If you want to learn more about responding to SARs compliantly, the data protection experts at leading law firm Muckle LLP are offering in-person training in Teesside on Wednesday 25 November.
Through a subject access request (SAR), anyone can request access to the personal data an organisation holds about them at any time. For businesses, managing an influx of SARs can be time-consuming and demanding on resources, alongside the added pressure of responding within a strict timeframe.
It’s unsurprising that organisations are turning to technology, including AI, to support the administrative burden of SARs. However, there are real legal risks to consider.
Alex Craig, partner in Muckle LLP’s data protection team, explains the risks of using AI to respond to SARs.
The rise of AI adoption
As AI adoption increases with businesses looking to simplify their processes and save time, it’s easy to see why they may be tempted to use AI to take on the administration involved in managing SARs.
Using AI to manage SARs could help to organise key documents and automate searching. However, while AI-automated processes can help from an efficiency perspective, they also pose serious legal risks, including potential data protection breaches.
Responding to SARs compliantly
Under UK data protection legislation, organisations must consider specific factors when responding to a SAR. The Information Commission’s Office (ICO) guidance on producing a SAR response is a very useful steer on what should be included.
Responses need to include an individual’s personal data whilst protecting the rights of third parties, supplementary information (purposes of processing, data categories, recipients, use of automated decision-making including AI, and more), and any further details relating to exemptions or refusals to disclose information.
But that’s not all; organisations also have to respond to SARs within one month, except in special circumstances, such as complicated situations. Failure to deliver accurate, complete SAR responses can lead to reputational damage, fines, and in some cases prosecution, so it’s vital that organisations using AI to support SAR responses do so responsibly and with human input.
The risks of using AI for SARs
As AI continues to learn and evolve, it becomes difficult to keep track of all of the risks associated with using it in the context of SARs.
We know that AI systems aren’t always correct in their generated responses, which could result in important documents being categorised incorrectly or missed out altogether.
As SARs deal with personal data, which can include third-party or confidential personal data, the unpredictable nature of AI tools could lead to unlawful disclosures. For example, an unchecked response might disclose information relating to a different individual or matter, sensitive information or information which jeopardises an organisation’s position. Identifying and processing personal information calls for careful, supervised management to prevent data breaches, so when using AI assistance for SARs, organisations should always have clear processes in place to ensure that supervision and oversight of the process.
Minimising risk with expert advice
AI tools shouldn’t be used as a one-stop solution for responding to SARs. When built into a wider process, controlled by human input, AI can certainly reduce repetitive administrative tasks. Ultimately though, an organisation fulfilling its legal responsibility should always be the first priority when it comes to SARs to prevent fines and legal action.
It’s essential that organisations understand how their AI tools process personal data before incorporating them into the SARs process. Sensitive, confidential files identified when using AI for the SAR response should always be thoroughly reviewed by humans to prevent data breaches. Consideration should also be given to exemptions, which ultimately require contextual consideration, not automation.
The best way forward when it comes to getting SARs right and mitigating risks to your business is to seek expert advice and ensure your teams are sufficiently trained to lawfully respond to SARs.
To access expert-led training on responding to SARs compliantly, visit muckle-llp.com/ events or contact events@muckle-llp.com or 0191 211 7777.