Data Subject Access Requests

Risks for employers

Under UK GDPR, employees can request a copy of their personal information held by an employer, together with certain supplementary information about how that information is held or processed. The personal information may be contained within documents, but a DSAR does not necessarily entitle an employee to copies of entire documents. Once an employee makes a DSAR, the employer is legally required to respond without undue delay and normally within one month. This period can be extended by up to a further two months where the request is complex or the employee has made a number of requests.

As an employer, responding to a DSAR can put a huge strain on your workforce as vast amounts of data must be reviewed and assessed to meet the request, which can be an onerous and frustrating task. It might be tempting to simply provide everything that might be caught by a DSAR to the employee, shifting the burden of reviewing the material to the data subject who requested it.

However, this approach has serious pitfalls – the last thing you want to do is provide a disgruntled employee with information unnecessarily. The steps to be taken by an employer in order to respond properly to the request are to confirm the identity of the person making the request, carry out a reasonable and proportionate search, review the relevant data and provide the information in a clear and accessible format. In a large, or long-running company, this task can cause internal staffing issues, put pressure on resources and overall aggravation for the employer.

How a DSAR can result in a claim

Despite the administrative issues issues, there are bigger concerns an employer should have after a DSAR has been made. Employees who are pursuing grievances, attending disciplinary hearings or are aggrieved may make a DSAR at any stage, and employers must comply with the request.

Often these DSARS are used as a “fishing expedition” ahead of potential discrimination claims. This information and data can become the basis of a claim against the employer themselves, although an employee's purpose in making a DSAR does not, by itself, provide grounds for refusing the request.

Common Mistakes Employers Make

• Delayed Responses - failure to respond within the statutory deadline (usually one month) can result in regulatory action or enforcement measures.
• Incomplete or Inaccurate Information - providing insufficient or incorrect data can result in complaints to the ICO and potential penalties.
• Excessive Fees - charging excessive or unjustified fees for processing DSARs is prohibited.
• Failure to Consider Exemptions - not applying relevant exemptions correctly can result in unnecessary disclosure. Exemptions should be considered on a case-by-case basis and properly documented.

Practical DSAR tips and tactics for employers

• Have a Clear DSAR Policy - develop a comprehensive policy outlining the procedures for handling DSARs, including response times, how requests should be identified and escalated, and how exemptions are considered.
• Train Staff - ensure that relevant staff members are trained on data protection laws and how to handle DSARs effectively. This should include the importance of not deleting data, how to carry out appropriate searches and redact personal information relating to other individuals. Use appropriate techniques to effectively remove sensitive information.
• Document the Process - maintain a record of all DSARs received, the actions taken, and the reasons for any withholding or refusal of information. Record the actions taken to respond to the DSAR, including the search terms used, exemptions applied, and redactions made. Keep copies of the DSAR, the response, and any supporting documentation and be prepared to explain your decisions.
• ·Identify exemptions and apply them correctly - familiarise yourself with the exemptions under the GDPR and Data Protection Act 2018. If unsure about the applicability of an exemption, consult with a legal professional. Ensure that any exemptions claimed are justified and documented.
• Communicate Effectively - respond to DSARs promptly and clearly, providing the requested information in a comprehensible format.

DSARs and Grievance/Disciplinary Processes

If an employee raises a grievance or disciplinary matter and simultaneously submits a DSAR, employers must handle both processes carefully.

• Separate Processes - keep the grievance or disciplinary process separate from the DSAR to avoid bias.
• Timely Response - ensure that the DSAR is responded to within the ICO’s prescribed deadlines, regardless of the grievance or disciplinary proceedings. Where clarification is reasonably required, the response period may be paused until the employee provides the requested clarification.
• Avoid Retaliation - refrain from retaliating against an employee for exercising their right to submit a DSAR.

DSARs and Discrimination Claims

If an employee is investigating a potential discrimination claim and submits a DSAR, employers should proceed with caution.

• Relevance - carry out a reasonable and proportionate search for personal information falling within the scope of the request.
• Privilege - consider whether any of the requested information is subject to legal privilege.
• Redaction - if necessary, redact sensitive information relating to third parties or information that is otherwise exempt from disclosure.

Refusing employee DSARs

Employers can refuse to comply with a DSAR in limited circumstances, such as:

• Manifestly Unfounded or Excessive Requests - a request may be refused, wholly or partly, if it is unfounded, excessive or repetitive. There is a high threshold for relying on these provisions, and each request must be considered on its own facts. Examples include repeated requests for the same information within a short period or requests for information that are irrelevant or disproportionate. If an employer believes that a DSAR is manifestly unfounded or excessive, it must have a strong justification for its decision and should be able to explain the reasons to the employee and, if necessary, the ICO.
• Exemptions - if the requested information is subject to a recognized exemption under data protection law.

Seeking Clarification from the Employee

If a DSAR is unclear or ambiguous, employers can request further clarification from the data subject to ensure that they can provide a complete and accurate response. Clarification should only be sought where it is reasonably required to deal with the request effectively, and employers cannot force an employee to narrow the scope of a request.

Employers must also provide a clear explanation for any refusal and inform the data subject of their right to complain to the Information Commissioner's Office (ICO).

Legal help for employers

If your company has a DSAR ordered and you are unsure of how to handle it, please contact us. We can assist with reviewing the request and advising on the appropriate response. We will be more than happy to assist and have specialist lawyers on hand to create bespoke settlement agreements for any case. Please do call us on 020 7438 1060.