0

In the case an individual has an ongoing relationship with a company where data is collected and processed frequently one can make repeated Subject Access Requests (SAR) for free as long as they are not "manifestly unfounded or excessive, or if an individual requests further copies of their data".

I interpret this to mean I could make repeated request of the company as long as each request is for unique data (eg. "data for the last X time period") and the frequency X is not manifestly excessive. This could be termed a retrospective SAR.

Could one, instead of sending a new SAR every X time period make a prospective SAR, eg. "You can fit a smart meter, but I want you to send me all the data it transmits every X time period"?

User65535
  • 10,342
  • 5
  • 40
  • 88

1 Answers1

1

No. The right extends to personal data that are being processed. While a data subject may not know what data are being processed, the relevance is the point in time the request for access is made.

If you make a request to a controller on 1st October to obtain access to the personal data being processed, it will relate to the data that are being processed as of 1st October. It may be that more data were being processed on 30th September, but that it reached its retention limit and was erased before the access request was made. You cannot make a request for data that may be processed in future, on a speculative basis.

However, you may, as stated, make a repeated request for access to personal data at a later date, on the basis that while data may not have been processed as of the last request, it may now be. This does, however, open up the possibility of repeat requests being considered excessive and denied or charged for. The burden of proof is on the controller to demonstrate that the denied or chargeable request is in fact excessive.

Sam_Butler
  • 524
  • 2
  • 9