARs can be found here, here, here, here, and here.
I made my latest Subject Access Request to the Labour Party on July 21 2020 — the day after I was suspended by the party (see below). I did so in an urgent attempt to find out what lay behind my suspension.
Separately, I also made a complaint about a data breach by the Labour Party and/or its agents in relation to the way news of my suspension was leaked to media outlets, in an inaccurate and prejudicial manner.
I immediately received an automated acknowledgement:
In response, I sent a copy of my driving licence as my photographic identity on July 24.
On August 5, I received another email, again acknowledging receipt of my SAR. This time it suggested the Labour Party’s Data Protection Team might unilaterally decide my request was “complex” and subject to a two-month extension to the statutory requirement of one-calendar month.
The team promised to contact me again “in the next few days” to confirm this. The unnamed author added: “I would like to assure you that, regardless of whether or not we apply the two-month extension, we will endeavour to fulfil your request as soon as is practicable.”
I immediately replied that I did not regard my request as “complex” and said that any delay would be unacceptable to me.
On August 12 — a week later — I asked why the Data Protection Team had not contacted me “in the next few days”:
On August 21 — a calendar month after my SAR — I sent another reminder email, copying-in David Evans, the Labour Party general secretary, and his office manager, Janet Chapman (with whom I had previously raised the data-breach complaint relating to my suspension):
Ms Chapman replied on August 24, stating the Data Protection Team would be in contact.
On August 25, I received another email that appeared to be a generic automated reply:
I was beginning to lose patience — not least because nobody seemed to be reading emails before sending an auto-reply.
On September 14, I had to send another reminder email — copying-in Ms Chapman (whose auto-reply told me she had “left the organisation”).
On October 21 — to mark three months since my SAR — I sent another reminder to the Data Protection Team.
On November 10, the team contacted me again. The unnamed author wrote: “We are contacting you to acknowledge that we are still in the process of compiling your Subject Access Request. Unfortunately the Labour Party is currently dealing with an unprecedented level of data protection related queries, complaints and requests, which means it is taking much longer than usual to fulfil requests like yours. Please continue to read for more information.”
Interestingly, appended to what looked like a standard email, was the following assertion:
“The Information Commissioner’s Office (ICO — the regulator) are aware of this situation and we are working closely with them on this matter. I’m obliged to inform you that you can contact them on 0303 123 1113, or you can visit their website here, should you remain unhappy: https://ico.org.uk/make-a-complaint/. You should however be aware that they may not be in a position to provide you with any further updates in addition to this email and will continue to monitor this situation within the Labour Party.”
I replied immediately, saying the delay — after nearly four months — was unforgiveably shocking. I again asked the party to meet its statutory obligations.
I received only an auto-reply, from the “Legal Queries” team:
On November 13, I contacted the Philip Marsh, the ICO’s lead case officer, who had intervened — to no avail — in a previous SAR in December 2017 (to which the Labour Party never responded):
Mr Marsh immediately replied, urging me to submit a formal complaint.
This is the complaint (Case Reference Number RFA0742364).
_________________________________________________________________
My previous articles about the Labour Party’s chronic failure to fulfil SARs are:
November 9 2017
Labour Party breached the Data Protection Act — says the Information Commissioner’s Office
July 30 2018
Labour Party breaches the Data Protection Act….Again! Says the Information Commissioner’s Office
August 25 2018
Information Commissioner’s Office considers action against Labour Party over handling of Subject Access Requests
May 13 2020
The multiple breaches by the Labour Party of the Data Protection Act
___________________________________________________________________
IMPORTANT:
As the Information Commissioner’s Office (ICO) explains, submitting such a request is straightforward: simply email your request to dataprotection@labour.org.uk and provide your name, address, membership number, with proof of identity (for example, a photograph of your driving licence). You should receive all the information the Labour Party holds on you within a calendar month; if party officials unilaterally declare your case as “complex”, it may take three calendar months.
