Five data requests that went wrong, and what actually got the data out
- Area:
- Consumer
- Decision body:
- The Information Commissioner's Office
- Decided:
- October 2026
On this page
The issue
Between February and May 2026 one person asked five companies for a copy of the personal data they held about him. He needed the data for complaints and disputes he was running with each company, about a motor claim, card payments he says he never authorised, and accounts he could not see. A company has one month to answer such a request. It can take up to two months more for a complex request, but only if it says so within the first month.
- First Central Insurance Management Limited (1st Central), his motor insurer, answered on time but left out the engineer's costed report, the market valuation and the money figures in the claim notes. It also blacked out material without saying why. Its data protection officer wrote: "Please note it is not a right to documents."
- PayPal sent nothing. The address PayPal publishes for data requests replied automatically that it was "no longer monitored", on the day of the request and again a month later.
- Metro Bank answered within 30 days but left out call recordings, branch-visit records, card reissue records and statements.
- TSB Bank sent no acknowledgement, no data, no extension and no refusal.
- Booking.com, where he is a host, ran an identity check after three weeks and then sent nothing in time.
What was provided
- A complaint to the Information Commissioner's Office about each company once the month had passed, between 37 and 63 days after each request.
- Follow-ups to the ICO: a status request, a request for review on the day one complaint was closed, and updates with new evidence.
- Directly to the companies: letters listing exactly what was missing, and letters before claim under section 167 of the Data Protection Act 2018, which lets a court order a company to comply.
How would you have decided?
Vote to see how other readers answered and what the decision body said.
Partly won
The outcome
As far as his emails show, the ICO got none of the data released.
- PayPal. The ICO closed the complaint on day 12 without investigating it, and a review upheld the closure. By 6 October, 178 days after the request, PayPal had sent nothing.
- Metro Bank. The ICO's decision came on day 79. Metro had already sent statements and some of the visit records in June, three days after he challenged it directly. A week later it sent a call recording it had missed, in a file whose password was to follow by post, and he still had no password in October. Metro had also tried to treat his follow-up as a new request, which would have restarted the one-month clock, and said its CCTV had been deleted after 90 days.
- First Central. Never given to a case officer, 185 days on. In May the ICO said it handles complaints "strictly in date order", was "currently working on cases from mid-September 2025", and hoped to allocate his "within the next twenty weeks". The figures First Central held back reached him in September by another door: the Financial Ombudsman Service's answer to his own data request to it.
- TSB. Never given to a case officer, 115 days on. TSB said it had "been unable to locate any record" of the request. It sent the data 21 days after his letter before claim, and 164 days after the request. He says it is still incomplete.
- Booking.com. Never given to a case officer, 84 days on. Booking.com extended its deadline after the first month had already passed, then said it could not verify his identity, and that it does not send a copy of data a host can already see in its partner portal. No data by 6 October.
Two more complaints are left out of this account because they are tied to cases before a court.
What it means if you are in the same position
- Complain to the ICO once the month is up, but do not wait for it. Its own updates say: "You don't need to contact us to keep your complaint open."
- Expect a queue. The ICO takes complaints in date order, and in May 2026 it was about eight months behind.
- Three months with no progress lets you ask the First-tier Tribunal to order the ICO to respond, as its own update letters say (section 166 of the Data Protection Act 2018).
- A specific challenge can work faster than the regulator. List exactly what is missing. Metro sent more within three days.
- A letter before claim under section 167 is what moved TSB. Going to court carries a risk of paying costs, so weigh that first.
- Keep proof of when and where you sent the request. TSB said it had no record of it.
- Do not accept a restart. Metro tried to treat the follow-up as a new request, which would have reset the clock, and he disputed it the same day.
- Someone else may hold your data too. The ombudsman's file held what First Central would not send.
Where it went next
First Central has a new request from him, due on 18 October. TSB's disclosure is disputed as incomplete. PayPal's request is still unanswered, and Booking.com's has produced no data. The Metro Bank complaint is closed. This is one person's experience, not advice on your case.
Updates
- October 2026. Checked against the papers and emails in the matter. One line was added on why he made the requests. Nothing in the account of the five companies was found wrong.
- October 2026. Reworded so that the matter is told by the person's role, with nothing to say whose it was. No fact changed.
Comments
Comments are read before they appear.
This story is one matter, told from its papers. It is general information, not guidance on your situation, and one outcome says nothing about another. Docketory is not a firm of solicitors.
This story may change. It is told from the papers as they stood when it was written. If new evidence comes to light, or a court, an ombudsman or a regulator decides something new about the matter, the story is updated, or the part now before a court is taken out, and the change is noted at the end of the story with the month it was made. The poll's question and answers never change, so a vote cast before an update stands as it was cast.