ICO reprimands Labour Party for ignoring information requests

The Information Commissioner’s Office (ICO) is giving the Labour Party a slap on the wrist for failing to respond to hundreds of subject access requests (SARs).

The Labour Party however did not reply to most of these information requests. That’s why the ICO got over 150 complaints between November 2021 and November 2022 regarding the Labour Party’s handling of SARs.

The investigation showed that the Labour Party received 352 information requests in November 2022 from members who wanted to know what personal information the party held on them. Of that number, 78 percent did not receive a response within the maximum compulsory time limit of three months. Over half of the information requests (56 percent) were delayed by over one year.

During the investigation, researchers came across a so-called ‘privacy inbox’ that hadn’t been monitored by the Labour Party since the cyberattack happened. The inbox contained 646 additional SARs and 597 requests for personal information to be deleted. None of these requests were granted by the Labour Party.

During the examination, the Labour Party took measures to address the backlog, including hiring extra personnel to solely handle the outstanding requests and implementing an action plan.

Stephen Bonner, Deputy Commissioner at the ICO, is pleased with the way the Labour Party handled the matter. “It is vital that organizations do not underestimate the importance of responding to these requests on time. The public needs to fully trust that a political party will handle their data correctly and respect their information rights,” he says in a statement.

Article 15 of the General Data Protection Regulation (GDPR) formulates the legal basis for people or ‘data subjects’ the right to access their personal information that is stored by businesses and organizations. Organizations must respond to a SAR within one month of receipt of the request. This can be extended by up to two months if the SAR is complex.