Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+

Personnel Today

Register
Log in
Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+

Employment lawData protection

Access to personal data: employment law update

by Sheila Fahy 24 Sep 2007
by Sheila Fahy 24 Sep 2007

The Information Commissioner’s Office (ICO) has issued revised guidance on the meaning of ‘personal data’. This directly affects the information employees can legitimately request about themselves in a subject access request.

In recent years, employers have been able to take a robust approach to these requests. They have been able to fend off requests for ‘everything about me’ where the focus of the data was not about the employee. The new guidance, however, gives a wider interpretation of ‘personal data’: employees will be entitled to see more information, although the guidance will not require every document in which an individual’s name is mentioned to be disclosed.

Why the change of direction?
In 2003, in the landmark case of Durant v Financial Services Authority, the Court of Appeal (CA) marked the boundaries of an individual’s right to access their personal data to give a ‘sensible and practical effect’ to the Data Protection Act 1998 (DPA). It was a welcome decision, which eased the administrative task of employers who were faced with such a request. The CA decided that not all information that mentions an individual’s name has to be disclosed under a subject access request. Information should be biographical (eg, it goes beyond a passing reference to his or her name in a matter that has no personal connotations, such as a meeting request e-mail). The data must also have the individual as its focus, being information that affects his or her privacy, whether in a personal or business capacity.

Many practitioners and experts thought this was an unduly restrictive approach to the European Data Protection Directive, implemented by the DPA. So the Article 29 Working Party, the European data protection advisory committee, looked into the concept of personal data. In contrast to the Durant decision, the committee issued an opinion which gave personal data a wide interpretation under which employees would be entitled to see more information. The ICO revised its previous guidelines in response to that opinion and it essentially followed the opinion.

Biographical significance
In most cases it will be fairly clear whether an employee is entitled to a document or not. What has changed is that the guidance has provided examples in a number of the grey areas when employers might previously have been able to resist a request for disclosure.

The guidance now says that you only consider ‘biographical significance’ if the data is not obviously about an individual or clearly linked to them. This is different to the Durant position, which said the mere mention of a name does not make it personal data. It gives the example of an individual listed as an attendee in the minutes of a meeting. Previously, if the minutes were not about the employee, then there was no need to disclose them because they were not biographical. Now the guidance states that the minutes do have biographical significance because they record the individual’s whereabouts at a particular time, although the disclosure may only be limited to the list of attendees, depending on the content of the meeting.



  • Step-by-step guidance The guidance sets out a series of questions that should be considered when deciding whether a particular document has to be disclosed following a subject access request. These look at factors such as:

    whether data is linked to an individual so that it provides information about that person
  • whether the data can be used to inform or influence a decision about an individual
  • whether the data focuses or concentrates on the individual as its central theme rather than some other person, object or transaction
  • whether the data has the potential to impact on the individual.

Biographical significance is still an important factor in analysing whether materials have to be disclosed as the focus of data, but consideration now has to go beyond this.

What should employers do?
The guidance is extensive, but it should be read by all HR practitioners, particularly those who are involved with subject access requests. Should employers change their practices? Each subject access request must be looked at individually. There will be circumstances where it will be harder to justify not disclosing some documents and these will have to be dealt with on a case-by-case basis.

Sign up to our weekly round-up of HR news and guidance

Receive the Personnel Today Direct e-newsletter every Wednesday

OptOut
This field is for validation purposes and should be left unchanged.

Relevant filing system
The Durant case also looked at the issue of what amounts to ‘a relevant filing system’, and the ICO’s previous guidance covered this aspect too. This included the ‘temp test’ to help organisations decide whether they hold information within a relevant filing system. The ICO has not amended this part of its guidance but intends to do so at some time in the future.

Employment law changes

Sheila Fahy

previous post
Training is latest to benefit from EU money-go-round
next post
Top job – Jane Anderson

You may also like

Fire and rehire: the relocation question

22 May 2025

Minister defends Employment Rights Bill at Acas conference

16 May 2025

CBI chair Soames accuses ministers of not listening...

16 May 2025

EHRC bows to pressure and extends gender consultation

15 May 2025

‘Polygamous working’ is a minefield for HR

14 May 2025

Contract cleaner loses EAT race discrimination appeal

14 May 2025

Construction workers win compensation claim against defunct employer

9 May 2025

Zero-hours workers’ rights to be extended from beyond...

8 May 2025

Employment tribunal backlog up 23% in a year

7 May 2025

Ministers urged to outlaw misuse of NDAs

7 May 2025

  • 2025 Employee Communications Report PROMOTED | HR and leadership...Read more
  • The Majority of Employees Have Their Eyes on Their Next Move PROMOTED | A staggering 65%...Read more
  • Prioritising performance management: Strategies for success (webinar) WEBINAR | In today’s fast-paced...Read more
  • Self-Leadership: The Key to Successful Organisations PROMOTED | Eletive is helping businesses...Read more
  • Retaining Female Talent: Four Ways to Reduce Workplace Drop Out PROMOTED | International Women’s Day...Read more

Personnel Today Jobs
 

Search Jobs

PERSONNEL TODAY

About us
Contact us
Browse all HR topics
Email newsletters
Content feeds
Cookies policy
Privacy policy
Terms and conditions

JOBS

Personnel Today Jobs
Post a job
Why advertise with us?

EVENTS & PRODUCTS

The Personnel Today Awards
The RAD Awards
Employee Benefits
Forum for Expatriate Management
OHW+
Whatmedia

ADVERTISING & PR

Advertising opportunities
Features list 2025

  • Facebook
  • Twitter
  • Instagram
  • Linkedin


© 2011 - 2025 DVV Media International Ltd

Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+