Obtaining information under the data protection law
Your supplier is likely to hold a large amount of information about you electronically. This may include details of previous bills and consumption, credit ratings and prosecutions. If a supplier refuses to provide information voluntarily, you may still be able to get hold of this information by using your rights under data protection laws. This is known as a ‘subject access request’ (SAR). The UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 provide a right of access to the information held on you by suppliers.
To exercise your rights, contact the supplier’s data controller or data processing department. There is no standard form to make a request so long as you make it clear that you are asking for details of your own personal data held by the supplier. The supplier must respond to a SAR ‘without undue delay and in any event within one month of receipt of the request’.1Art 12(3) UK General Data Protection Regulation; ss45 and 54 Data Protection Act 2018 Generally, the supplier cannot charge a fee to comply with a SAR. However, where a request is manifestly unfounded or excessive (such as if it is repetitive or further copies of the same information are requested), the supplier may charge a ‘reasonable fee’ for the administrative costs of complying with the request. The Information Commissioner’s Office (ICO) website contains a useful guide to doing this and a sample letter.2 The supplier will then provide the information. You also have the right to:
•have inaccurate information corrected;
•claim compensation for loss caused by inaccurate information;
•complain to the ICO if the supplier fails to provide the information, to correct inaccuracies or to obtain and process information fairly and lawfully.