Data Protection Commissioner
Data Protection Commissioner

Ashbury Taverns: Failure to comply with an access request

My Office received a complaint regarding alleged non-compliance with an access request. This complaint was made by a legal representative on behalf of a data subject formerly employed by Ashbury Taverns of Wexford.

As the access request had not been complied with within the 40 day period, my Office wrote to the data controller. When no response was received, my Office also attempted to make contact on numerous occasions by telephone and by registered post.

As my Office had attempted to investigate this complaint and had been stymied by the failure of the data controller to respond, I decided to issue an Enforcement Notice to Ashbury Taverns. The Enforcement Notice required the data controller to comply with the access request within a period of twenty-one days. During that period, my Office received its first correspondence from Ashbury Taverns by way of a letter from its solicitors. My Office was informed that the access request had not been complied with by Ashbury Taverns because it had likely confused its obligations under the data protection legislation with claims made under employment legislation. The letter also stated that the access request had now been complied with. Upon follow-up communication with the legal representative of the data subject, it was confirmed to my Office that the personal data sought in the access request had been provided.

Once again, this case highlights the scope and strength of my enforcement powers. I intend to use these powers on a routine basis where the right of access to personal data is not granted promptly.