I assume we're talking about providing info in relation to subject access requests in broad terms. Generally in the interpretation of the law, courts tend to take the view that words have their ordinary meaning, so 40 days means 40 days (including the day when you get a valid request). I think it might well be the case (as in other areas of law) that if there are extenuating circumstances the next working day is permissible if the deadline falls on a day when the data controller is not at work. So for example, if the 40th day is the 31st December and the organisation is shut down between 22nd December and 2nd January inclusive and it's not practicable to send the information until the 3rd, you'd be likely to get some leeway. However this is not legal advice - just an assumption on my part. I would also point out that the relevant section (7(8)) of the DPA says:
... a data controller shall comply with a request under this section promptly and in any event before the end of the prescribed period...
Note the word 'promptly'. I don't think '8 weeks seemed like a nice round figure' would necessarily cut much ice here!
Paul Hubert
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|