Information commissioner gives authority eight months to respond to all outstanding subject access requests after concerns over backlogs and numbers of unanswered SARs that date back as far as 2022

Bristol City Council has been hit with an enforcement notice from the Information Commissioner’s Office, instructing it to deal with multi-year backlogs in subject access requests within eight months. 

The move follows complaints about the authority’s handling of people’s requests for personal information held about them that first prompted the data watchdog to raise “informal enquiries” with the city council in 2023. 

Subject access requests are supposed to get responses within one calendar month, but the rules allow for data-holders to take a further two months in some circumstances. 

According to the ICO, Bristol City Council had 170 overdue SARs as of March 2023, the oldest of which dated back to 2020. Figures in June this year indicated Bristol had a backlog of 231 overdue SARs, some of which date back to 2022. According the ICO, the majority of the SAR backlog relates to children’s social-care data. 

The ICO said Bristol had reported a spike of “almost 900%” in SARs following the Covid-19 pandemic but had struggled with resourcing to handle the requests because of budget restrictions.

The ICO enforcement notice gives the city council set deadlines for responding to its backlog of SARs. Those submitted in 2022 are expected to get responses within 30 days; the most recent requests that form part of the backlog should be answered within eight months, the regulator has stipulated.

Bristol is also required to give weekly progress updates to the ICO until all overdue SARs are resolved. Additionally it is required to create and share an action plan to address the SAR backlog within 90 days. 

Further, the authority has been given 12 months to make system and process changes to ensure future SARs are identified and completed on time, including ensuring that there is adequate staffing and resource for SAR responses.  

ICO head of investigations Sally-Anne Poole said subject access requests are a fundamental right that allow people to know what information organisations hold about them and how it is being used.  

“Despite our repeated engagement with Bristol City Council over a sustained period of time, limited progress has been made to clear a backlog of requests,” she said. “Our investigation has found that the council’s approach towards compliance demonstrates a poor organisational attitude towards data rights and compliance with the law. This enforcement notice requires them to clear their SAR backlog in a timely manner, and make lasting improvements to bring their practices in line with the law.”