GDPR - GPC - Blog 12
12 Blog Twelve, How long is a month?
In my earlier Blogs I struggled with what the words “one month” actually meant. Remember requests for SARs, erasure and restrictions are all expected to be responded to within “one month”. As if by magic the ICO has come up with an explanation.
The bottom line is you have a simple option; adopt a “universal 28 day deadline” policy or do event by event calculations.
What does GDPR say?
Throughout GDPR all response timelines are quoted as “one month”; responses to SARs, refusal of SARs, responses to requests for erasure, correction or cessation, they are all referenced to the one month deadline from receipt.
What does “received” mean?
Received means when first heard, seen, read, printed, copied, moved, viewed, deleted, forwarded or in any other acted upon by a human being. So an e-mail sitting in an inbox over the weekend is not received until it is opened and read on the Monday morning. A message left on an answer phone is not received until it is listened to.
But received date is not when GDPR starts counting.
GDPR and the ICO have issued guidance that makes it clear that despite receipt meaning one thing to humans it means others to law makers,
the clock starts ticking under different rules.
When does the clock start, when do we begin counting?
All requests are considered to become active from midnight the day they are received. So received 9 am or as late as 4:29pm on a Tuesday, the clock starts counting from the Wednesday. This applies whether or not the day that follows is a working day, for example; received 4:59 pm on a Friday; the clock starts at 00:01 am on the Saturday of that weekend.
How does a “universal 28 day deadline” work?
It means treating every request in the same way. It means opening your calendar at the day you receive the request, move to the day after and from there start crossing off the days counting one at a time. When you get to 28 that date is the deadline date by which you must respond.
What if the 28th day I cross off is during a weekend or bank holiday?
If the 28th day you cross off is a Saturday, Sunday or any public holiday, you move on until the next normal working day. That then becomes the deadline day.
This is the NHS, that’s far too simple, can’t we make it more complicated?
Well yes of course you can, for the flagellalistas, according to the ICO “one month” also means; from the day after you receive the request, whether a working day or not, until the corresponding numerical date in the next month or the last day of that month, whichever is the latest, unless the corresponding date falls on a public holiday or weekend.
For example received Tuesday 5th June 2018, deadline day is Thursday 5th July 2018.
Or alternatively for example received 31st August any year, deadline day is 30th September any year (there is no 31st September so it becomes the last calendar day of September).
If the deadline day falls on a weekend or a public holiday, you move on to the next working day to respond.
For example if 31st August is a Friday, 30th September will be a Sunday, so deadline day moves to Monday 1st October.
Why would it be helpful if we all used the “universal 28 day deadline” approach?
Because if that’s what my patients are used to they are less likely to moan when they make a similar request of your practice and you start looking for bank holidays in July and mumble about dates possibly 30 or 31 days away. If we all adopt the 28 day deadline then we establish a standard for all, patients, solicitors, everyone, and if we develop the standard it becomes the standard. Unfortunately, because of the logic above and the existence of February we can’t adopt a universal deadline of more than 28 days because it wouldn’t be universal.