Employers: responding to a Subject Access Request?

When Tribunal proceedings are contemplated, employees will often make a Subject Access Request (SAR) to their employer. 

This is a well-used tactic to obtain early disclosure of documents that might be used at the Tribunal hearing.

When the claim gets underway, the Tribunal will order the parties to disclose all relevant documents to each other. Employers are often reluctant to comply with a SAR on the basis that the person will receive the documents under the Tribunal’s disclosure order and the employer should not have to undertake two disclosure exercises. 

This is not a ground to refuse (although there are other grounds on which employers can refuse to comply with a SAR).

However, recently The Information Commissioner's Office (ICO) issued an enforcement notice against a company for failure to comply with Article 15 of the EU GDPR and UK GDPR. It failed to respond to a subject access request from a person who was making a claim in the employment tribunal.

When the person made the SAR the company informed them it would only release information when instructed to do so by the tribunal. The person complained to the ICO. The company failed to respond to the ICO on a number of occasions, but then told the ICO it had been instructed by the tribunal not to release any information at that stage although it could produce no evidence of this. 

The tribunal confirmed to the person that it had no jurisdiction to deal with matters relating to data protection requests which suggested the company had lied to the ICO.

The ICO found that the company had wilfully sought to mislead the ICO and, as well as failed to comply with the subject access request, it was in breach of the accountability principle (Article 5(2), EU GDPR and UK GDPR). It issued an enforcement notice requiring the company to properly respond to the subject access request and to make changes to its internal systems, procedures and policies to ensure it identifies and responds to any future requests.

Disclosure under a SAR and as part of a Tribunal case are two separate and distinct regimes. 

Employees are entitled to make a SAR at any time, because Tribunal proceedings are contemplated or ongoing does not relieve the employer of its duty to comply with the SAR. 

A reply to SAR is likely to be far more restrictive than disclosure within an employment tribunal but it can be a valuable tactic for individuals to deploy. Employers, when responding to a SAR must ensure they only disclose material they are required to disclose and in particular not to disclose privileged material.

If you require any more information on this subject please contact the team here