In this latest blog article in our series on de-mystifying Data Subject Access Requests (DSARs), Sue Dowling and Victoria Eustace, in our Employment Law team, outline when requested information can be withheld due to certain exemptions.
We have outlined an employer’s duties regarding Data Subject Access Requests (DSARs) in our previous blog articles. In certain circumstances, however, the obligation to disclose copies of personal data in response to a DSAR does not apply. Employers should consider possible exemptions and whether it is appropriate to apply these to data obtained from its searches before responding to a DSAR.
Details of the exemptions can be found in Schedules 2-4 to the Data Protection Act 2018 (DPA 2018). They must be applied carefully on a case-by-case basis. Those most relevant in an employment context can be found in Schedule 2 to the DPA 2018 and include:
Legal Professional Privilege
Personal data, in respect of which a claim of legal professional privilege could be maintained in the context of legal proceedings, need not be disclosed in response to a DSAR. Similarly, any information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of that adviser is exempt. In relation to the latter, the duty applies to communications between a lawyer and client where the communication is for ‘the dominant purpose of giving or receiving legal advice’. An example is where an employer seeks legal advice following a disciplinary meeting with an employee, as to how to write a letter of dismissal (with appeal option). Any email from the lawyer to the employer with that advice (and draft letter) would be protected from disclosure through a DSAR.
References
A reference given in confidence for employment, training, volunteering or educational purposes is exempt from disclosure. Employers should ensure such references are removed before providing an employee with a copy of their HR file. The exemption covers personal data within a reference whether it was processed by the person giving the reference or by the recipient of the reference.
Management Forecasting/Planning
Personal data need not be disclosed if it was processed for the purposes of management forecasting or management planning in relation to a business or other activity. The exemption only applies to the extent that complying with a DSAR would prejudice the conduct of the business or activity concerned. For example, if at the time an employee makes a DSAR for their personal data their employer is planning a restructure which could result in redundancies, personal data relating to the employee processed as part of that planning process may potentially be withheld from disclosure to prevent news of the restructure being released, causing disruption to the workforce.
Negotiations
Personal data contained in records of an employer’s intentions in relation to negotiations between the employer and employee are exempt from disclosure to the extent that compliance with the subject access request would be likely to prejudice negotiations. If a DSAR is made during the course of an employment dispute, for example, an employer may not be required to disclose communications which relate to the sum it would be willing to offer that employee to settle the dispute.
Third Party Rights
An employer does not have to provide information in response to a DSAR from an employee, to the extent that doing so would reveal information about another person unless:
- the other person has consented to the disclosure; or
- it is reasonable to disclose the information without their consent.
If an employee’s personal data has been processed by an employer responding to a confidential complaint for example, it may be necessary to withhold the relevant personal data to protect the identity or other personal data of the complainant. The employer should approach such data carefully, and should consider:
- Whether it is possible to disclose the information without revealing the third-party personal data, such as by removing or redacting elements of the data before disclosing.
- Whether it is reasonable or appropriate to seek the consent of the third party. An employer is not obliged to seek consent and should consider whether doing so could in itself alert the third-party to the fact a Subject Access Request has been made. In addition, if the third party is themselves an employee, they may not be in a position to give or withhold consent freely due to the employer/employee power imbalance.
- In the absence of consent, the employer should consider whether it is possible to disclose the data in any event. Employers should seek advice where appropriate to ensure compliance with their obligations to all parties.
Criminal Investigations
Information may be exempt from disclosure to the extent necessary to safeguard the prevention, investigation, detection or prosecution of a criminal offence.
Summary
There are additional exceptions relating to matters such as regulatory functions, tax collections and various corporate finance services. Employers should ensure they review the available exemptions in full and/or obtain specific legal advice before responding to a DSAR as some exemptions are mandatory.
If an exemption is relevant, it may be possible to redact, remove, or otherwise restrict the personal data before responding to the DSAR/providing the disclosure but again it may be prudent to take specialist advice. It is crucial to remember that an employer is under an overall duty to facilitate the exercise of the right to make a DSAR, and any request must be handled lawfully, fairly and transparently. Where an employer relies on exemptions, in its response to the DSAR, it would need to explain to the employee why it has handled the response in the way it has (explaining the exemption(s) relied upon) and remind the employee that they have the right to complaint to the Information Commissioner's Office (ICO) if they disagree with its decision.
For further information or legal advice, please contact law@blandy.co.uk or call 0118 951 6800.
This article is intended for the use of clients and other interested parties. The information contained in it is believed to be correct at the date of publication, but it is necessarily of a brief and general nature and should not be relied upon as a substitute for specific professional advice.
