ICO releases new Q&A for employers on data subject access requests
The Q&A provides a helpful reference point for employers when responding to a DSAR.
The Information Commissioner’s Office (ICO) has released a Q&A series to assist employers in responding to data subject access requests (“DSARs”) from an employee or former employee.
Employers will recognise that the DSAR regime is often utilised by employees, particularly where a grievance or disciplinary matter has arisen. The Q&A document includes advice on the following common queries:
- Witness statements - the Q&A explains how to approach the disclosure of witness statements and particularly when it is reasonable to withhold such a witness statements to protect the rights of third parties;
- References – confidential references are exempt from disclosure in specific circumstances. The ICO clarifies in the Q&A when a reference can properly be treated as confidential and what to do when it is unclear whether a reference is confidential or not.
- NDAs and Settlement Agreements – the ICO confirms that a DSAR can be made regardless of the terms of a settlement or non-disclosure agreement. Any provision restricting the right to make a DSAR is likely to be unenforceable.
- What amounts to the employee’s personal data – it is common for organisations to recover a large amount of information when responding to a DSAR from an employee, much of which may not be their own personal data. This includes emails where the employee is copied for information and documents where there is a large amount of personal data about various employees. The Q&A addresses factors employers should take into account when determining whether the information required amounts to the employees’ personal data and the steps that should be taken to ensure that the employee only receives information to which they are entitled.
The Q&A also includes useful examples to illustrate how the ICO would approach these situations.
The clarity provided by the Q&As will be of great assistance for employers in dealing with DSARs from employees. It addresses some common themes we see when assisting clients in their response to a DSAR, acting as a useful supplement to the ICO’s more comprehensive guidance on the right of access.
If you would like to discuss any aspect of this article further, please contact Nick Dunn or any of the employment team on 0113 244 6100.
You can also keep up to date by following Wrigleys employment team on Twitter.
The information in this article is necessarily of a general nature. The law stated is correct at the date (stated above) this article was first posted to our website. Specific advice should be sought for specific situations. If you have any queries or need any legal advice please feel free to contact Wrigleys Solicitors.