Fee for Subject Access Request to GCHQ, Data Protection Act 2018
<p>When making a Subject Access Request to GCHQ I was told that I would have to pay a fee for this Request. The GDPR does not allow for such a fee, while the UK Data Protection Act does(Part 4 – Chapter 3 - Section 94). My Subject Access Request concerns the website of the GCHQ, and not the GCHQ's surveillance activities. Does the GDPR supersede the UK Data Protection Act in this case?</p>

<blockquote>
  <p>The GDPR does not allow for such a fee</p>
</blockquote>

<p><a href="https://gdpr-info.eu/art-12-gdpr/" rel="nofollow noreferrer">Article 12(5) GDPR</a> contains:</p>

<blockquote>
  <p>Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. </p>
</blockquote>

<p>But <a href="https://gdpr-info.eu/art-23-gdpr/" rel="nofollow noreferrer">Article 23 GDPR</a> contains:</p>

<blockquote>
  <ol>
  <li><p>Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:</p>
  
  <p>(a)  national security;</p></li>
  </ol>
</blockquote>

<p>So basically, the GDPR would allow a fee if there is specific legislation (the <a href="http://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180012_en.pdf" rel="nofollow noreferrer">DPA2018</a>) and it is considered necessary and proportionate for national security.</p>

<blockquote>
  <p>My Subject Access Request concerns the website of the GCHQ, and not the GCHQ's surveillance activities.</p>
</blockquote>

<p>I would agree it is hard to believe that asking a fee to get information concerning the GCHQ website, would increase national security. But I am afraid you would have to go to court to change that.</p>

united-kingdom privacy european-union gdpr