The Information Commissioner published, on 6 June 2022, its decision in Case No. EN2022/03, as issued on 3 May 2022, in which it imposed an enforcement notice Port St Mary Golf Club Limited for violations of Articles 12 and 15 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a complaint on failure to comply with a request for right of access.

Background to the notice

In particular, the Information Commissioner outlined that the data subject submitted a right of access request on 11 May 2021, which was not fulfilled at the date of the enforcement notice.

Findings of the Information Commissioner

Notably, the Information Commissioner concluded that it was not satisfied that Port St Mary could maintain its assertion of legal privilege in respect of the documents requested by the data subject provided in the legal privilege and, therefore, is not justified in continuing to refuse to provide a copy of its personal data to the data subject. Specifically, the Information Commissioner outlined that, in order to, engage its legal privilege, litigation has to be actual or reasonably in prospect, not a mere possibility and it is not sufficient that there is a distinct possibility that sooner or later someone might make a claim, nor is a general apprehension of future litigation enough.

Therefore, the Information Commissioner determined that although some personal data has been provided to the data subject, Port St Mary infringed, and continues to infringe, Articles 12 and 15 of the GDPR.

Outcomes

Consequently, the Information Commissioner was satisfied that Port St Mary violated its responsibilities to fulfil a data subject access request and thus ordered Port St Mary to comply with the request by providing the data subject with a copy of their personal data and a copy of the same to the Information Commissioner within 30 days of the aforementioned issue date. In addition, the Information Commissioner highlighted that the failure to comply with an enforcement notice could result in the imposition of penalties and referral of the matter to the High Court, but outlined Port St Mary's right of appeal to the Isle of Man Data Protection Tribunal.

You can read the press release here and the decision here.