The Information Commission has reacted to the sharp rise in businesses being bombarded with so-called “AI-clog” by issuing new guidance on AI-assisted subject access requests, designed to help organisations tackle the issue.
The guidance comes as more and more people are using AI tools to draft data requests, creating new operational hurdles for organisations.
The ICO reckons that people are increasingly relying on AI to overcome uncertainty about how to make a request or because they believe formal legal phrasing makes an organisation take them more seriously.
However, AI-generated requests are frequently overly long, repetitive, and broad. This makes it difficult for teams to pinpoint what personal data the individual actually wants.
In addition, AI tools often insert irrelevant legal references, cite laws from foreign jurisdictions, or demand low-value technical metadata outside the scope of a reasonable search.
The ICO outlines how organisations can apply existing data protection rules to respond effectively without being overwhelmed by complex AI-generated text.
The regulator is quick to point out that using AI to draft a SAR does not make the request invalid. If it is clear that an individual is asking for their personal information, organisations must treat it the exact same way as any standard SAR.
In addition, drafting a request with AI does not automatically make it “manifestly unfounded or excessive”. While some people may use AI to cause disruption through repetitive or massive requests, organisations must evaluate all circumstances before refusing a request on these grounds.
The ICO stresses that organisations must also look past AI hallucinations, foreign legal citations, or bundled service complaints to identify the core request for personal data.
The regulator advises organisations to keep their SAR processes straightforward so people feel less need to rely on AI. Recommended steps include providing a clear point of contact, publishing optional example templates or prompts, and reminding users to review AI drafts before hitting send.
Finally, organisations are being urged to train staff so they are not intimidated by lengthy, legalistic AI requests; they should also clearly communicate response timelines and explain that specific requests lead to faster results.
The guidance concludes: “Most people make SARs because they genuinely want to obtain their personal information. They may use AI because they think the request needs to be formal or that you’ll take it more seriously if they include legal references. They may also not know how to make a SAR.
“SARs should be straightforward. Making the process simple and clear can reduce the likelihood of receiving overly complex or wordy SARs that are difficult for you and the requester to understand. While you can’t discourage people from using AI if they want to, you can offer to help them with their request.”
Related stories
‘AI clog’ on the rise as ICO rejects 45% of complaints
All you need to know about the changes at the ICO
Information Commission set to launch without a chair
Search begins for new boss of Information Commission
Union demands ‘urgent action’ as ICO row escalates
Be the first to comment on "ICO acts over huge rise in AI-assisted data requests"