Controller Bouncing
One common deflection tactic I've noticed whilst making SARs is "controller bouncing".

This usually looks like one controller claiming certain data they hold actually belongs to someone else, and that the controller you're contacting has only been provided with it (and therefore, apparently, cannot provide it to you).

This is often not exactly the case, and it limits your ability to understand how data has been shared (or even how it has mutated) between organisations.

This can end up with well meaning requesters being pushed into the middle of an endless bureaucratic loop looking suspiciously like a Spiderman meme.

────────────────────────────
"My love has got no data, he's got his trampoline..."
Before deciding whether you're being bounced around, it's worth understanding which organisations may genuinely not be responsible for your data and which are responsible but have a lawful reason to withhold it.

A data controller is legally defined as who "determines the purposes and means" of data processing - notably not necessarily who originally supplied it.

Any data "relating to an identified or identifiable natural person" counts as personal data. There are a number of restrictions on whether an organisation is required to disclose it, which can be found on the ICO's website, in the Data Protection Act, and in the UK GDPR.

These essentially boil down to;
- Protecting "information relating to another individual" (unless they consent or disclosure is reasonable),
- "Legal professional privilege", Government and public protection, or data which would be "likely to prejudice" certain crime/tax matters.
- Some health data which may be "likely to cause serious harm" if disclosed.
- Requests which are "manifestly unfounded or excessive" may be charged for or refused, and controllers need to prove why they consider a SAR beyond a "reasonable and proportionate search".

(The ICO has a fuller guide to some much more specific exemptions for anyone interested.)

Notice what's missing? "But they had it first! We only had it sent to us!"

That just doesn't cleanly fall under the third party data exemption. If they decide how and why to process your personal data, they now have responsibilities as a controller - alone or jointly with others - regardless of who originally supplied it.

However, if they are genuinely only processing it on another controller's behalf, that controller remains responsible for your SAR. Some examples of this may be outsourced call centres or companies hosting medical records systems, where they very specifically process data only on another controller's instructions. The controller must request this data for you, if it's relevant to your SAR, and cannot continually bounce you between non-controllers without direction.

This can truly be a tricky distinction to unwrap without asking the controllers themselves - and sometimes, seemingly, it's difficult on their end too.

────────────────────────────
If your data is being withheld
When controllers refuse to act on a SAR, they must express their "reasons for not taking action" clearly to the requester and explain how to complain to them, the ICO, and seek a legal remedy.

Subject to the exemptions we just discussed, "the controller shall provide a copy of the personal data undergoing processing", and must provide "any available information as to their source" (as in, where they actually got the data - if it wasn't collected directly from you), and information about the "recipients or categories of recipient" (who the data has been shared with, or will be shared with).

In other words; where did it come from, and where did it go? Where did it come from, Cotton Eye Joe?

────────────────────────────
But who actually is The Fat Controller?
Often in this situation, your data may genuinely be split between a number of controllers.

The first thing to do is to ask who exactly, if not them, the organisation thinks IS the controller.

If they can tell you, this can be another valuable asset when hunting for your data - different controllers may hold and release different data; which can help you to sniff out and link up other seemingly missing pieces of information.

If they can't tell you, then that is another piece of evidence towards their statements perhaps not being completely well considered.

So, before contacting the ICO, why not ask the controller "just one more thing";

Which actual legal provision are they relying on to refuse disclosure?

────────────────────────────
TL;DR:
When responding to Subject Access Requests, the controller which originally supplied data isn’t necessarily the only controller responsible for providing it.

If an organisation tells you that they can't provide certain data because they are not the controller, don't feel you're being annoying to question that.

Just ask them directly; "Thank you for the update. Are you saying you're not the controller, or that an exemption applies? If you're not the controller, who do you believe is? If you're relying on an exemption, which legal provision applies?"

The ICO promised to allocate my urgent complaint within 12 weeks. That deadline has passed without an allocation update.

I submitted a data protection complaint on 31 July concerning incomplete SAR disclosure, disputed accuracy and unresolved rectification requests.

I requested urgent handling and explained the prejudice caused by delay.

Despite it being urgent, they were going to allocate it to a case office only in 12 weeks!

That time has lapsed and they've still not allocated it. What particularly frustrates me is the likely explanation: workload.

I accept that complaint volumes may have increased. But the ICO has also become more selective about the work it undertakes and, further, it said 12 weeks after knowing its own workload.

Has anyone successfully used section 166 DPA 2018 to obtain an order requiring the ICO to progress a complaint? What did it achieve in practice?

On getting a complaint (case reference numbers are illustrative):

Subject: ICO Case Reference IC-123456-A0A0. Cyfeirnod achos yr ICO IC-123456-A0A0

Thank you for getting in touch. Your case reference number is XXXXX.

If you have new or relevant information you would like to add, you can:

• reply to this email, or
• email us and include your full reference number in the subject line.

Please only send information that is directly relevant to the issue you’ve already raised.

Yours sincerely,
Information Commissioner’s Office

Diolch i chi gysylltu â ni. Eich cyfeirnod achos yw XXXXX.

Os oes gennych wybodaeth newydd neu berthnasol yr hoffech ei hychwanegu, gallwch:

• ymateb i'r e-bost hwn, neu
• e-bostiwch ni a chynnwys eich rhif cyfeirnod llawn yn y llinell bwnc.

Anfonwch wybodaeth sy'n uniongyrchol berthnasol i'r mater rydych chi eisoes wedi'i godi yn unig.

Yn gywir,
Swyddfa'r Comisiynydd Gwybodaeth

To notify users of delay:

We’re writing to let you know that we still have your data protection complaint, which hasn’t been allocated to a case officer yet.

We understand that waiting can be frustrating, and we’re sorry for the delay. We’re continuing to work through a high volume of complaints, and allocation is taking longer than usual.

You don’t need to take any action

You don’t need to contact us to keep your complaint open. We’ll be in touch once it’s allocated or if we need more information from you.

If you want to send more information

If you have new or relevant information about your complaint, you can:

reply to this email, or

email us and include your full reference number in the subject line (it’s at the top of this email and looks like this: IC-XXXXXX-XXXX).

Please only send information that is directly relevant to the complaint you’ve already raised.

If your complaint has been resolved

If the organisation has resolved the issue and you no longer want us to consider your complaint, please reply to this email to let us know.

Current timescales

Our latest complaint handling timescales are available on our data protection complaints page on our website.

Your legal rights

If you believe we have either failed to take appropriate steps to respond to your data protection complaint, or we do not provide you with information about the progress or outcome of your complaint within the next three months, you may be able to apply to the First-tier Tribunal to require us to respond to your complaint or to provide you with information about its progress. Read more about Information rights and data protection: appeal against the Information Commissioner.

Thank you for your patience.

Yours sincerely
Public Advice and Data Protection Complaints Service
Information Commissioner’s Office

Rydyn ni'n ysgrifennu i roi gwybod ichi fod eich cwyn diogelu data gennyn ni o hyd, ond nad yw wedi'i dyrannu i swyddog achosion eto.

Rydyn ni’n deall y gall aros beri rhwystredigaeth, ac mae'n ddrwg gennyn ni am yr oedi. Rydyn ni’n parhau i weithio trwy nifer fawr o gwynion, ac mae dyrannu’r rhain yn cymryd mwy o amser nag arfer.

Does dim angen ichi gymryd unrhyw gamau

Does dim angen ichi gysylltu â ni i gadw'ch cwyn yn agored. Byddwn ni’n cysylltu pan fydd y gŵyn wedi'i dyrannu neu os bydd arnon ni angen rhagor o wybodaeth gennych.

Os hoffech chi anfon rhagor o wybodaeth

Os oes gennych wybodaeth newydd neu berthnasol am eich cwyn, fe allwch chi:

ymateb i'r neges ebost yma, neu

anfon neges ebost aton ni gan gynnwys eich rhif cyfeirnod llawn yn y llinell bwnc (mae hwnnw ar frig y neges ebost yma ac mae'n edrych fel hyn: IC-XXXXXX-XXXX).

Anfonwch wybodaeth sy'n uniongyrchol berthnasol i'r gŵyn rydych chi eisoes wedi'i chodi yn unig.

Os yw'ch cwyn wedi'i datrys

Os yw'r sefydliad wedi datrys y mater ac nad ydych chi am inni ystyried eich cwyn chi erbyn hyn, ymatebwch i'r neges ebost yma i roi gwybod inni.

Yr amserlenni cyfredol

Mae’n hamserlenni trin cwynion diweddaraf ar gael ar ein tudalen cwynion diogelu data ar ein gwefan.

Eich hawliau cyfreithiol

Os ydych chi'n credu ein bod ni heb gymryd camau priodol i ymateb i'ch cwyn diogelu data, neu os na fyddwn ni’n rhoi gwybodaeth ichi am gynnydd neu ganlyniad eich cwyn o fewn y tri mis nesaf, mae’n bosibl y byddwch chi’n gallu gwneud cais i'r Tribiwnlys Haen Gyntaf i ofyn inni ymateb i'ch cwyn neu roi gwybodaeth ichi am ei chynnydd. Mae rhagor o wybodaeth ar gael yma am Hawliau gwybodaeth a diogelu data: apelio yn erbyn y Comisiynydd Gwybodaeth.

Diolch ichi am eich amynedd.

Yn gywir
Gwasanaeth Cyngor Cyhoeddus a Chwynion Diogelu Data
Swyddfa'r Comisiynydd Gwybodaeth

If you phone and ask for your case to be expedited (with reasons):

Subject: Case Reference: IC-123456-A0A0 

Dear xxx,

Thank you for your complaint of xx xx xxxx regarding xxxx.

We understand that you have requested that your case is expedited.

We are dealing with a large number of complaints at the moment, which means that it is taking longer than we would like to allocate your case to a Case Officer. We’re sorry for any inconvenience this has caused you.

Our statutory obligation is to provide a response within 12 weeks of the complaint being submitted to the ICO.

Whilst we are not able to expedite your case any sooner than this, we will allocate your case within 12 weeks of the submission date of xx.xx.xxxx.

Yours sincerely,

Public Advice and Data Protection Complaints  
Information Commissioner's Office

Essex County Council are running way behind on SARs.

Be aware that if you submit a SAR they'll find some excuse to buy themselves an additional two months - by claiming your SAR is complex or whatever.

And even after the entire 3 months have passed, you'll likely not get your data.

[Your Full Name]
[Your Postal Address / Email Address]
[Your Account Number / Reference Number with the organisation] 

[Name of the Organisation / Company]
[Address of the Organisation / Email of their Data Protection Officer] 

[Date] 

URGENT: STATUTORY DEADLINE MISSED – Subject Access Request (SAR) 

Dear Data Protection Officer / Privacy Team, 

On [Date you sent the initial SAR], I submitted a formal Subject Access Request (SAR) to your organisation, requesting access to my personal data under Section 45 of the Data Protection Act 2018 / Article 15 of the UK GDPR. 

According to statutory requirements, you are required to respond to a SAR without undue delay and at the latest within one calendar month from receipt. 

Your deadline to provide this data expired on [Date the one-month deadline ended]. As of today’s date, I have not received the requested information, nor have I received any formal notification extending the period for compliance due to complexity. 

Your organisation is now in breach of its statutory obligations under UK data protection law. 

Please note that if the complete set of requested data is not provided within 7 calendar days of this letter, I will take the following steps without further warning: 

1. Lodge a formal complaint with the Information Commissioner’s Office (ICO) regarding your failure to comply with statutory timeframes. 
2. Consider raising a formal dispute in the small claims court to seek an order for compliance and financial compensation for the distress caused by this delay, as permitted under Article 79 of the UK GDPR. 

I expect to receive a response acknowledging this letter and confirming when the data will be delivered immediately. 

Yours sincerely, 

[Your Name]