This case is about:

  • missing information in a subject access request response.

Ms L made a subject access request to her insurance company for all the personal data they held about her. The insurance company replied and sent her a large amount of information. However, Ms L was concerned that some information was missing and called our helpline to raise her concern with us.

We talked Ms L through our accessing personal information guidance and advised her to contact the insurance company, using one of our template letters, and list the information she thought was missing.

Upon receiving Ms L’s letter, the insurance company compared her list with what they had sent and found that they had not sent her everything. There were some files they had not looked in that contained more information about her.

When the insurance company received Ms L’s subject access request, it should have identified all the computerised and manual files likely to contain the information she had requested, and then searched for it.   

The company apologised to Ms L and provided the additional information to her. They also changed their search procedures to prevent a similar incident from happening again.

However, Ms L remained concerned that the insurance company was still withholding information, although she could not say what this was. She wanted us to check all the information the insurance company held about her to ensure she had received a full response.

We provided Ms L with more details about our responsibilities and our role in providing guidance to organisations to help them get their data protection practises right. In addition, we explained that without evidence to show that the insurance company was withholding more information from Ms L, we would be unable to determine whether its data protection practices needed improvement.

We also explained that, in situations such as these, the Data Protection Act gives individuals the right to take their concerns to court. We explained that if the court was satisfied that the insurance company had not complied with her subject access request, it could order the insurance company to disclose any inappropriately withheld information. Ms L decided to take independent legal advice before pursuing the matter further.