Tony,

My understanding on disproportionate effort was that this term, although not defined in the act is solely with regard to the supply of the information in permanent form - not that it takes a lot of effort to seek consent from all the ex-employees or in fact that it would take a long time to remove their names or identifiers from the hard copy data. They will probably have to sit there with a thick black marker and strike through all of the ex-employees names if they feel that strongly about their duty of confidentiality to their ex-employees.

I would be surprised if they had been given this advice from the ICs office. I advise you to make a complaint to the ICs office and let them battle it out with the organisations in question.

I'm sure there are a lot of Data Controllers out there who would like to be able to rely on disproportionate effort to get them out of the extra workload that is necessary sometimes with a SAR. Or maybe not!


Heléna Ashton
Data Protection Officer
G50 Romney House
Romney Avenue
Lockleaze
Bristol 
BS99 3HB
Tel: 0117 9222725

>>> Tony Bowden <[log in to unmask]> 20/06/03 14:07:57 >>>
So, I've had another organisation claim that they can't provide me with
a lot of data as it contains personal data relating to other people and
it would require disproportionate effort to either contact all these
other people to see if they're happy for the data to be disclosed or to
go through and remove all the identifiable references. They claim to be
refusing to supply this data on the advice of the Data Protection Office.

Consider the (rather common, I would assume) case where every contact
with a company is recorded in some sort of Customer Management System,
with annotations by the staff member who dealt with the contact. Assume
this happens regularly, and over a longish period of time, such that,
by the time an SAR is made, most of the staff in question have now left
the organisation. Does the company really have to get permission from
all those ex-staff members to disclose the notes they made regarding the
customer, if they're annotated with their name? And can the company then
claim that if the employee's name cannot be removed automatically from
this data, that, due to the quantity of information that would have to
be processed by hand, that it would be disproportionate effort to supply
that data?

Surely this would be quite a major loophole?

Tony

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
       All archives of messages are stored permanently and are
      available to the world wide web community at large at
      http://www.jiscmail.ac.uk/lists/data-protection.html 
      If you wish to leave this list please send the command
       leave data-protection to [log in to unmask] 
            All user commands can be found at : -
    www.jiscmail.ac.uk/user-manual/summary-user-commands.htm 
  (all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
       All archives of messages are stored permanently and are
      available to the world wide web community at large at
      http://www.jiscmail.ac.uk/lists/data-protection.html
      If you wish to leave this list please send the command
       leave data-protection to [log in to unmask]
            All user commands can be found at : -
    www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
  (all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^