Data Protection Act 2018 and subject access requests: easier for employers to resist? Caroline:Yeah. § 0.39a, the Counsel for OPR reports directly to the Attorney General and Deputy Attorney General. Maybe sometimes what happens is people will anonymise their statements or they will redact the statements. Really, what we need to look at is the fairness of that. Seamus: Yeah. The Guidance provided by the Information Commissioner's Office clarifies that the right of subject access is motive blind. Indeed,… They never knew who the witnesses were. This was postponed until 29 September, because Mrs Smith was unwell and then on annual leave. How do I know that these witnesses don't have it in for me in some way that their bona fides are genuine, that there isn't an ulterior motive? There could be allegations these witnesses don't like the individual itself. COVID-19 Restrictions: Government Support for Closed Businesses; Disciplinary Issues & Remote Working, Conduct Dismissals - Key Considerations by Tribunals. This meant that the exemption from subject access relating to a confidential employment reference could only be applied by the person giving the reference and not the recipient. There is a degree of uncertainty here, but clearly government introduced the provision so that employee personal data of a “certain type” (whatever that means) are not disclosed. Failure to comply with a Subject Access Request. when the requestor faces an allegation … This is not the case with the equivalent exemption in the DPA 2018, which omits the phrase “given by the data controller” and states: “The listed GDPR provisions do not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of … employment (or prospective … employment) of the data subject” (paragraph 24, Schedule 2). It can be hard to guarantee that the individual that at the time. Dealing with a SAR can be challenging enough. Certainly, there's no doubt in the best of the world that you would have a fair trial, even at the disciplinary stage where you maybe have witnesses attend the disciplinary hearing and allow cross-examination to take place. But from a complainant's point of view, you're saying, "Well, hold on. If the information does not fulfil the definition of personal data then the University does not have to disclose it in response to a subject access request (although you may choose to do so at your discretion). In part 1 of this blog series, we asked how employers facing a Data Subject Access Request (DSAR) should be dealing with ‘mixed data’ cases, i.e. Really sometimes it's hard at times to make correct decisions and to make right decisions unless you see the whites of the eyes and the person is sitting in front of you. The extensive SAR was refused on the basis of proportionality. It is not uncommon for somebody who is part-way through a process, such as a performance management process, sickness absence management process, redundancy situation or disciplinary process, to put in a subject access request under the Data Protection Act. Also, in relation to whenever you get to hearing and the right for the person to have a fair trial. Employers should not refuse to respond to a SAR on the belief that it is made for an improper purpose. They wouldn't be able to block an employer from saying, "Hold on a second. You don't know if they're bullies. Following an investigation, she was invited to a disciplinary hearing on 5 September 2016. I just want to keep a lid on it.". If it has just been received post-25th of May, it'll be under the new GDPR regime. http://employmentblog.practicallaw.com/data-protection-act-2018-and-subject-access-requests-easier-for-employers-to-resist">. [email protected], If there's anything you'd like to ask us, just fill in the form on the contact us page:Contact Legal Island, © Copyright 2020 | Legal Island, Island House, 5 Steeple Road, Antrim, BT41 1DN | Tel: 028 9446 3888. The controller who receives the reference, who can now argue that he or she has been “given a confidential reference” and refuse access. The investigation process Employers should draw a clear distinction between the investigation process and a disciplinary procedure ideally by ensuring they are conducted by different people. I can understand that. If it were to go to that level, there's a very good chance that information would be discovered and there's a very good chance the tribunals would look at the Walkers Snack Foods case and they'd look at the Linfood Cash and Carry case about what you do when you have to anonymise witness statements. Scott: Just before we move on, we've got another GDPR question coming in on the chat box. A third party can also make a SAR on behalf of another person. I think I can control this. There's nothing, really that would in law allow a witness to say you can never use my name at any stage. Required fields are marked *. . Subject access requests – when an employee asks to see any personal data held on them – can throw legal negotiations into disarray if employers do not tread carefully. It is a practitioner, it's a question that you get asked quite a lot and people do have concerns about their information and even from the advice I would give to HR advisors that would call through to me, that is definitely a concern they would have. The main content of this article was provided by Seamus McGranaghan. It seems to be an internal disciplinary matter. Enter your registered email address below and we will send you a link to reset your password. Disciplinary Issues During Remote Working – How Do I Handle It? The GDPR is not there to stop the efficient process of discipline and grievance procedures. Seamus: Absolutely not. Contact telephone number is To respond to a DSAR, employers will likely need to sift through vast amounts of information to find data relating to a particular individual, whilst also ensuring that the privacy of others is protected. We regret we are not able to respond to requests for specific legal or HR queries and recommend that professional advice is obtained before relying on information supplied anywhere within this article. Jennifer McGrandle advises on how to deal with them. In summary the answer outlined that the employer should investigate the reasons for the anonymity request and balance the complainant’s right of confidentiality with the accused right to a fair hearing. What Does Effective Performance Management For Remote Teams Looks Like? It also deals with the issues that arise when an individual asks you for access to personal data held about somebody else in a complaint file under either FOIA or the EIR. I guess the starting point when you're dealing with any investigation, whether that be a discipline, whether that's a grievance, no matter what the matter or the issue is, the first thing we need to do is to look and see what is the policy that's in place in the organisation that we have given the employee and that is our procedure because we're obliged then to follow that and there is an element of guidance in relation to we have a code of conduct, which is the SI-146. F… The bottom line is this could be discovered if it goes to tribunal. This is a typical situation that arises in disciplinary whereby maybe somebody confidentially comes to their own manager, makes a complaint and would be very uncomfortable with their details being provided or sometimes even on a general risk assessment, you can say to yourself it wouldn't be wise to provide the details of the complainant to this person. The right to be informed, so a prospective employee might be unaware of the fact that a confidential reference about him or her has been given or received. If the result of a subject access request is that somebody else's privacy is infringed, then it's an adverse affect. Employers be warned: failure to respond properly to a subject access request (“SAR”) can lead to a finding of unfair dismissal. . For example, when an employee exercises the right of subject access to personal data concerning complaints made by another member of staff (e.g. We have been seeing a rise recently in the number and complexity of Subject Access Requests (SARs) being made under the Data Protection Act 1998 (DPA 1998). I'm going to keep them quiet and anonymous." Disciplinary investigations can be protected. It covers what you should do when an individual makes a subject access request under the GDPR and the DPA for access to their own personal data in a complaint file. There's a very stiff burden, if you like, on that. This business, this organisation needs to keep functioning. The scope of the SAR was then limited to certain search terms relevant to the disciplinary proceedings, but was again refused on the basis that it was unreasonable. However, one “type” of information that is likely to be withheld on subject access is any information that has been given, for example, to the HR department, in confidence, by an employee who is a witness to another employee’s behaviour. Mrs Smith informed Talon that her union representative was unavailable on 29 September and suggested alternative dates just under two weeks later. Confidential references become more confidential. You can see a circumstance where possibly a manager will say, "I think I can keep a lid on this. It's about sitting down and working through the ups and the downs, the rights and wrongs and hopefully arriving at a fair decision. Subject access requests are a useful weapon for the disgruntled employee. Following her suspension, she made a subject access request (SAR) under section 7 of the Data Protection Act 1998. 1 Your right to make a subject access request. Really, what you need to do is weigh it up and assess it. Under the ACAS Code of Practice on Disciplinary and Grievance Procedures, employers should always conduct a disciplinary meeting. A subject access request applies to all personal data held by the University. Seamus: Yes. Alternatively, they will take parts of the statement and create one block page with maybe five or six of the comments that were contained within statements. You can't use my witness statement because it involves my name and I've got a right under the GDPR that you can't divulge that to somebody else." And you can no longer charge for it as well. Those are the preliminary points on that. Comment document.getElementById("comment").setAttribute( "id", "cc914def5d73b4e937af313dacb88661" );document.getElementById("51e063523b").setAttribute( "id", "comment" ); …thinking on various aspects of employment and discrimination law from our team and leading commentators. This is why in the Information Commissioner’s advice, the recipient of an employment reference was told: “We explained that organisations are generally required to release references they have received about individuals, even if they are marked as confidential”. But in the context of the UK obtaining an adequacy finding for the post Brexit scenario, I would suggest this is another measure that supports the view that the UK Government does not have citizens best interests at the heart of what it does. I suppose the real test will come down to if there was ever an employment tribunal claim taken and the LRA Code of Practice does have some guidance on witnesses. or email You have those sorts of issues. That gives us some guidance around what o… There are all sorts of issues that can arise there. One of the most difficult aspects in data protection occurs when an SAR is made in relation to personal data which contain personal information about another individual. The Office of Professional Responsibility (OPR) was established by order of the Attorney General to ensure that Department of Justice attorneys and law enforcement personnel perform their duties in accordance with the highest professional standards expected of the nation's principal law enforcement agency. At first glance, one might think the answer to this question was rather obvious, in that the employee raising the grievance is going to want to see that the investigation has been done thoroughly and fairly in order to be able to accept that the employer is following the correct processes based on the evidence. ... (e.g. Individuals can make SARs verbally or in writing, including via social media. Employees have a right to make a data subject access request (DSAR) under the GDPR. At discipline or the disciplinary hearing, I chose to withhold the employee's names as it served no purpose to disclose. It's the employers saying, "You know what? This right of access means you can ask to review and … It comes down to your justification and if it is justified and if it's the correct decision to make based on the circumstances, I think that should be recorded at the time in writing so that if it is challenged at a later date, you say, "Well, look, this is the circumstance that I was presented with at the time and I believed this was the right step to take.". I have received a subject access request asking for all information on the employee pursuant to section 7 of the Data Protection Act 1998 (DPA), including his personnel file and all other documents relating to the grievance, even though it is still ongoing. The employment tribunal (ET) case of McWilliams -v- Citibank NA considered whether non-compliance with a subject access request made in the context of disciplinary … We don’t know why this provision was introduced. Where a disciplinary investigation results in the decision to proceed to a disciplinary hearing, the employer should provide the employee with copies of any witness statements and other written evidence that will be referred to in the hearing. In summary, the confidential reference exemption in the DPA 2018 now extends to: Disciplinary investigations can be protected. If the employee is off sick or because they’re at a very early stage in the process, they may not even be aware that, for example, a disciplinary investigation … Following EU-wide changes to data protection rules, introduced in the UK as the Data Protection Act 2018 (GDPR), you can make a subject access request for free. The witnesses would not be able to block on the other side either. The Information Commissioner has powers to enforce the right of access in the UK. In most circumstances, you cannot charge a fee to deal with a request. The employment judge will always encourage the sides to agree it themselves. Pursuant to 28 C.F.R. SARs are often used as a mechanism for pre-action disclosure by current or former employees for the purposes of actual or intended litigation. Writing your Subject Access Request. Your email address will not be published. If you are a lawyer or work in a legal capacity, please register for a free trial to see if Practical Law’s resources are right for your business. I am conducting review of a grievance brought by an employee. A High Court case where judgement was handed down last month shows the complexity of this area of the law and how SARs can be used to try and halt or hinder corporate investigations. Whilst absent, he sends an email complaining that he is being targeted because of his race and religion and submits a Subject Access Request (SAR) specifically asking for a copy of the unredacted statements from colleagues collected during the investigation, sales figures of other staff and a breakdown of sales figures and client data. There's a whole series of issues there when you come to anonymity, particularly if in this case or as in this case, it's not the witnesses saying we are scared of this complainant. Employee Data Subject Access Requests: Part 2 – It’s complicated – extending the DSAR deadline (UK) ... schooling, skills and qualifications, health information, performance data, pay history, grievances, disciplinary actions, bank details, next of kin details, and possibly biometric data and CCTV/call recordings. Thus, if a controller is a private body (that is, not an “FOI public authority”), then the processing of manual unstructured personal data is not subject to the DPA 2018 (section 21(2)). I want a fair trial. This was a manager who decided look, "For the sake of good employment relations, I'm going to pour oil on troubled waters. On 18 December last year, the Prime Minister told the House of Commons that “we will maintain, and indeed enhance, workers’ rights”. But where they have to, they'll make a decision and it will be based on the principles as we talked about in the Walkers Snack Food case. Because the reality is they're all going to have to work together tomorrow. The Information Commissioner’s Subject Access Code of Practice suggests that the organisation should tell the employee that it needs the further information too. As the “listed GDPR provisions” (in paragraph 18 of Schedule 2 to the DPA 2018) include the right to be informed (Articles 13 and 14 of the GDPR), the existence of any further confidential reference might not be transparent to the prospective employee. I've been on many a case where we've had to go down before the employment judge and argue our case as to why documents, full documents on redacted documents should be provided and times why they shouldn't be. If I don't know who they are, I don't know if it's because I've done something bad to them or they've done something bad to me. Can we continue with a disciplinary process if the employee leaves before the process has concluded? So, when constructing the DPA 2018, the government was faced with a political choice. It would only cause more negative behaviour in the working environment and the testimony was such that the behaviour was undisputed. The basis of the discipline was on reported behaviour from a number of other employees. A Subject Access Request (SAR) is a mechanism under data protection law that allows an employee to request copies of any personal information related to them held by their employer. New ICO Guidance on Subject Access Requests and Education Data, The Importance and Key Components of A Data Privacy Policy In The Workplace, Neurodiverse Employees - Data Protection Implications, Hopkins v Revenue and Customs Commissioners [2020]. Investigations are covered by the Acas Code of Practice on disciplinary and grievance procedures , which is the minimum a … McWilliams v Citibank NA also highlights the importance of carrying out thorough disciplinary investigations. The evidentiary material obtained during an investigation will also be used during subsequent disciplinary proceedings, and act as a preparatory stage to a disciplinary process. The General Data Protection Regulation (GDPR) and Data Protection Act 2018 have now been in force for over 2 months. One of the most difficult aspects in data protection occurs when personal data, subject to an access request, contains personal information about another individual. It would only cause more negative behaviour in the working environment and the testimony was such that the behaviour was undisputed. The government has ensured there is no right of access to these handwritten notes if they comprise “manual unstructured personal data” as defined in the DPA 2018, where the content of the notes relate to employment matters. You would say look, it's a balancing exercise. In addition, the exemption did not exclude the fairness requirements of the First Data Protection Principle, so a prospective employee should know that personal data containing an employment reference had been given. They can cost a business significant time and money as well as potentially disclosing a … Part of that aspect absolutely could be that they were never allowed to cross-examine witnesses. The claimant was a foreign exchange trader at Citibank and was dismissed following allegations that she had breached client confidentiality in her use of trading chat rooms. It's a twofold test really, it's data protection rights of the person that the allegation has been made against because they'll be saying if this is about me, I'm entitled to know. The DPA 2018 makes it easier to protect such personal data from the right of access because when deciding whether it is reasonable to release of the information concerning that other individual, account has to be taken of “the type of information that would be disclosed” (paragraph 16(3)(a), Part 3, Schedule 2). This could risk legal action. The inference is that information of a certain “type” should not be disclosed as part of an SAR. So there are those aspects. The Data Protection Act 2018 (DPA 2018) contains three provisions that allow an employer to resist subject access requests (SARs) from employees. It’s that versus the rights of the anonymity for the other parties. This is commonly referred to as a subject access request or ‘SAR’. But it does come down to fairness and ultimately, I suppose, there would be an entitlement at a tribunal stage. It's not dismissal and so on. Despite the Court of Appeal case of Durant v FSA making it clear that employees should not use Subject Access Requests (SARs) to embark on \"fishing expeditions\", it would appear that employees are continuing to do just that. Hi, I have a query regarding subject access requests. You as the manager will have an understanding of that, where specifically the person who's coming to you and saying, "I want to raise a complaint, but I want this to be kept anonymous." We know from that there's a reduction in the time to provide the response to that to four weeks rather than six. Scott: Also, controlling the process because this caller here, this listener here knows the situation. The Data Protection Act 1998, under the heading “Confidential references given by the data controller“, stated that personal data were exempt from the right of access: “if they consist of a reference given or to be given in confidence by the data controller for the purposes of … employment, or prospective … employment, of the data subject” (emphasis added) (paragraph 1, Schedule 7). However, this opened the prospect that public sector employees would have preferential subject access rights merely because their employer was an “FOI public authority”. The information in this article is provided as part of Legal-Island's Employment Law Hub. If the employer does not carry out a reasonable investigation, any decisions they make in the disciplinary or grievance case are likely to be unfair. Seamus: This is interesting in terms of subject access requests. Is there an exemption which could be applied to avoid complying with a request by an employee for information that relates specifically to an ongoing, internal disciplinary investigation concerning said employee? Absolutely understandable. Really, they're looking at a big justification of threats of violence and such towards witnesses about steps the employer would have to go through to make sure they trust the witnesses and so on before they go forward. Since the 25th May 2018, our employment and privacy teams have seen a large increase in the number of clients who are receiving subject access requests from both staff and customers. With all employees now more aware of their rights to access information held on them from GDPR training, I have had a request for a subject access request from an employee that has recently been disciplined. This would protect an investigation until it had concluded. What information do I have to disclose in a Subject Access Request and can I provide redacted copies of evidence to keep the anonymity of those involved? The Data Protection Act 2018 (DPA 2018) contains three provisions that allow an employer to resist subject access requests (SARs) from employees. Seamus: This is interesting in terms of subject access requests. In a workplace investigation allegation letters are used to advise the person subject of the complaint about what has been alleged and also to invite that person to attend an interview to provide their version of events or their side of the story. The undermining of the rights of employees in this way, leaving them potentially unable to defend themselves against accusation fails the fairness test. There's no indication from the email I got that it was the witnesses themselves were saying, "Keep me anonymous." I can get a resolution for all of these parties. The scope of a Data Subject Access Requests (DSAR) is wide ranging and has become a staple action point in the itinerary of an employee embarking on a contentious internal or external litigation process with their employer. Inspection of section 24(3) and (4) of the DPA 2018 shows that the government chose to take any prospect of access to unstructured employment notes away, even though these notes could be important from an employee’s perspective (for example, to show that the formal record of a disciplinary hearing did not accord with the contemporaneous handwritten notes). This could happen when an employee makes an SAR in the context of complaints made by another member of staff (for example when the employee faces an allegation of bullying). Use the Subject Access Request letter template to ensure that you make your request accurately in order to obtain the information you need. Have you ever been to a meeting where someone has taken handwritten notes of what was said? Have the minutes of that meeting, subsequently circulated to attendees, been completely different to your recollections of the actual meeting? It could legislate so that all employees could have access to unstructured manual employee personal data or it could take away the public sector employee’s right of access to such unstructured manual employee records. At discipline or the disciplinary hearing, I chose to withhold the employee's names as it served no purpose to disclose. Disciplinary hearing, I chose to withhold the employee 's names as it served no purpose to disclose whenever... ( GDPR ) and data Protection Regulation ( GDPR ) and data Protection Act 2018 subject... Highlights the importance of carrying out thorough disciplinary investigations can be protected n't be able to an... Are often used as a mechanism for pre-action disclosure by current or employees. A mechanism for pre-action disclosure by current or former employees for the purposes of actual intended! On it. `` be under the heading `` confidential references... disciplinary investigations can be protected a fee deal... Or the disciplinary hearing, I suppose, there would be an entitlement a... Resolution for all of these parties you know what: just before we move on, we 've another. To have to work together tomorrow 's the employers saying, `` keep me anonymous. why this provision introduced! We know from that there 's nothing, really that would in law allow a witness to you! Of other employees that of the data Protection Act 1998, under the ACAS Code of Practice disciplinary. Jennifer McGrandle advises on how to deal with a request efficient process of and. I chose to withhold the employee 's names as it served no purpose to disclose four weeks rather six... ’ t know why this provision kicks in when an employer from saying, `` hold.! Protect an investigation until it had concluded I Handle it stop the efficient of! Negative behaviour in the working environment and the testimony was such that the individual itself s that the... Issues During Remote working – how do I Handle it terms of subject access requests the behaviour undisputed. Data is intertwined with that of the requester? be under the ACAS Code of Practice disciplinary. Working – how do I Handle it enforce the right of access in the opposite direction the bottom is. In writing, including via social media fairness and ultimately, I,. A reduction in the opposite direction saying, `` I think I can get resolution. Been completely different to your recollections of the data Protection crunch, the government was faced with political. 'S an adverse affect like, on that confidential the data Protection crunch, the Counsel for reports... The employment judge will always encourage the sides to agree it themselves lid on this circumstance where possibly manager. Was unwell and then on annual leave 's employment law Hub Performance Management for Remote Teams Looks?. There to stop the efficient process of discipline and grievance Procedures the new GDPR regime on.. Was said been received post-25th of May, it 's a reduction in the UK of other employees of. To obtain the information in this way, leaving them potentially unable to defend themselves accusation... Do I Handle it or intended litigation of another person the disgruntled employee for OPR reports to! Side either handwritten notes of what was said was faced with a request say look, it 'll under! Request letter template to ensure that you make your request accurately in order to obtain the information need! Subject to the prospective employee seamus: this is interesting in terms of subject access request ( SAR under... Employment judge will always encourage the sides to agree it themselves for an improper purpose access in the direction. The disgruntled employee circumstance where possibly a manager will say, `` hold on goes to.. Support for Closed Businesses ; disciplinary Issues & Remote working, conduct Dismissals - Key Considerations Tribunals... A Deputy Counsel, and Assistant Counsel unavailable on 29 September and suggested alternative dates under... Conduct a disciplinary process if the employee leaves before the process because this caller here, organisation... Data subject access requests that it was the witnesses themselves were saying, keep! It was the witnesses themselves were saying, `` I think I can keep a on. Was faced with a political choice is they 're all going to keep them quiet and.! Working in the working environment and the testimony was such that the government working... A right to make a data subject access request or ‘ SAR ’ look, it 'll be the... How to deal with them it has just been received post-25th of,. All of these parties Commissioner has powers to enforce the right for the person to a! Environment and the testimony was such that the individual that at the.!: this is interesting in terms of subject access request is that of. Hearing and the testimony was such that the individual that at the time not there to stop the process! The witnesses themselves were saying, `` I think I can keep a lid on this to your! The sides to agree it themselves for the disgruntled employee am conducting review of a grievance brought by an.... Request or ‘ SAR ’ hearing, I chose to withhold the employee 's names as it served no to... Sars verbally or in writing, including via social media could be allegations these witnesses do want. Teams Looks like was postponed until 29 September and suggested alternative dates just under two later. No indication from the email I got that it was the witnesses not! Purpose to disclose requests: easier for employers subject access request disciplinary investigation resist Hi, have... Accurately in order to obtain the information you need to look at is the fairness that... Interesting in terms of subject access subject access request disciplinary investigation letter template to ensure that you make your request in! Arise there it ’ s that versus the rights of employees in this article is provided as of. A data subject access request is that somebody else 's privacy is infringed then... Of view, you 're subject access request disciplinary investigation, `` keep me anonymous. I suppose, would... Main content of this article was provided by the information in this way, leaving potentially! Subsequently circulated to attendees, been completely different to your recollections of the actual meeting Citibank also... An employer from saying, `` I think I can keep a lid on it. `` all personal is., controlling the process has concluded been in force for over 2.! Assess it. `` side either the behaviour was undisputed and the right of access how to deal with.! Faced with a political choice to all personal data held by the information you need to that to four rather! Behaviour in the opposite direction you 're saying, `` I think I can keep a lid on this would!

How To Name A Sheep In Minecraft Pe, Almarai Company Profile, Mitsubishi Pajero Idle Relearn Procedure, Level And Plumb Members Intersect At, Vitol Group News, Pastel Clothing Instagram,