This is a cross-posted article, originally written on the Pure Employment Law Website and has now been posted here. Please note the date on which this article was posted originally and that any information within may have changed.
30 November 2021
Most employers will be aware of what a subject access request is and how to handle one. However, an issue arose in a recent matter where an employee who had brought a claim against their employer in the Employment Tribunal, then made a subject access request to them. Unfortunately, the employer did not handle the situation correctly, stating they would only disclose the requested information when ordered to by the Employment Tribunal. This led to the employer being issued with an enforcement notice by the Information Commissioner’s Office (ICO). Failure to comply with such a notice can result in an employer being ordered to pay a penalty of up to £17,500,000 or 4% of their total annual worldwide turnover, whichever is the higher. Therefore, it is incredibly important that employers understand their obligations in relation to subject access requests, and the distinction between this and Employment Tribunal disclosure.
Subject access requests
An employee can make a request from their employer for personal data that the employer holds about them, and the starting point is that the employer should respond to this within one calendar month.
Employment Tribunal disclosure
Once an employee has brought a claim against their employer in the Employment Tribunal, an important part of the preparation for the final hearing will be the disclosure of documents. As we discussed in our previous article, the Employment Tribunal will usually make a general order regarding disclosure when dealing with case management and it may make further specific orders regarding disclosure if required, such as if a party to the case requests specific disclosure.
A subject access request is an entirely different matter as it relates only to personal data about the employee. Not everything that is relevant to a Tribunal claim will necessarily form part of a response to a subject access request, just as not all of the information in a subject access request will be relevant to the Tribunal proceedings. However, it is fairly common for Claimants to make subject access requests when pursuing Tribunal claims, to try and find as much information as possible in case it assists them with their claim.
Where did the employer go wrong?
First Choice Selection Services Limited were the employer in this matter. The employee submitted a subject access request to them on 7 May 2020, setting out a list of items specifically sought.
First Choice replied, stating that they had no intention of releasing the information requested. They added that they would:
“at the required time release what the tribunal designate as the required material in relation to your claim.”
The employee complained to the ICO, who wrote to First Choice, requiring them to take appropriate steps to respond to the subject access request.
First Choice responded on 28 August 2020, stating that they were involved in ongoing Employment Tribunal proceedings with the employee and that:
“In discussions with the Judge around the issues of documents we were instructed to release no information at this stage and as part of the ongoing case we will be instructed to release appropriate documents to (the employee) as required for the case.”
Further correspondence followed, with the ICO requesting evidence to support the above assertion and informing First Choice that they needed to deal with the subject access request.
On 14 January 2021, the employee forwarded to the ICO an email they had received from the Employment Tribunal that day. In response to the suggestion that the Tribunal’s directions had prevented First Choice from complying with its data protection obligations, the email stated the correct position which is that:
“the Tribunal has no jurisdiction to deal with matters relating to data protection requests.”
In light of this, the ICO concluded that First Choice had either wilfully sought to mislead them by claiming that the Employment Tribunal had given instructions not to release the information contained in the subject access request, and/or that they were unaware of the extent of their data protection obligations. In any event, Article 15 of the General Data Protection Regulation (GDPR) had been breached by the failure to deal with the subject access request and consequently, an enforcement notice was issued. The enforcement notice required First Choice to properly respond to the subject access request, and to make changes to its internal processes to ensure that it can identify and respond to any future requests.
Conclusion
This matter underlines the importance of employers understanding their different obligations that arise from either a subject access request or a disclosure request in the Employment Tribunal. The consequences of failing to do so can potentially be very costly. Our team have significant experience in advising employers on these issues and can help you to get it right.