We use cookies to improve our site and your experience.

By continuing to browse on this website you accept the use of cookies.

Privacy Notice

Subject access requests: Do you have to spend £100k? - HR Magazine

Subject access requests: Do you have to spend £100k? - HR Magazine

By Daniel Pollard and Christopher Stone - 11 May 2017

The Data Protection Act gives employees the right to know what information you hold on them

An individual has a right to make a request for his personal data under the Data Protection Act 1998 (DPA). This right was intended to allow data subjects to understand what information is held about them but is often used by disgruntled employees who want to dig for information that might prove useful in an employment tribunal claim.

There has been much uncertainty about the extent to which employers have to respond to such requests. This has recently been considered in three key Court of Appeal decisions: Dawson-Damer v Taylor Wessing, Ittihadieh v 5-11 Cheyne Gardens, and Deer v University of Oxford.

How much time and effort do we have to go to?

It can be relatively easy to locate references to individual employee’s names using automated key word searches. However, not every reference to an individual’s name constitutes their personal data and a manual review of those search results are required to:

  • decide what information (if any) in proximity to their name constitutes that individual’s 'personal data.'
  • extract the personal data from the document in question;
  • apply the various exemptions.

This process is important because often employees are seeking advance disclosure of entire documents but, in contrast to disclosure in legal proceedings, the employer does not have to provide the entire document. Just the personal data within it.

DPA includes an exception where “the supply of ... a copy … would involve disproportionate effort”. The Court of Appeal has made it clear that that exception applies to the entire effort in finding and providing the personal data, not just providing copies. It said “the EU legislature did not intend to impose excessive burdens on data controllers”.

This is hugely helpful for employers because it means that an employer does not have to do further searches where the cost of doing so would outweigh the benefit to the employee of the data provided. But knowing when that point is reached is not easy. In one case the data controller’s solicitors had already charged £116,000 to review some 500,000 documents before the courts said it did not have to go any further.

To read the full article, click here