Navigating the Rise of AI-Generated DSARs and complaints – our top tips

In the last year, our data protection practice has changed dramatically.

We now spend a considerable time assisting clients dealing with AI-generated data subject access requests, and data protection complaints and claims.  

They are easily recognisable, from the font and tone, and use of repetition to the littering of irrelevant case law and legislation.

Whilst the use of AI can be a great enabler for data subjects, especially those who may otherwise struggle to exercise their rights or articulate complaints, it is increasingly placing a disproportionate burden on organisations.  This is especially the case where there is clearly no genuine concern about privacy and data protection rights, but where a DSAR or data protection complaint is leveraged as part of some other grievance or in an attempt to find a “smoking gun” in an employment dispute.  

Here are some tips on how to handle these types of DSARs or complaints:

1. Less is more: Keep your responses brief and focus on what you believe the key issues to be.  Do not feel the need to respond to every point raised.
2. Don’t feed the machine: Do not use AI to argue with the AI – this will only result in protracted and unproductive exchanges.
3. Let the process take its course: If a data subject threatens regulatory or legal recourse, sometimes it is better (and more efficient) to let those processes run their course.
4. Hit pause: Consider whether you should leave several days or even a couple of weeks before responding in full to give the data subject time to reflect and allow any heightened emotions to settle.
5. Be kind: Maintain a courteous tone, no matter how cross the AI may be!
6. Manage data subjects’ expectations:  Sometimes AI will make people believe that a DSAR will reveal a treasure trove of hidden information.  The reality is often disappointing to data subjects.  Therefore, making clear which exemptions are likely to apply to the DSAR response could help temper expectations.
7. Know when to refuse:  Consider whether there is any justification to refuse a DSAR outright if it is manifestly unfounded or manifestly excessive.

Whilst AI may be generating more DSARs, good AI-powered software can also significantly reduce the time spent on the actual response.  In that sense, AI is both friend and foe!