Subject Access Request On House Builder

APerson

HI all

I have a question in relation to raising a Subject Access Request with our house builder.
As a quick background we have been in the property for over a year now and have had lots of issues which the builder has failed to resolve or in many cases has out right ignored. These issues range from still not having a drive fully laid to foul drainage not being connected. We are not the only house on the small estate (16 houses) which have had issues.
We have started down the NHBC and Consumer Code route and as we have, on numerous occasions, caught the builder out in their own lies within emails we felt it was about time to request all information they held on us/our property.
We sent the SAR shown below within an email which we have recived a reply by recorded delivery from the builder. In this reply the builder has requested that we complete:

• A form supplied by then (Name, DOB,Phone Number, Email)
• Provide photographic proof of identification
• Provide a bill/statement to verify our address

All of this they have stipulated must be returned to them via postal mail and they will only start processing the SAR after they are in receipt of this completed form and identification and have verified the information.

my initial questions are as follows:

1. Can the builder request this information from us and do we have to provide it?
2. Can the builder stipulate that we must send the information via postal mail?
3. Can the builder stop the SAR clock until we supply this information?

Thank you in advance for any insight and advice you can provide.

Regards

Mike

June 5, 2019
Dear Sir/Madam,

Re: Subject Access Request - General Data Protection Regulations (GDPR)

We are writing to formally make a Subject Access Request for a copy of all information about us to which we are entitled to under the General Data Protection Regulations (2018). Where applicable, this should also include all information and correspondence (internal and external) relating to our property (Plot XXXXXXXX/10 XXXXXXXX March Cambs PE15 xxx) from our plot or home file(s). This information should be supplied in a machine readable electronic format.

Please supply all the information about us which we are entitled to under Article 15 of the GDPR.

Please note, you must comply with my Subject Access Request without undue delay and at the latest within one month of receipt. The time limit starts from the day after you received this request (whether the day after is a working day or not) until the corresponding calendar date in the next month (6th July 2019).

If you require any further information from us, to comply with our request, then you may contact us at the above address, by email at xxxxx@xxxxx and xxxxxx@xxxxx or by telephone on xxxxxxxxx or xxxxxxxx.

If you do not normally deal with these requests, please pass this communication to your company’s Data Protection Officer or other appropriate official. If you need advice on dealing with this request, the Information Commissioner’s Office can assist you and can be contacted on 0303 123 1113 or at ico.org.uk

We are disappointed that we are having to use legislation to access information that we have requested on numerous occasions to which you have failed to provide.

davidmcn

Not necessary, but is it worthwhile arguing about this point and holding up getting a response about the info you actually want?

Comms69

They must be sure you are who you say you are, so ID is certainly legitimate.


But they cannot insist on either a paper form, or use of their form.


ICO if they fail to keep to the deadline.

SeaVixen

If you've sent the email from the email address which you had all other contact with them, I'd believe this counts as proof of who you are, as they would be replying to an already verified email address.
Might be worth checking with the ICO on that point, though.

davidmcn

SeaVixen wrote: »

If you've sent the email from the email address which you had all other contact with them, I'd believe this counts as proof of who you are, as they would be replying to an already verified email address.

And if the postal address is the house which they built and sold to the OP then I think that would also be an adequate link. Not sure what photo ID would add to the mix unless they think they know what the OP looks like.

bouicca21

See the code of practice issued by ICO, p23
https://ico.org.uk/media/for-organisations/documents/2259722/subject-access-code-of-practice.pdf

eddddy

It'll be interesting to see whether you get the info you want.

I'm no expert on GDPR, but I would think that notes / emails / correspondence etc like this wouldn't count as 'Personal Information' about you:

"The drains on plot 23 are faulty and need to be relaid."

However, the following would be 'Personal Information':

"The owner of plot 23 has complained about the drains. They are faulty and need to be relaid."

... because you can be indirectly identified as the owner of plot 23.

But I suspect that a lot of correspondence between the developer, sub-contractors, etc about problems with your house won't contain any information that counts as 'Personal Information' about you.

Ozzuk

As above, you are unlikely to get anything relating to your property unless it specifically identifies you. Also you have no guarantee they will supply anything incriminating - how will you know if they don't include it? The ICO hasn't the resource to audit every company they recieve a complaint for, especially as you likely won't have proof of a breach - at most they'll send a strongly worded letter (IMO).

davidmcn

Also they might have personal information which they don't have to disclose e.g. correspondence with their lawyers about your dispute with them.