Wednesday, March 29th, 2017
What is reasonable and proportionate for you to do in responding to a subject access request?
It seems to be the world we live in, but more and more clients are receiving subject access requests – often from disgruntled or exited employees.
What is a subject access request?
It is a written request from somebody for their ‘staff file’ – usually sent to you “pursuant to the Data Protection Act 1998”. The Act says that you must provide them with copies of all documents, or all documents of a certain type, relating to them. As a rule, you must comply with the request – there is no right to refuse – but you might consider the subject access request to be too wide-ranging. If so, read on.
We can see the purpose of such a procedure – if you control data relating to another person, you must use it fairly and you must be prepared to let them see it. But it can be quite a nuisance to be faced with such a request, and it can test the administrative skills of the fairest business. You normally need to comply within 40 days, which quickly passes!
But quite how extensive must your search for documents be?
A recent High Court Judgment from January 2017 Holyoake v (1) Candy (2) CPC Group Limited provides useful guidance on this. In brief, the court confirmed that the search must be reasonable and proportionate – in the circumstances of this particular case, asking directors to search their personal email accounts went beyond what was expected.
The case also gives guidance regarding the exemption for any documents protected by legal privilege. You may be aware that in many circumstances, if you have received advice from a lawyer, that advice should remain confidential and should not be disclosed – either under a subject access request (as in this case) or in legal proceedings.
In this case, the claimant asked the court to inspect the documents to ensure that legal privilege had been applied correctly and that no exemption applied. The court refused to inspect the documents – in particular, the court considered the claimant’s arguments to be too speculative.
You need only do what is reasonable and proportionate in responding to a subject access request . . .
but don’t risk getting it wrong!
If you receive a subject access request, get in touch and we can help you.