HR NEWS – TRANSCRIPT – 6 NOVEMBER 2020
Knowledge safety – new detailed topic entry request steerage printed by ICO
The Info Commissioner’s Workplace (ICO) has printed detailed steerage on topic entry requests which ought to assist employers relating to dealing with requests extra successfully and effectively – it is geared toward information safety officers and people with particular information safety duties in bigger organisations. A reminder – information topic entry requests are an necessary a part of the information safety regime. People have the proper to make information topic entry requests to search out out whether or not or not you might be processing their private information. If you’re, they’ve the proper to entry copies of that information and you have to present them with details about how you might be processing it. As an HR skilled you might be more than likely to see these requests coming from present staff, job candidates and former staff. So, for instance, within the context of a dispute the place an worker might ask to see all of the notes and witness statements regarding his or her grievance or disciplinary proceedings, or maybe a request from an unsuccessful job applicant who suspects that she or he has been discriminated in opposition to, and we see that lots. As for the brand new steerage, this initially went out for session again in December final yr and it resulted in over 350 responses from organisations of all sizes, and throughout all sectors, who had been in broad settlement in wanting the entire course of simplifying. So to that finish there have been calls for extra content material and examples, and clarification on some facets of the legislation that aren’t so clear-cut. The steerage has now been printed and, apparently, the ICO’s weblog confidently states it thinks it has succeeded with that process. They are saying they’ve offered readability on the three key factors which had been raised within the session that are: (i) stopping the clock when employers thought requests didn’t depart sufficient time to reply; (ii) making clear what quantities to a request which is manifestly extreme; and (iii) what might be included when charging a payment for extreme, unfounded or repeat requests. So what will we make of the brand new steerage? On the road information safety specialist, Leanne Francis:
Leanne Francis: “There is no doubt that this new steerage could be very welcome and for employers as a result of it dietary supplements the previous steerage and clarifies among the gray areas which have actually continued for the reason that new Knowledge Safety Act was launched in 2018 and it is vitally detailed and really sensible steerage. One of the crucial fascinating areas of the steerage, for me, is the reason of what quantities to a fancy information topic entry request. In the meanwhile employers have simply 30 days to adjust to the DSAR, which in most circumstances just isn’t sufficient time. The laws permits for an extra two months to conform the place the DSAR is advanced, however nobody actually knew what that meant. What the ICO has executed is listed a variety of circumstances the place we is perhaps coping with a fancy DSAR, however truly these are pretty area of interest and in my expertise we do not have a tendency to come back throughout these examples fairly often. The ICO has additionally mentioned that the mere reality that there’s a giant quantity of information doesn’t in and of itself imply that the request is advanced, and far will depend upon the dimensions and sources of an employer.
Maybe what’s extra useful within the steerage is that it does discuss what’s known as the “cease the clock” provisions which is one thing that’s maybe used much less typically by employers. This enables an employer, the place they’re making an attempt to cut back the scope of a DSAR with the worker, maybe as a result of it is too broad, that may take a very long time and on what the ICO is saying is that that can pause time till you are capable of attain settlement over precisely what it’s the worker is on the lookout for. The steerage additionally goes on to clarify that employers are nonetheless required to go to cheap or proportionate efforts to adjust to the DSAR. The previous steerage referred to in depth efforts – it’s not clear whether or not that basically makes any distinction and the ICO are nonetheless saying that there is a excessive expectation on employers to conform. That is nonetheless seen to be a elementary proper of an information topic to request entry to their information however I believe what it is perhaps is, maybe, a bit little bit of a nod to employers that the place you’ve a troublesome worker who’s refusing to slim the scope of their request, and being very unreasonable, that an employer might be able to unilaterally determine that they need not do a forensic response to a DSAR and that they’ll have one eye on the dimensions of their organisation and the sources obtainable to them.
The steerage can also be useful as a result of it goes on to clarify what “manifestly unfounded or extreme” means. Now, the place a DSAR falls into this class the employer has the proper to refuse all of it collectively and the ICO lists a variety of, once more, pretty slim circumstances the place a DSAR would possibly fall into this class. So it offers an instance of an worker who says, for instance, I’ll withdraw my DSAR for those who give me a settlement settlement, or an worker who explicitly states that they are doing this out of malice or to trigger hassle. Now, in my expertise, this not often occurs, staff are a bit bit cleverer about that. They could have a collateral goal they is perhaps doing as a part of a fishing train, they is perhaps doing it so as to add stress to an employer in a negotiating scenario, however that is not sufficient in and of itself to refuse a DSAR. So we do should be actually cautious about making use of this exception and, if we do use this exception, then we’d wish to have our determination very, very rigorously documented. The steerage additionally talks about the truth that employers must get their methods and their processes so as.
This can be a proper that has existed approach earlier than 2018. Employers must be sure that they’ve groups of individuals inside their organisations who know the way to deal with a DSAR from begin to end and at Pinsent Masons we frequently prepare these in-house DSAR groups in order that they know the way to deal with what is a reasonably advanced job. It additionally talks about having constant insurance policies and checklists in place, having an asset register the place you’ll be able to discover in a short time the areas through which you retailer your information, and likewise talks about retention, so ensuring that we’re refining the information that we retailer and we’re solely maintaining what is actually vital as a result of, in fact, the much less information you’ve the better it’s to adjust to a DSAR. So total, it is useful steerage. I believe there are nonetheless some questions that stay for employers however it’s, in fact, important studying for anybody dealing with a DSAR, particularly as we begin to see an increase in DSARs within the context of redundancy workout routines and grievances.”
We must always level out which you could, in fact, discover that new steerage on the ICO’s web site. If you’re not accustomed to that web site and you’ve got duties on this space, one can find it an excellent supply of knowledge and assist – very nicely set out, very sensible and stuffed with working examples.
