By Daniel Pollard and Christopher Stone - 11 May 2017
An individual has a right to make a request for his personal data under the Data Protection Act 1998 (DPA). This right was intended to allow data subjects to understand what information is held about them but is often used by disgruntled employees who want to dig for information that might prove useful in an employment tribunal claim.
There has been much uncertainty about the extent to which employers have to respond to such requests. This has recently been considered in three key Court of Appeal decisions: Dawson-Damer v Taylor Wessing, Ittihadieh v 5-11 Cheyne Gardens, and Deer v University of Oxford.
How much time and effort do we have to go to?
It can be relatively easy to locate references to individual employee’s names using automated key word searches. However, not every reference to an individual’s name constitutes their personal data and a manual review of those search results are required to:
This process is important because often employees are seeking advance disclosure of entire documents but, in contrast to disclosure in legal proceedings, the employer does not have to provide the entire document. Just the personal data within it.
DPA includes an exception where “the supply of ... a copy … would involve disproportionate effort”. The Court of Appeal has made it clear that that exception applies to the entire effort in finding and providing the personal data, not just providing copies. It said “the EU legislature did not intend to impose excessive burdens on data controllers”.
This is hugely helpful for employers because it means that an employer does not have to do further searches where the cost of doing so would outweigh the benefit to the employee of the data provided. But knowing when that point is reached is not easy. In one case the data controller’s solicitors had already charged £116,000 to review some 500,000 documents before the courts said it did not have to go any further.
To read the full article, click here