HSC Mandated to Enhance Data Request Responses Within Three Months

Health and Social Care (HSC) has received a directive to improve its procedures for responding to requests concerning personal data records within a three-month period. This instruction originates from the Office of the Data Protection Authority (ODPA), which initiated an investigation into HSC’s response protocols after a member of the public lodged a complaint about receiving only partial records. In a statement, the ODPA indicated that its investigation revealed HSC’s failure to consider all pertinent filing systems and electronic databases when conducting searches for information, and also noted that HSC did not meet a deadline established during the authority’s inquiry. HSC responded by stating that its data access department was under “immense pressure” as the volume of requests had “more than doubled over the last two years,” but affirmed its commitment to taking the ODPA’s findings “seriously.” The ODPA clarified that HSC is obligated to provide individuals with their complete personal records, and that a failure to do so prevents individuals from fully understanding how their data is being utilized. HSC was “reprimanded” by the ODPA for its non-compliance with an information notice issued by the authority within the stipulated timeframe as part of the investigation. “This is the second public statement by the authority relating to a matter where information was missed by HSC in a subject access request, and deadlines were not met,” the ODPA said. As a direct consequence of these findings, the ODPA has instructed HSC to identify all filing systems and electronic databases necessary for handling personal information requests. It has also granted HSC three months to enhance its responsiveness to information requests. A spokesperson for HSC stated: “While we recognise that it is important for data subjects to get information in a timely manner it would be remiss of us not to highlight the immense pressure HSC is under in this area, as the volume of Data Subject Access Requests has more than doubled over the last two years. “These requests are often particularly complex and span an individual’s entire lifetime.”We are reviewing how to meet this demand going forward, including expanding our resource capability to best meet our legal obligations.”