The High Court has said again that businesses only need to conduct “reasonable and proportionate” searches when answering data subject access requests (DSAR). This approach stands in contrast to earlier guidance on the Information Commissioner’s Office, which has taken the more blunt view of requiring a full search of all records caught by the Data Protection Act.
The latest decision will give employers comfort that they don’t need to turn over every stone when dealing with an employee’s DSAR. So far as the High Court is concerned, the employer only needs to do what is reasonable and proportionate (though this will always include searching email and other electronic records using keywords and date ranges).
In a separate case, the Court of Appeal will soon rule on whether a DSAR issued for the predominant purpose of litigation, is an abuse of the legislation. If the Court of Appeal decides that pre-litigation DSARs are not valid, it will be welcome news for HR practitioners who frequently have to deal with DSARs as a fishing exercise prior to Employment Tribunal claims being launched.