|
Ask Employment Law |
|
|
|
|
|
|
Remember: There is no substitute for legal advice on the actual
situation you find yourself in. The information posted on this site is for
general information only, is based on |
|
|
|
|
|
|
|
Question: |
What rights does an employee have to access data held on them by
the employer? |
|
|
|
|
Answer: |
Data Protection is a massive area and this note only
touches on the obligations of organisations holding personal data. Please note that Public bodies will also be
bound by the Freedom of Information Act. In very simple terms, under the Data Protection Act,
employees have the right to access paper files held by their employer on
them, and electronic data held by the organisation on them. ‘Data subjects’ (in this case applicants and employees) have
the right to obtain disclosure from the employer of: ·
The
personal data held on them ·
The
purpose for which the data is being processed and ·
Details
of who the data is or may be disclosed to. Employers can charge up to £10 to deal with a subject
access request. Disclosure should be given ‘promptly’ and in any case within
forty days of receiving the request. Employers only need provide disclosure
of personal data held on a ‘relevant filing system’ What is a
‘relevant filing system’ for the purposes of complying with data access
requests. (ie personnel file, other files,
emails, payroll records, other electronic records?). This was covered in the leading
case of Durant –v- FSA [2003] in the Court of Appeal. MANUAL (PAPER) FILES: ·
Manual
files are only covered by the act if the personal data is as readily
accessible as on a computerised filing system. ·
So
if you have to leaf through a file to see what information qualifies as
personal data, that is not a relevant filing system. ·
In
a relevant filing system the files are clearly structured and indicated at
the outset of the search ELECTRONIC FILES: ·
Pretty
much any personal data held electronically will be covered by the data access
request. What does that mean in practice? Let’s say
Jane Bloggs makes a data access request under the Data Protection Act. What
data does this apply to? ·
A
paper Personnel file. Inevitably this will be covered by a data access
request. ·
Personnel
information held electronically will be covered. This includes payroll information
as well as documents held on the C drive of personnel officers computers or a
mainframe. ·
Documents
held by other managers / personnel within the organisation. These will not be
covered UNLESS (say) the line manager has a file entitled ‘Jane Smith’.
Rather than ask everyone in the organisation whether they have any documents
or files on Jane Smith, it would be sensible to ask Jane Smith herself who
she wants you to check with. This should help focus the search. The good news
is that if her line manager has notes from a meeting on which he has written
‘Jane is a nutter’, this does not have to be disclosed if it’s in loose
papers on various subjects on his desk. However if it were placed on her
personnel file, it would have to be. ·
Miscellaneous
memos and letters held on other files not defined by reference to Jane Smith
herself will not be covered. ·
Emails
will be covered. In her data access
request, Jane Bloggs wants disclosure of any email ever sent between any
member of staff including herself in which her name is mentioned. Does the employer have to trawl through
endless records to comply? Emails will be covered. It’s impractical to carry out a
search of all emails ever sent or received at whatever time, or to try to
retrieve deleted emails. Again it’s worth clarifying with the employee
herself the emails from and to whom she is concerned by and over which
period. If the employer insists upon the employee clarifying the search with respect to
defined individuals, it is less likely that the Data Commissioner would
criticise the employer if a complaint followed. Lets say an ex
employee makes a data access request, specifically asking for disclosure of
the reference that the (ex) employer provided to his current employer. Is the
(ex) employer obliged to disclose it? ·
The
ex employer does not have to disclose confidential references provided by
third parties ·
However
the ex employer would have to disclose the reference that the organisation
provided to his current employer. If there are documents relating to a 3rd party who has left the
organization (and possibly the country), is it necessary for the employer to
obtain the express permission of that 3rd party before disclosing
the information to the employee? This is a really difficult area to deal with. When it comes to
balancing the interests of the third party against those of the person making
the data access request, in the Durant case the Court of Appeal said: Ask yourself what legitimate interests the person making the request
has in obtaining the disclosure of the identity of the third party. It may be
appropriate to anonymise the data by blanking out the individuals name from a
document. You should not do so every
time someone else’s name is mentioned though. The
Court of Appeal in Durant said: ·
‘Is the information about the
third party necessarily pat of the personal data that the data subject has
requested?’ ·
‘If so, how critical is the third
party information to the legitimate protection of the subject’s privacy, when
balanced against the existence or otherwise of any obligation of confidence
to the third party or any other sensitivity of the third party disclosure
sought.’ Remember,
it’s not necessary to obtain the express consent of a third party (whether or
not a present employee), before releasing information about them. However
anything that discloses a third parties’ ·
Private address ·
Private phone number ·
Private email address ·
Or information ‘sensitive’ data
about their health, sexuality etc …should not
in my opinion be disclosed without their express consent. See
also our page on personal data. Last reviewed: July 2010. |
|
|
|
|
Employment
Solicitor Reculver Solicitors Tel
0207 324 6271 Regulated
by the Solicitors Regulation Authority ©
Reculver Solicitors. 2005- |
|