Subject Access Requests undertaken by the Police (FOI)

​Request

How many subject access requests do the police receive a year (2010 to 2021) by year, and in each year how many of these take longer than the required 28 days to fulfil?

Response

The below table shows how Jersey police have responded to subject access requests over a period of 10 years. The relevant Data protection legislation has changed during this period. The Data Protection (Jersey) Law 2005 allowed a controller 40 days to respond to a Subject Access Request (SAR).

The current legislation, The Data Protection (Jersey) Law 2018, enacted in May 2018 states under Article 27(1), that the controller should respond to the request “without undue delay and in any event within four weeks of the receipt of the request”. This time frame can be extended within certain conditions.

However, also in line with the European GDPR regulations, there is a Law enforcement directive within the new law that provides certain modifications to the law for ‘Competent Authorities’ under Schedule One. The States of Jersey Police is one of those Competent Authorities listed.

The modification to Article 27 reads, (a) the words in paragraph (1) after the words “undue delay” are omitted. This still requires those Competent Authorities to respond, without undue delay, but removes the requirement to respond within four weeks.

Numbers shown from 2015 onwards (complex column) relate to those subject access requests where personal data other than criminal conviction data was requested. These require extra work and, in some cases, considerable redaction. Criminal conviction data is always provided within any identified time scales. Total numbers after 2014 are reduced as police no longer provide conviction data for employment purposes. This is processed via the Disclosure and Barring service (DBS).