Question
An employee whom we are currently investigating under our disciplinary procedure has submitted a subject access request to obtain the contents of their personal file. Do we have to respond to the request and, if so, is there anything else we should know about?
Answer
A subject access request (SAR) is a mechanism under data protection law that allows an employee to request copies of any personal information related to them held by their employer. They are often used by employees subject to disciplinary proceedings and it can be tempting for the employer to ignore them, particularly if they are considered to have been made as a nuisance.
However, a number of recent decisions have highlighted the need to deal with SARs appropriately.
In the context of your question, in the case of McWilliams v Citibank the employee was suspended as part of a disciplinary procedure and was unable to obtain documents relevant to her case. Ms McWilliams made a SAR, but the employer did not give her the requested documents until after the disciplinary hearing.
In her unfair dismissal claim the judge found the employer’s own investigation lacking, and as Ms McWilliams had been forced to rely on that investigation she had been unable to prepare her defence properly. As such, her dismissal was found to be unfair.
SARs can also be made during litigation to obtain relevant information in advance. While previous cases suggested a reluctance by the courts to enforce a SAR where the employee is considered to be ‘fishing’ for information, in the more recent case of Gurieva and another v Community Safety Development (UK) Ltd, the High Court stated that it was not open to an employer to ignore a SAR made for this purpose.
However, while the above cases show that a SAR should not be ignored, it is possible for an employer to limit the scope of the request in certain circumstances. For example, if the SAR is very wide it may be possible to ask the employee to give a date range for the request or a particular subject, such as (in your case) anything related to the current matter under investigation. However, attempting to limit the request in this way will generally be reasonable only if the employee has made a very broad request and it would be onerous for the employer to locate the information.
In addition, if the information requested involves the personal data of a third party, it may be possible not to comply with the request. However, if the third party consents to their information being disclosed, or it would be reasonable to disclose it without their consent, it is unlikely to be possible to refuse the request.
If you have any questions on any of the issues raised in the above article, please contact Seanpaul McCahill.