As ever, I thank noble Lords for raising and speaking to these amendments. I start with the stand part notices on Clauses 9 and 36, introduced by the noble Lord, Lord Clement-Jones. Clauses 9 and 36 clarify the new threshold to refuse or charge a reasonable fee for a request that is “vexatious or excessive”. Clause 36 also clarifies that the Information Commissioner may charge a fee for dealing with, or refuse to deal with, a vexatious or excessive request made by any persons and not just data subjects, providing necessary certainty.
5.45 pm
It is important to be clear that controllers already have the ability to refuse or charge a reasonable fee for “manifestly unfounded or excessive” data subject requests. However, the scope of the current provision is unclear, and there are a variety of circumstances where controllers would benefit from being able to confidently refuse or charge a reasonable fee for a request. The Government are introducing the new “vexatious or excessive” terminology to clarify the scope of the provision. Clause 36 amends the grounds for refusing to deal with a request to ensure consistency with this terminology and clarifies that the Information Commissioner may refuse a request by any persons, not just data subjects.
On Amendment 24, the Government believe that it is reasonable to consider
“the resources available to the controller”
as one of the new circumstances for controllers to determine “vexatious or excessive” requests. This will give controllers the confidence to focus resources on responding to reasonable requests.
Today, controllers can already consider resources when refusing or charging a reasonable fee for a request. The Government do not want to change that. The current ICO guidance sets out that controllers can consider resources as a factor when determining whether a request is excessive. We expect the new parameters to be considered individually, as well as in relation to one another. A controller should consider which parameters may be relevant when deciding how to respond to a request. Thus a controller may also consider available resources when deciding whether to respond to a request in full—for example, where the resource impact of responding would be minimal, even if a large amount of information had been requested.
I will take Amendments 25 and 26 together. They would require controllers to provide evidence for why a request is considered vexatious or excessive. In the view of the Government, these amendments are redundant, because the Bill already requires controllers to provide data subjects with reasons for why and when they have not acted on data subject requests. When a data subject is not satisfied, they have the right to complain to the controller and then to the ICO. If they are still not satisfied, the data subject can take the controller to court to attempt to resolve the dispute.