ICO (UK) - The Ministry of Justice
| ICO (UK) - The Ministry of Justice | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 15 GDPR Section 45 Data Protection Act 2018 |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 12.01.2022 |
| Published: | 18.01.2022 |
| Fine: | None |
| Parties: | Ministry of Justice |
| National Case Number/Name: | The Ministry of Justice |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | Frederick Antonovics |
The UK DPA served the Ministry of Justice an Enforcement Notice to bring its processing into compliance by responding to data subjects' pending access requests and carrying out organisational changes to ensure that future ones are dealt with in the time frame provided for by Article 15 GDPR.
English Summary
Facts
The controller is the UK Ministry of Justice ('MoJ'), and processes personal data in the course of carrying out its functions.
In December 2017, the MoJ had already been issued with an Enforcement Notice following a finding by the ICO that it had failed to comply with a large number of subject access requests without undue delay. Then, in January 2019 the ICO "was made aware by the controller that a backlog of subject access requests had again accrued." The DPA therefore launched a new investigation into the matter.
After a series of exchanges with the MoJ, the ICO uncovered that there were 7,753 overdue access requests.
Holding
As such, the ICO held that the controller contravened Article 15 GDPR by failing to inform the relevant data subjects, without undue delay, whether their personal data was being processed and, where that was the case, failed to provide access, in an intelligible form, to such personal data, and to the information as set out at Article 15(1) GDPR.
As a result, it served the MoJ an Enforcement Notice to bring its processing into compliance by responding to data subjects' pending access requests. It also advised the MoJ to "develop a recovery plan, containing details of how it intends to remedy the issue of the out-of-time subject access requests."
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
Action we've taken/
Enforcement/
The Ministry of Justice
The Ministry of Justice
Date
18 January 2022
Type
Enforcement notices
Sector
Central government
The Ministry of Justice has contravened Article 15 of the EU and UK and Section 45 DPA18 in that it has failed to provide, without undue delay, 7,753 data subjects with a copy of their data in accordance with its legal obligations.
Further Reading
The Ministry of Justice enforcement notice
Action we've taken
PDF (136.7K)
Action we've taken/
Enforcement/
The Ministry of Justice
The Ministry of Justice
Date
18 January 2022
Type
Enforcement notices
Sector
Central government
The Ministry of Justice has contravened Article 15 of the EU and UK and Section 45 DPA18 in that it has failed to provide, without undue delay, 7,753 data subjects with a copy of their data in accordance with its legal obligations.
Further Reading
The Ministry of Justice enforcement notice
Action we've taken
PDF (136.7K)
EnglishCymraegEnglishCymraeg
