Cookies on our website

We use cookies on our website. To learn more about cookies, how we use them on our site and how to change your cookie settings please view our cookie policy. By continuing to use this site without changing your settings you consent to our use of cookies in accordance with our cookie policy.

Read more Close
Skip Ribbon Commands
Skip to main content
Sign In


A&O's data protection team responds to the ICO's consultation on its draft subject access code of practice


The Information Commissioner's Office (ICO) published a draft subject access code of practice in December 2012. The draft code seeks to consolidate and supplement existing guidance, providing information for both organisations and individuals.

The right of subject access is a fundamental right under UK data protection law and it is likely to take on greater importance as individuals and authorities seek to regain control of personal data in the face of great technological and social change.

The ICO opened a consultation to gather the views of organisations, stakeholders and members of the general public on the draft code. Allen & Overy has submitted a response to this consultation, which includes various recommendations in relation to the draft code.

The code helpfully consolidates builds on existing guidance, but there are several aspects of the code which will be cause for concern among data controllers. In particular, the code does not seek to tackle the widespread misuse of subject access requests as a tool in litigation. The code also takes a very narrow view of the "disproportionate effort" exemption under the Act, which is arguably at odds with recent case law.

Commenting, senior associate Nigel Parker explains: "We congratulate the ICO on the work it has done to bring together and refresh existing guidance. We also welcome the code’s aim to achieve "the right balance between the protection of individuals’ privacy and proportionate obligations for organisations".

We have some concerns that certain aspects of the code could potentially require data controllers to take disproportionate steps, which exceed their obligations under the Act, both in relation to the law as stated in the code and the recommendations of good practice."

Last year Allen & Overy released Access Assist, an App (freely available on iPad from the Apple App Store) which aims to assist data controllers in responding to subject access requests. You can find further information here.

You can find our full response here.

Additional reading

Unregulated access - The expanded right of access under the proposed Regulation




News search

Related people

  • Add comment (optional)