ICO releases new Q&A for employers on data subject access requests

The Q&A provides a helpful reference point for employers when responding to a DSAR.

The Information Commissioner’s Office (ICO) has released a Q&A series to assist employers in responding to data subject access requests (“DSARs”) from an employee or former employee.

Employers will recognise that the DSAR regime is often utilised by employees, particularly where a grievance or disciplinary matter has arisen. The Q&A document includes advice on the following common queries:

• Witness statements - the Q&A explains how to approach the disclosure of witness statements and particularly when it is reasonable to withhold such a witness statements to protect the rights of third parties;
• References – confidential references are exempt from disclosure in specific circumstances. The ICO clarifies in the Q&A when a reference can properly be treated as confidential and what to do when it is unclear whether a reference is confidential or not.
• NDAs and Settlement Agreements – the ICO confirms that a DSAR can be made regardless of the terms of a settlement or non-disclosure agreement. Any provision restricting the right to make a DSAR is likely to be unenforceable.
• What amounts to the employee’s personal data – it is common for organisations to recover a large amount of information when responding to a DSAR from an employee, much of which may not be their own personal data. This includes emails where the employee is copied for information and documents where there is a large amount of personal data about various employees. The Q&A addresses factors employers should take into account when determining whether the information required amounts to the employees’ personal data and the steps that should be taken to ensure that the employee only receives information to which they are entitled.

The Q&A also includes useful examples to illustrate how the ICO would approach these situations.

The clarity provided by the Q&As will be of great assistance for employers in dealing with DSARs from employees. It addresses some common themes we see when assisting clients in their response to a DSAR, acting as a useful supplement to the ICO’s more comprehensive guidance on the right of access.