The Office of the Ombudsman ('the Ombudsman') published, on 25 February 2022, its enforcement order in Case No. 202200019, as issued on 14 February 2022, in which it ordered the Department of Children and Family Services ('DCFS') to provide a comprehensive response to a submitted subject access request, no later than the end of business on 7 March 2022, and to investigate the reasons for its failure to comply with the submitted subject access request, following a violation of Section 8 of the Data Protection Act (2021 Revision) ('the Act'), for the DCFS' failure to respond to a submitted subject access request within the required statutory timescale under the Act.

Background to the case

The enforcement order highlights that, on 1 August 2021, the DCFS had received a subject access request from an individual on behalf of themselves and their child, requesting the personal data held by the DCFS in relation to specific proceedings. On 31 August 2021, the complainant send a reminder to the DCFS as they had not received a response, and sent additional reminders in September after the DCFS responded that it was working on the request, but did not provide any information. The enforcement order further highlights that the complainant also contacted the Ombudsman in this regard, which subsequently contacted the DCFS, although no further information was provided to the complainant.

The enforcement order notes that the DCFS provided the complainant with information on 20 December 2021, following the Ombudsman's notice that it intends to file an enforcement order against the DCFS for failing to respond to the complainant's request.

Findings of the Ombudsman

The Ombudsman found that, as the initial request from the complainant was submitted on 1 August 2021, the DCFS was required to provide a response by 31 August 2021, in accordance with Section 8(6) of the Act. In addition, the Ombudsman found that, although the law allows for an extension of the statutory timeline, the DCFS requested further information beyond its initial deadline. As such, the Ombudsman found that the response to the complainant was provided 141 days after the original request was received, which amounts to 111 days after the statutory deadline, and the complainant was required to wait an additional 56 days for further clarification on the provided information after they had queried the completeness of the provided response from the DCFS. 

Outcomes

As such, and as a result of the DCFS' violation of Section 8 of the Act, the Ombudsman required the DCFS to:

• provide a full response to the complainant's request no later than the end of business on 7 March 2022, and to identify whether any of the information is considered exempt from disclosure under the exemptions within the Act, and explain the exemption to the complainant; and
• investigate why its response to the complainant's request failed to comply with the requirements of the Act, and to provide these findings, in full, to the Ombudsman by the end of business on 7 March 2022.

In addition, the Ombudsman recommended that the DCFS draft a comprehensive policy to detail how it will address data subject requests in accordance with Section 8 of the Act in the future. 

You can read the enforcement order here.