Addressing Employee DSARs: A Different Angle on Compliance

In an era marked by increasing awareness of data privacy and personal rights, the Data Subject Access Request (DSAR) has emerged as a vital tool for individuals seeking control over their personal information. The General Data Protection Regulation (GDPR) grants individuals the right to access their data, and organisations, including employers, are mandated to comply with these requests within a specified time frame. However, when the data subject is an employee, the dynamic changes. The employment relationship adds complexity to an already challenging process of compliance with DSARs. In this article, we’ll explore employee DSARs from a different angle, focusing on practical strategies, legal obligations, and a broader understanding of compliance, all while aiming to protect both the organisation and employee rights.

Table of Contents

What is a DSAR?

Before diving into the complexities of employee DSARs, it’s essential to understand the basics. Under GDPR, a DSAR is a formal request made by an individual (data subject) to a data controller (in this case, the employer) to access personal data that the controller holds about them. This right is enshrined in Article 15 of the GDPR, and its aim is to provide transparency and control over personal data.

A DSAR can request access to:

The categories of personal data processed.
The purposes for which personal data is being used.
The recipients of the personal data.
The duration of data storage.
The logic behind any automated processing of the data.
A copy of the personal data itself.

While these requests can be made by any individual whose data is processed, the dynamics change significantly when the requestor is an employee or former employee.

The Unique Nature of Employee DSARs

DSARs made by employees tend to be more complex than those made by other data subjects. Several factors contribute to this complexity:

Volume of Data: Employers typically hold large volumes of data about their employees, collected over the course of the employment relationship. This includes payroll information, performance evaluations, email communications, and personal health information.
Purpose of the Request: Employee DSARs are often made in the context of a workplace dispute, such as grievances, disciplinaries, or even litigation. The request may not be a simple exercise of accessing personal data for its own sake, but may be tied to a larger, contentious issue.
Mixed Data Sets: Employee data is often mixed with other data types, such as communications involving multiple parties, performance feedback, or internal investigations. This raises concerns about balancing the privacy rights of other individuals whose data may be intertwined with the subject’s.
Sensitive Nature of Data: Employment records often contain highly sensitive information, such as details of health conditions, family circumstances, or allegations of misconduct. This increases the risk of data breaches if the information is not handled appropriately.
Legal Professional Privilege: Particularly in contentious situations, there may be documents that fall under legal professional privilege, such as emails between the employer and their legal advisors. Deciding whether to withhold such documents can be legally complex and must be approached with caution.

Given these unique challenges, organisations need a robust and proactive strategy for handling employee DSARs.

Legal Obligations for Employers

Under GDPR, employers must respond to a DSAR within one month of receipt. This can be extended by a further two months if the request is complex or numerous. However, the burden falls on the employer to prove that an extension is necessary. Failure to comply with these time limits could result in regulatory action and significant fines.

While it is essential to meet the deadlines, the focus should not be on speed alone. Employers must ensure that they provide a comprehensive and accurate response while respecting the rights of other employees and stakeholders whose data may be involved in the request. Some key considerations include:

Data Minimisation: The principle of data minimisation means that the employer should not disclose more personal data than necessary. This requires a careful and methodical review of the data in question.
Exemptions and Limitations: While the GDPR provides broad rights to access, there are exemptions that may apply. Employers can withhold information if:
- The data includes information about other individuals, and providing it would infringe their rights.
- The data is subject to legal professional privilege.
- The data relates to management forecasting or planning, particularly if its disclosure would prejudice the organisation’s commercial interests.
Secure Transmission: Employers must ensure that the data is provided in a secure manner to avoid data breaches. Encrypting the files or using secure file transfer services can help mitigate the risk of unauthorised access.
Managing Expectations: Employees may request large amounts of data, which may not always be feasible to provide in a single response. It’s crucial for employers to communicate clearly with the employee about the process, the expected timeline, and any limitations.

A Proactive Approach to Employee DSARs

Handling DSARs effectively requires more than just a reactive approach. By taking proactive steps, employers can reduce the time, cost, and risk involved in responding to DSARs. Here’s a look at strategies that can help organisations better manage the process:

Create a DSAR Response Policy

A well-defined DSAR response policy is the foundation of effective compliance. This should be part of a broader data protection strategy and should outline the procedures for handling DSARs from all types of data subjects, including employees.

A strong policy should include:

The process for submitting a DSAR.
The timeframes for responding.
The roles and responsibilities of various stakeholders (e.g., HR, IT, Legal).
Guidance on the exemptions and limitations that apply to employee DSARs.
A procedure for ensuring secure transmission of data to the employee.

Maintain a Data Inventory

Organisations should maintain an up-to-date inventory of employee data, detailing the types of data collected, where it is stored, and how it is processed. This not only helps with efficient DSAR responses but also ensures compliance with broader GDPR principles such as data minimisation and purpose limitation.

A data inventory should include:

Personal details (e.g., name, address, contact information).
Employment history (e.g., roles, salary history, performance reviews).
Sensitive personal data (e.g., health records, disciplinary actions).
Correspondence and communications (e.g., emails, internal messages).

By having a clear understanding of where employee data is stored, employers can respond to DSARs more quickly and with greater accuracy.

Train Staff on DSAR Compliance

Handling DSARs is not just the responsibility of the data protection officer or legal team. HR staff, IT teams, and managers all play a role in ensuring that DSARs are handled correctly. It’s essential to provide training to employees on how to identify a DSAR and what their role is in the process.

Training should cover:

Recognising a DSAR request (since these can be submitted verbally, in writing, or even via social media).
The importance of responding promptly.
How to retrieve and filter data from various systems.
The legal risks of non-compliance.

Develop an Internal Communication Strategy

Employee DSARs often occur in the context of workplace disputes. To mitigate the risk of escalating tensions, employers should develop an internal communication strategy that prioritises transparency and professionalism. This involves:

Acknowledging the DSAR promptly and informing the employee of the process.
Keeping the employee updated on the progress of their request.
Being clear about any limitations or exemptions applied to the request.

A well-executed communication strategy can help manage employee expectations and prevent misunderstandings that may lead to further disputes or legal action.

Implement Data Governance Measures

Good data governance is essential for managing the risks associated with DSARs. Organisations should implement measures to ensure that employee data is accurate, up-to-date, and stored securely. This includes:

Regularly auditing data systems to identify any issues with data integrity.
Reviewing access controls to ensure that only authorised personnel have access to sensitive employee information.
Implementing encryption and other security measures to protect employee data from unauthorised access.

By taking a proactive approach to data governance, organisations can reduce the likelihood of mistakes or data breaches during the DSAR process.

Addressing DSAR Challenges: A Case Study Approach

To fully appreciate the complexities of employee DSARs, let’s consider a hypothetical scenario:

Case Study: Disciplinary Action and a DSAR

Sarah, an employee at a medium-sized company, is undergoing disciplinary action for alleged misconduct. During the process, Sarah submits a DSAR, requesting access to all communications related to her performance and the disciplinary action.

This situation presents several challenges for the employer:

Volume of Data: The employer holds a significant amount of data related to Sarah’s performance, including emails, meeting notes, and feedback from her manager. Sifting through this data to identify what is relevant to the DSAR is time-consuming.
Mixed Data Sets: Some of the requested data includes information about other employees who were involved in meetings or performance reviews. The employer must balance Sarah’s right to access her data with the privacy rights of her colleagues.
Legal Professional Privilege: The company’s legal team has been involved in providing advice on the disciplinary process. Some of this advice is covered by legal professional privilege, and the employer must determine which documents can be withheld.
Time Constraints: The employer is under pressure to respond to Sarah’s DSAR within the one-month timeframe. Given the volume and complexity of the data, this deadline is challenging.

Managing the DSAR Response

To address these challenges, the employer takes the following steps:

Data Filtering: The employer uses a data filtering tool to identify relevant emails and documents, reducing the volume of data that needs to be reviewed manually.
Third-Party Data: Where data involves other employees, the employer redacts their personal information before providing it to Sarah.
Legal Advice: The employer consults with its legal team to ensure that any documents covered by legal professional privilege are correctly withheld.
Communication: The employer keeps Sarah informed throughout the process, explaining the reasons for any redactions or withheld documents. This helps to manage her expectations and reduce the risk of further disputes.

The Future of Employee DSAR Compliance

As data privacy regulations continue to evolve, the importance of compliance with DSARs will only grow. In the context of employment, DSARs will likely remain a significant issue, particularly in situations of workplace conflict. Employers need to be prepared to navigate the complexities of these requests while safeguarding both employee rights and organisational interests.

In the future, we may see:

Increased Automation: AI-driven tools that can help employers filter and process large volumes of data more efficiently.
Stricter Regulation: As regulators continue to enforce GDPR compliance, organisations may face even greater scrutiny when handling employee DSARs.
Expanded Employee Rights: New data protection laws may grant employees additional rights over their data, further complicating the DSAR process.

Conclusion

Addressing employee DSARs requires a nuanced approach that goes beyond merely meeting legal obligations. Employers must strike a balance between transparency, privacy, and data security, all while navigating the complexities of the employment relationship. By adopting a proactive, well-structured approach to DSAR compliance, organisations can protect themselves from regulatory risks, safeguard employee trust, and create a culture of accountability in data management.

Ultimately, employee DSARs are not just a legal requirement—they are an opportunity to demonstrate a commitment to data privacy and respect for individual rights. By addressing these requests thoughtfully and diligently, organisations can foster a workplace that values both compliance and employee wellbeing.