When can you refuse a subject access request as manifestly unfounded or excessive?

The test

Under Article 12 of the UK GDPR you can refuse to respond, or charge a reasonable fee, only where a request is manifestly unfounded or manifestly excessive. "Manifestly" means it has to be obvious. You must be able to show why, and the starting point is that a request is valid.

You must consider each request on its own facts. A blanket policy, such as refusing every request from a particular solicitors' firm, will not stand up.

Manifestly unfounded

The ICO describes two situations:

• No real intention to exercise the right. For example, the person offers to withdraw the request in return for some benefit, such as rent arrears being written off.
• Malicious intent, used to harass with no real purpose beyond disruption. For example, the person says outright that they want to cause disruption, makes unsubstantiated accusations against particular staff, targets one employee they have a grudge against, or sends a stream of different requests as part of a campaign.

Being in dispute with you is not enough. Neither is wanting the information for a complaint, an Ombudsman case or a legal claim. Tenants are entitled to use subject access to get their records, whatever they plan to do with them.

Manifestly excessive

A request may be excessive if it is clearly unreasonable, judged against what it would achieve and the burden of answering it. Things to consider:

• whether it repeats a previous request and a reasonable interval has not passed
• whether it overlaps with other requests you are already answering
• how often the information changes
• the nature of the information and what the person needs it for, if they have said

A request is not excessive just because it asks for a lot. A tenant of twenty years asking for everything is entitled to everything you can find with a reasonable and proportionate search. If you hold a large amount, you can ask them to clarify, which stops the clock, and you can extend by two months if it is complex.

Your options

1. Comply anyway. Often the cheapest route, and the one least likely to end up at the ICO.
2. Charge a reasonable fee based on the administrative cost of complying. Ask for it promptly, and within a month at the latest. The clock starts when it is paid.
3. Refuse. Respond within the month, explaining why.

What a refusal must say

Tell the person, without undue delay and within one month:

• that you are not complying, and the reasons
• that they can complain to the ICO
• that they can seek to enforce the right through the courts

Keep a record of the decision, the evidence you relied on and who made it. If the ICO investigates, you have to show the request met the test, not the other way round.

Common housing situations

A tenant sends the same request every month

If nothing much has changed, repeating a request after a short interval can be excessive. Consider instead providing only what is new since your last response. That is often the more defensible answer.

A tenant in a long-running ASB dispute

The conflict does not make the request unfounded. If the request names staff with unsubstantiated accusations and is one of a series designed to disrupt, it might be. Look at the pattern, not the tone of one letter.

A disrepair firm sends hundreds of template requests

Each one is a valid request from a client who has given authority. Volume across a firm is not grounds to refuse. See our guide to SARs from disrepair solicitors.

Questions

Sources

• ICO: When can we consider a SAR to be manifestly unfounded or excessive?
• ICO: A guide to subject access
• UK GDPR, Article 12