‘Access requests’ from staff to find out what information employers hold
about them is an unwelcome development, which is out of synch with data
protection legislation
The deputy director general of the Confederation of British Industry (CBI)
condemned the Information Commissioner’s draft code on the Data Protection Act
1998 as "a gift to lawyers that will not help companies in any way, shape
or form". These words ring true to a growing number of employers who have
been bruised by the increasing trend for staff (usually ex-employees) serving
"access requests" under the Act.
An individual’s right to find out what information their employer (or
ex-employer) holds about them, and to require changes to be made to information
where it is inaccurate, goes to the very heart of data protection legislation.
However, a growing number of disgruntled employees are using access requests as
a nuisance tactic in litigation. The requests are a pain, not just because
embarrassing documents may have to be disclosed, but also because an enormous
amount of time and money can be involved in responding to them.
Access requests extend to e-mails and other computer records and it is this
area that has caused the most headaches for lawyers and HR professionals. It is
widely accepted that employees have the right to receive copies of information
held on them in a paper-based "relevant filing system" – that is
information that has been structured by a reference to an individual, or by
criteria relating to individuals, in such a way that information on a
particular individual is "readily accessible". This clearly covers
personnel files. The reason e-mails are also caught is because they fall
squarely within the other category of information that staff are entitled to
receive copies of, namely, information processed by means of equipment
operating automatically.
Once an employee has made a valid access request (and there are a number of
checks which should be made to ensure that it is valid), the individual is
entitled, within a period of 40 days, to be given:
– a copy of his personal data in permanent form, with any unintelligible
terms or codes explained
– a description of the data
– told for what purposes the data are processed
– the recipients of the data; and
– any information available about the source of the data.
The Act contains a number of exemptions, but perhaps the most difficult one
to assess, is where the provision of data involves a "disproportionate
effort". This exemption relates only to the requirement to provide the
worker with a copy of material in permanent form. The exemption does not
qualify the obligation to search for material in the first place, but applies
strictly to the ease with which a copy of it can be provided in permanent form.
So, does this mean that an employee is entitled to view on screen hundreds
(possibly thousands) of e-mails, even where to print them off and provide them
in a permanent form would amount to a disproportionate effort? Well, the Information
Commissioner has provided potentially helpful guidance on this, where he says
he may exercise his discretion not to enforce a worker’s access rights if he is
satisfied that to give access would involve disproportionate effort on the part
of the employer. This suggests that when the Information Commissioner exercises
his discretion on whether to take enforcement action, he may apply the
exemption not just to the provision of copies in permanent form, but also to
the idea of access itself (so, viewing on screen too).
Furthermore, if a worker issued High Court proceedings for breach of the
access request Act, the court has discretion as to whether to penalise an
employer.
The deployment of access requests in employment litigation is an unwelcome
development for most employers, and isn’t in line with the spirit of data
protection legislation. The practical advice is to have a policy for handling
access requests, which may contain technology/resource driven parameters for
e-mail searches.
By Lisa Mayhew, partner, Lovells, Employment group
