Dealing with Employee Subject Access Requests

Under the Data Protection Act 1998 (DPA) all employees have the statutory right to access any personal data that their employer holds about them and which is stored on both a computer and in any paper based filing system, i.e. an employee’s personnel file.

An employee wishing to do so must make a written subject access request to the employer’s data controller.

The Court of Appeal in Deer v University of Oxford 2017 provided guidance to employers about the legal obligations of data controllers when responding to subject access requests. Deer was in dispute with University concerning her employment and submitted a subject access request to the Universities data controller.

The University refused to comply with Deer’s requested stating that:

– Some of the personal data being sought was covered by legal professional privilege, and was not therefore required to disclose;

– The documents Deer sought disclosure over under the subject access request had previously been provided to her during the course of her employment and was already in possession of these documents; and

– The subject access request was being made purely for litigation purposes and not to ensure the personal data held by the university was accurate and had been processed lawfully.

Deer argued that the reason behind her subject access request was irrelevant and she had an absolute right under the DPA to submit her request; the university could not refuse to process her request on the basis that documents disclosed could be used for or may find their way into any litigation and the university could not withhold a document on the basis a copy had already been received.

The Court of Appeal held that an employee’s subject access request rights under the DPA are not subject to any express test of purpose or motive and there is no requirement to state a reason for the request. It also ruled that a data controller cannot refuse to comply with a subject access request because their motive is or may be to obtain documents or evidence for the purpose of litigation.

– Employees right to make a subject access request is absolute and whilst employers are not prohibited from asking an employee the reason behind any subject access request, employees have no obligation and employers cannot demand a reason for the subject access request before releasing any person data.

– It is highly unlikely that employee’s will make subject access requests of their employer for no reason, if an employer receives a request from an employee and is unaware of an on going dispute, employers would be minded to proceed on the basis that the employees believes there is a problem of some sort and seek to engage with employee to try to resolve the issue or perceived issue.

If you are looking for guidance with Employment Law, call Andrew Lester on 01785 223440 or email Andrew.Lester@orj.co.uk