Data Subject Access Requests

They are a monumental pain (which is so obvious I’m not counting it as one of the five) and that is why they are so effective in terms of negotiation strategy.  They are time consuming and when made by an employee result in the employer having to search data held over numerous different systems.  If an employee wants to put pressure on their employer to encourage settlement, a DSAR is certainly one way to do it.  But they don’t have to be that bad to respond to if you……

1. Narrow the scope – an employee demanding all data related to their entire period of employment (unless it is a very short period) isn’t making a proportionate request and therefore probably (not always) isn’t entitled to the entirety of the data they are demanding.  Consider asking them what their concerns are in order to narrow the search time period or even informing them that the request is disproportionate and unless they object you propose to search against a smaller timeframe, giving reasons as to why. It’s amazing how many people don’t challenge the proposal to narrow. Also consider asking an employee to identify colleagues whose inboxes that they want searched, requesting that they provide reasons for doing so.

2. Narrow the search parameters – if an employee requests a search of individual initials (or even initials which form common words or parts of words) that search is rarely going to be proportionate.  For example I regularly sign off emails “A” but to require a search against “A” or even “AM” (as opposed to AKM) is going to throw up just about every document ever prepared.  Explain what you are going to search against and why you are not prepared to such a particular letter / letter combination.

3. DSARs are not meant to be an exercise in pre-action disclosure! Whilst we all know that’s normally what they are (and indeed it’s one of the reasons smart employment lawyers have been advising clients to make them since 1984) the courts and the Information Commissioners Office guidance are very clear that data protection legislation is not designed to be used as a tool to go on a fishing expedition.  Use that rationale as a reason to justify a more proportional scope for the search, clearly explaining what you are / are not prepared to search and why.

4. Consider whether the information is biographical in nature – is the data thrown up by the search about the employee making the request?  In order to be personal data the information must “relate to” the identifiable data subject.  If it does not then there is likely an argument that it is not their personal data and doesn’t have to be disclosed.  For example a list of employee initials in attendance at a particular project meeting is unlikely to be personal data  It can often be particularly tricky to determine when documents contain comments or statements that one employee has made about another.

5. Get them over with! A DSAR is not going to get easier to deal with (nor will you suddenly have the capacity to deal with it) the longer you leave it.  Narrow the scope quickly and get searching. It’s not the searches that take time (no matter what your IT team tells you) , it’s reviewing and then redacting the data that you are not required to disclose.  It is often harder than you think it will be to make a decision about whether a sentence is confidential, proprietary data, about someone else or is subject to an exception under the legislation meaning it doesn’t have to be disclosed.  If you are likely to need more than one month make it clear to the individual what data you will provide in that period (personnel file should be easy enough) and why you need longer for the rest.  If you’d like some generic wording suitable for many employment requests ping me a DM.

Author