Excessive SAR request

A practice manager contacts MDDUS for advice on a subject access request (SAR). Mrs T wants voice recordings of every phone call that she has made to the surgery, as well as call backs from practice staff. She is a frequent caller to the surgery.

The practice manager points out that relevant details from telephone consultations are always recorded in the patient notes by GPs or other clinical staff. Phone calls to administrative staff regarding general queries are not written up unless advice from a clinician is necessary.

Copies of written patient records could easily be made available to Mrs T. But to search out and extract recordings of every call to the practice in which she was a party could involve a great deal of work and the practice manager feels this would be excessive.

ANALYSIS/OUTCOME

An MDDUS medical practice adviser responds to the advice request. She explains that patients have a right of access to a copy of their personal data as stipulated in law under the Data Protection Act (DPA) 2018 and UK GDPR. Voice recordings of telephone calls to the practice would be included in the data that can be requested under a SAR, as the information contained within such telephone calls is data about the patient.

The Information Commissioner’s Office (ICO) provides guidance to organisations on SARs, including when it is reasonable to refuse a request. This may include, for example, if a request is considered “manifestly excessive”.

The ICO states that to determine whether a request is manifestly excessive involves considering whether it is “proportionate when balanced with the burden or costs involved in dealing with the request” but it will not be “necessarily excessive just because the individual requests a large amount of information”. The ICO further states organisations should consider each request individually and not apply a blanket policy on what is considered excessive.

The MDDUS adviser suggests that the practice takes all reasonable steps to comply with the SAR, including seeking assistance from their telephone provider on how to extract the calls. If on review and exploration of the feasibility of complying, the practice considers the request to be manifestly excessive then it may refuse, in line with the ICO guidance. The practice should be prepared to justify their decision, which can usually be achieved by explaining how the guidance has been applied to the request.

If there was an exemption, and the practice refuse the SAR, the practice must then contact Mrs T and explain the reasons why the request has been refused and inform her of her right to refer the matter to the ICO, or to seek to enforce her request through the courts.

The MDDUS adviser further suggests that a compromise might involve Mrs T narrowing her request to certain telephone calls, or over a specific period.