WITNESS STATEMENT

On 5 September 2024, the Claimants submitted a DSAR directly to Citizen New Homes Limited. No response was ever received. On 9 September 2024, a further DSAR was submitted to Vistry Group, which named Citizen as the data controller due to a Data Processing Agreement. That request was answered. On 26 September 2024, a follow-up request was sent directly to Citizen, seeking information that had not been disclosed in the Vistry reply. Again, no response was received.

The Defendant has taken the position that no further responses will be given, on the grounds that a DSAR was already answered. The Claimants submit that this position is incorrect in law. Under Article 15 of the UK GDPR, a data subject has the continuing right to access personal data held by a data controller, and that right cannot be limited to a single request. A response to a DSAR addressed to a separate firm (Vistry) does not discharge the legal duty to respond to DSARs addressed directly to Citizen New Homes Ltd.

The first DSAR was made prior to the one addressed to Vistry and has never been answered. The third request was a legitimate follow-up. The Defendant’s blanket refusal to respond to these requests amounts to an ongoing and unjustified interference with the Claimants’ rights of access under data protection law.