Ms Helen Dixon:

It is interesting that the Chairman referenced the case studies because they are a particularly useful way to communicate with lots of controllers who are looking to understand how to comply. In our annual report this year, we published a range of new case studies. In addition to the case studies on our website, the Chairman might have seen that we have published all of the decisions we made under the 2018 Act, including the eight decisions so far in respect of which we have imposed fines. Regarding those cases, we are getting feedback from stakeholders that they find it particularly useful.

There has been significant conflation of the issues of complaint handling and enforcement. If one looks under the GDPR, one can see that complaint handling is a separate function and the only obligation on the DPC now is to handle a complaint to the extent appropriate. They are not necessarily the same thing. When I was referencing the fact that no two cases are the same, what I was really reflecting is that around those larger-scale enforcement cases, we are really having to go back to first principles. I think everyone on the committee knows that the most frequent complaint type the DPC receives year in, year out is a complaint about the exercise of the right of access. Each year, it represents at least 30% of the complaints we receive. It is probably the most important right that individuals seek to access. I am interested in the Chairman's ideas regarding ways to make it faster because we wish we could do so. In every case where an access request is made that a company refuses, or the individual perceives he or she has not received all the data, we cannot see any fast-track route to resolving that other than engaging in often iterative contact with the controller to ensure the data is finally released. It is worth thinking about and we would really like to talk about it further with the committee. It is not particularly obvious how technology could assist.