Part 3: Law enforcement processing Chapter 3: Rights of the data subject Sections 51 to 54: Supplementary
These sections make supplementary provisions about the exercise of data subjects’ rights through the Commissioner. These are broadly in line with the provisions of the 1998 Act, in that information should be made available in the format it was requested (where practicable), but any means are permissible and responses for information can be delayed whilst the identity of the requester is verified. However, in contrast to the 1998 Act, section 52(5) provides that the controller must respond to a subject access request free of charge (the 1998 Act permitted data controllers to charge a fee of up to £10).
	Section 53, however, makes special provision for subject access requests that are "manifestly unfounded or excessive". This may include requests that are repetitious, are malicious in intent or where they represent an abuse of the rights to access, for example by providing false or misleading information. Similarly, data subjects might attempt to use the right of subject access as a means to harass law enforcement bodies with no real purpose other than to cause disruption to the organisation. This can be in the form of repeated requests over a relatively short period of time or extending over several years, or where the controller has provided the data subject with their personal data through an alternative disclosure mechanism. In these circumstances, the controller can charge a reasonable fee (subject to any prescribed maximum) to act on the request or can refuse the request entirely. The burden is on the controller to demonstrate that the request is manifestly unfounded or excessive.