An employee has the right to obtain information from their employer in respect of the personal data which is held about them. This is known as a data subject access request (DSAR). Often, such requests are made by employees when their employment with a particular organisation is being terminated or they are entering a grievance procedure. However, an employee can make a request at any time. An employer must respond to the request, within strict timescales, or potentially face a hefty fine.
Recently, new guidelines were set out by the European Data Protection Board (EDPB) regarding the rights of employees in relation to responding to DSARs, particularly in relation to the time limits. So, to what extent will these developments change the process for employers?
The EDPB reiterates the position that a controller does not have to process requests sent to “a random or incorrect email (or postal) address, not directly provided by the controller, or to any communication channel that is clearly not intended to receive requests concerning data subject’s right, if the controller has provided an appropriate communication channel, that can be used by the data subject.” Therefore, to ensure DSARs are received and dealt with appropriately, it is recommended that the employer clearly communicates the contact details to which requests should be sent. This information would usually be contained within an employer’s data protection policy.
An employer must deal with a DSAR in writing and without undue delay. There is a one-month time limit to respond to the request which can be extended, in exceptional circumstances, by a further two months. There is a tendency by employers to maximise this three-month time period but the EDPB has emphasised that the default time period is one month and an extension “is an exemption from the general rule and should not be overused”. Furthermore, they also noted that “if controllers often find themselves forced to extend the time limit, it could be an indication of a need to further develop their DSAR procedures.”
Therefore, to facilitate a timely response, it is advisable that employers ensure they have adequate systems and procedures in place to enable them to deal with DSARs in a timely manner. Responding to DSARs usually incurs significant time and cost to a business and, as such, having relevant processes in place can assist with reducing some of this time and subsequent cost. It is also important to ensure that training is provided for staff and, in particular, for those with responsibility for dealing with such requests.
Where data belongs to a third party, an employer will need to consider if the DSAR can be complied with without disclosing information identifying the third party. If not, then the employer will need to consider whether to obtain consent from the other individual or whether it is reasonable to disclose the information without their consent. In any event, the employer will need to justify their decision and it is for this reason that it is recommended that a record be kept of the decision and the reasons for it.
The EDPB reconfirms this position and reiterates that employers should not simply refuse to provide the information but, instead, analyse the risks and bridge the gap. If reconciliation is not possible then the employer will have to take a view and decide whether the information is disclosed or not.
At Buckles, we can provide assistance with drafting policies concerning DSARs – please contact our Data Protection Team.
