3. Covid-19 doesn’t stop your legal obligations

April 15th, 2020

With all the disruption the world is currently experiencing, it would be easy to assume that some legal obligations may be put on hold. This assumption could be an expensive mistake – and here’s one example why.

The Isle of Man Information Commissioner has recently published guidance for individuals and data controllers on the exercise and compliance with rights during the COVID-19 crisis. It is safe to assume that the rest of the UK’s ICO offices and officers will take the same approach. The Individuals Guidance states that the ability of individuals to exercise any of their data protection rights in a proportionate, responsible, and appropriate manner, remains UNCHANGED. 

In addition, the Controllers Guidance notes that controllers are expected to continue to comply with subject access requests and provide evidence for the actions they have taken by, among other things, maintaining records demonstrating the actions taken to comply with the request, including dates and times of actions, and logs of the correspondence with the data subject. Furthermore, the Controllers Guidance highlights that controllers should not request information that could identify data subjects and should communicate with data subjects any delays in responding to requests due to the Coronavirus crisis.

For businesses with a complex personal data landscape, the need to have an accurate map of the datastores, their contents, their legal bases and their end-of-life arrangements remains as strong as ever. This means that even in these difficult times, businesses must have a handle on the metadata around their personal information. With reduced staff numbers, some/most/all staff working from home, can the organisation still respond to Data Subject Access Requests within 30 days? The current dispensation to extend the 30-day response period is intended for enquiries of exceptional complexity and size, not as a convenient get-out for changed staffing arrangements.