Privacy Request Statistics

#

Each report covers one calendar year and includes:

• Privacy requests from individuals: the number of requests to know or access, delete, correct, opt out of sale, and limit the use of sensitive personal information; how many we complied with in whole or in part; how many we denied; and the median number of days we took to respond.
• Disclosure requests from Agencies: the number of requests submitted, released, denied, declined, withdrawn and expired, broken down by case type.
• Requests from other authorities and third parties: the number of requests we received under legal process or in an emergency from bodies that are not Agency customers, as described in Requests from Authorities & Third Parties, and how many resulted in disclosure. Where the law allows, requests under non-disclosure orders are reported in ranges.

Figures are aggregated so that no individual, Agency or case can be identified.

#

• A request is counted once, under the type the requester chose. A combined request, such as delete and opt out, is counted under each type.
• Complied with in whole or in part includes opt-outs we applied to an advertising ID even where we held no data for that ID.
• Denied includes requests we could not verify, requests from unauthorised agents, and requests the law allowed us to refuse.
• Median days runs from receipt to our substantive response.
• A disclosure request that expires before a decision is counted as expired, not as released.

#

The report is published here each year. A draft of the current report, including the underlying data where needed, is available on request from [email protected].