The argument was attractively simple: 

All our prayers had been answered…

Or had they? On closer examination, the legal analysis was far less straightforward than the letter suggested.

While we can’t know whether a lawyer, an AI tool or both drafted the response, it highlighted a growing problem: correspondence that builds legal arguments around selective quotations from legislation, Information Commissioner's Office (ICO) guidance and case law but doesn’t properly test whether those authorities apply to the given situation.

The problem isn’t that AI gets the law wrong — it’s that it can produce arguments that look legally persuasive while skipping over the detailed analysis required to support them.

Here, Matt Brown from our data protection team examines the risks of relying on oversimplified legal arguments in DSAR disputes and highlights the key lessons for both controllers and data subjects.

A legal framework designed for a different era

Neither the UK GDPR, Data Protection Act 2018 (DPA 2018) or ICO's guidance was drafted with widespread use of generative AI in mind.

Organisations now receive requests that appear AI-generated or AI-influenced. Some responses also appear to be AI-generated. Both sides may cite legislation, guidance and case law without addressing the facts and legal nuances that determine whether those authorities apply.

The legal framework hasn’t yet caught up. It assumes human analysis and judgement. AI makes legal arguments easier to generate but not easier to assess.

The attraction of simple answers

This challenge is particularly acute in the context of DSARs.

Few organisations welcome them. DSARs can require extensive searches, careful review and difficult decisions about exemptions, privilege and third-party information. That creates an understandable temptation to find a quick basis for refusal.

That temptation is understandable. It’s also dangerous.

A controller shouldn’t rely on a single line from a case or one paragraph of ICO guidance to apply a blanket refusal. 

It must assess the request properly, including whether: 

That kind of shortcut is precisely the type of simplification that AI-generated analysis can encourage.

To continue reading the full article, please see our website:
https://www.brabners.com/insights/data-protection/dsars-in-the-age-of-ai-why-you-should-resist-the-siren-call-of-simplicity

Talk to us

DSARs often involve complex legal and practical considerations. If you need support making, responding to or challenging a request, our data protection team can help.