Third-party data related to an individual was inappropriately released due to a SAR request.
Undertaking issued to ensure that all individuals dealing with SARS receive sufficient training and guidance.
Reason for action
It transpired that the individual tasked with redacting data for this type of request was neither an employee of the data controller nor acting under process as a data processor. It was also revealed the guidance and checking of these processes was inadequate.
19 October 2010