ICO publishes new AI-assisted SAR guidance

The Information Commission (ICO) has published new guidance addressing subject access requests (SARs) compiled with the assistance of artificial intelligence (AI). The AI-assisted SARs (AI-SARs) guidance is a supplement to the ICO's right of access guidance and is designed to help organisations comply with Article 15 of the UK General Data Protection Regulation (GDPR). 

The ICO recognises that AI tools can help individuals obtain information held about them, particularly when they are uncertain about how to exercise their rights. However, the ICO warns that AI-SARs can introduce significant administrative difficulties for both applicants and recipient organisations. AI-SARs are often excessively lengthy, repetitive, or vague, which can obscure any specific personal data being sought. Furthermore, AI-SARs are often confusing, overly broad, target low-value technical metadata, or contain inaccuracies and hallucinations. As a consequence, responding to these machine-generated requests can prove complex, resource-intensive, and demanding for operational teams.

To accompany the AI-SARs guidance for organisations, the ICO has published a consumer version to help people write their SAR or file a data protection complaint. 

Training Announcement: Freevacy offers a range of short one-day courses on a range of data-related subjects, including data protection topics such as how to handle SARs, conduct DPIAs, and implement privacy-by-design, as well as how to use AI tools responsibly, cybersecurity best practices, and information access. The interactive sessions cover basic concepts through to advanced examinations of specific areas. Find out more.