The most reliable and efficient way of locating data controllers turned out to be online. In nearly two-thirds (63 percent) of all cases, online searching provided the relevant contact details, and this was achieved in less than five minutes over half (61 percent) of the time.
Attempts to locate data controllers using alternative methods generally did not fare well. In the majority of cases, when contacting organisations by telephone, members of staff lacked knowledge concerning subject access requests. As a result, answers were "often incorrect, confusing and contradictory", say the researchers.
When it was possible to locate the data controller via telephone, this took over six minutes, and on premium rate lines in over half (54 percent) of all cases. Even then, the information provided via telephone was rated as "good" in only 34 percent of cases.
In the case of CCTV data, where researchers attended sites in person, nearly one in five sites (18 percent) did not display any CCTV signage. Where signage was present, in more than four in 10 cases (43 percent) it was rated as "poor" in terms of visibility and content. Only one third (32.5 percent) of CCTV signage named the CCTV system operator or data controller.
When it was possible to locate the CCTV data controller, the process of submitting an access request was often "problematic" with data controllers "employing a range of discourses of denial" which "restrict or completely deny data subjects the ability to exercise their informational rights".
Access requests were sent for a range of data, including paper, digital and CCTV records. Requests made three demands of data controllers, including disclosure of personal data, disclosure of third parties with whom data had been shared, and disclosure of whether (and if so how) data had been subject to automated decision making processes.
The research found that obtaining a satisfactory response concerning all aspects of the requests was a relatively rare occurrence. Four out of ten requests (43 percent) did not result in personal data being disclosed or data subjects receiving a legitimate reason for the failure to disclose their personal data.
In over half of all cases (56 percent), no adequate or legally compliant response was received concerning third party data sharing.
In over two-thirds of cases (71 percent) automated decision making processes were either not addressed or not addressed in a legally compliant manner.
Public sector v private sector responses to data access requests
There were noted variations in how different types of organisations responded to requests. In general, public sector organisations performed less badly than those in the private sector, with 43 percent engaging in restrictive practices compared with 62 percent in the private sector.
Sign up for Computerworld eNewsletters.