My interpretation - and I hope I've got it right because I start internal
training on Monday :-) - is that:
The main effect on the public authority is that the Right of Access under
S7 of the DPA is extended to include unstructured personal data as long as
the request contains a description of the data. Notwithstanding this, the
public authority:
is not required to communicate the data in response to a S7 request
if it estimates that the cost of doing so (so far as relating to
those data) would exceed the appropriate limit, but
is still obliged to inform the data subject that it is processing
such data, if that is the case.
In addition to this, however, we have the over-riding factor that costs can
only include those reasonably incurred. If the public authority concerned
incurs high costs because it hasn't put its house in order as regards
records management then refusal on cost grounds might well be successfully
challenged.
Regards,
Graham
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
