At any given time an employee can ask to see any personal data that their employer holds on them. This is known as a ‘subject access request’, and when it happens employers need to tread very carefully.
Subject access requests are a powerful tool for a disgruntled employee and can cost a business both time and money. They also have the potential to open a can of worms in terms of the documents that they uncover, which could prompt an employer to settle a dispute unnecessarily. It’s important therefore to be well informed when it comes to an employee’s subject access rights.
Employee Rights on Subject Access Requests
Under s.7 of the Data Protection Act 1998, employees have the right to make a subject access request to ask for copies of the personal data their employee holds on them. They also have the right to receive information on how that data is stored and processed.
The Subject Access Rights Checklist
There is a set procedure that employers must follow when dealing with subject access requests:
- Check that the subject access request has been made correctly and that the £10 fee has been paid and received, as the timeframe for responding does not start until this point. This could therefore buy you some valuable extra time.
- Deal with the request as soon as possible. It’s a time consuming process, and you’ll need to remember to build in time for your legal team to review the request, and consider whether there is any third-party personal data which will need to be redacted.
- An employer has the right to narrow the focus of a data search where the request for data is particularly wide. For any electronically stored data, it is important to agree a time frame for the search, as well as agreeing search terms with the employee.
- Consider using document management systems or litigation support if there is likely to be a large volume of data.
- If you are conducting settlement discussions with your employee, try to reach an agreement with them that subject access requests will be put on hold until all discussions are concluded. If discussions break down, try to extend the deadline for the search with the employee.
- Make sure the subject access request is with withdrawn if a settlement is agreed.
- Remember that the normal rules of privilege apply and any documentation created for the purpose of legal advice or because litigation is being contemplated should be excluded.
- Think about providing the documents electronically rather than in a hard copy format, as this will save you both time and money.
2018 Changes to the Law Surrounding Subject Access Requests
Having said all of this, the law is set to change in 2018, and employers may need to rethink how they deal with Subject Access Requests. The General Data Protection Regulation (GDPR) will require employers to respond to Subject Access Requests in a shorter timeframe than that which currently applies under UK data protection laws.
This is why it’s so important to follow a defined process for handling subject access requests, such as that outlined in the checklist above. Failure to meet the deadline could result in a significant fine under the new regulation.
Look out for further updates from Office Assistants on how GDPR will affect subject access requests and be sure to consult your legal advisers when handling any form of request, no matter what the circumstances.
