In
the wake of the Soham murder trial, there are calls for data protection
reforms. Meanwhile, wise employers will keep an eye on their record-keeping
policies
For years after the advent of the Data Protection Act, scrupulous record
management has been advocated. Employers were advised to apply policies to the
retention of records, and to root out and destroy any records or documents that
are irrelevant, excessive, or inadequate.
Humberside police were heavily criticised for destroying vital information surrounding
previous allegations made against Ian Huntley. So many employers may now be
tempted to immediately freeze the destruction of records to avoid being left
‘high and dry’ in the event of some unpredicted problem in the future. However,
that would be dangerous.
Here’s a helpful reminder of the provisions of the Act. It states that
information should be ‘adequate, relevant and not excessive’. Furthermore, it
states that information should ‘not be kept for longer than necessary’. What is
‘necessary’ for a police authority in the context of crime prevention or
detection is different from what is ‘necessary’ for another employer. It is
clear that during employment, the retention of salary information, contracts of
employment, emergency contact details and absence information can be justified
by employers. But the retention of certain types of personal information may be
more difficult to assess.
In particular, you as the employer may have to choose whether to keep
information relating to conduct, but which has not resulted in formal
disciplinary action. You may not intend to pursue disciplinary action, but may
still wish to retain the information.
For example, you may receive information that an employee has been convicted
of speeding. In this case, you must assess whether this information should be
retained on their personnel file. To comply with the Act, you must question
whether retaining the information can be justified for business purposes. If
your worker isn’t required to drive as part of their job, then arguably the
information shouldn’t be retained as it is irrelevant to their employment. But
if they are required to drive, you may be able to justify retaining the
information.
An employer may hold papers on file in relation to a case where disciplinary
proceedings concerning misconduct have commenced against a worker, but have not
been proven. Again, it is difficult to know when it is appropriate to keep this
information.
For example, you may have investigated a worker for poor time-keeping, but the
case hasn’t been proven. Here, it may be relevant to retain some basic
information in the event of future proceedings arising from the same issue. In
this case, the information may be helpful to establish the worker’s knowledge
of their correct working hours.
More difficulties arise in cases involving more serious allegations. For
instance, there may be a case where allegations of sexual harassment are not
established. On the one hand, an employer may wish to retain information in
case further allegations arise. But the Data Protection Act states information
should not be kept if it would cause ‘damage or distress’ to the individual
concerned. Retention of unproven allegations may cause damage or distress.
The best action in both scenarios may be for employers to keep a record of
the fact that the incident occurred, and dispose of all other paperwork
relating to the allegations. If appropriate, a basic summary can also be
retained.
Sign up to our weekly round-up of HR news and guidance
Receive the Personnel Today Direct e-newsletter every Wednesday
The bad news is that the Act provides no clarity for retention of documents.
The good news is, the Information Commissioner has recently announced a ‘Making
Data Protection Simpler’ campaign. He has invited comments on how to make
compliance easier, which is likely to lead to better interpretation of the more
difficult concepts in the Act.
By Shona Findlay, Solicitor, McGrigor Donald
