Just flicking idly through the ICO’s new guidance the other evening, as you do when the only alternative is Ant & Dec, and two paragraphs caught my eye. In the section relating to DSARs which are “manifestly unfounded” (and can therefore be batted away by the employer) appear two examples, where:
- “the individual clearly has no intention to exercise their right of access. For example, an individual makes a request but then offers to withdraw it in return for some sort of benefit from the organisation”; and
- “the request is malicious in intent and is being used to harass an organisation with no real purpose other than to cause disruption”.
There will be few employers on the receiving end of a DSAR from a disgruntled employee who would not consider either or both of those paragraphs to apply to it. So is this at last a means of pushing back against the weaponisation of DSARs in employment disputes, hooray? And if you add to that the reference in the description of “manifestly unfounded” to cases where the requester is making “unsubstantiated accusations against [the employer] or specific employees” and “is targeting a particular employee against whom they have some personal grudge”, surely the position is put beyond doubt?
That is clearly what the guidance says, but we think it very unlikely to be what it means. To apply the guidance in that way would put a bus through one of the fundamental rights granted by the GDPR and DPA 2018, i.e. the right to know what of your personal data your employer has and what it has done/is doing with it. As we know, in case of conflict, the rights of the data subject (the employee or ex-employee) will almost always outweigh those of the employer/controller. Moreover, it is always for the employer to prove that the request is manifestly unfounded, not the employee to prove that it isn’t. So an uphill struggle awaits at the best of times.
The drafting of the guidance is unhelpful here since the “right of access” is exercised by the very fact of making the DSAR in the first place, not why the employee does it or what he subsequently does with that data. It would be safer to read this as subject to Article 15 of the GDPR which covers cases where “the individual clearly has no interest in obtaining… confirmation as to whether or not personal data… [is] being processed”. Recital 63 of the GDPR says that DSARs should be made with a view to “verifying the lawfulness of processing”. This is absolutely not what most employee DSARs are about, but equally that is not what the ICO guidance says. The burden on an employer to prove that verifying lawfulness was not even a subsidiary purpose of the request will be a very heavy one. After all, how many DSAR disclosure exercises in contentious cases are not met by allegations that something has been missed and the threat of a referral to the ICO?
As to “obtaining some sort of benefit from the organisation”, can you automatically go from an employee’s offer to withdraw a DSAR if a settlement payment is made straight to the DSAR having been made for that purpose? Almost certainly not, any more than you could do in relation to a grievance or interrogatories on alleged discrimination. You could try to argue that those two are necessary parts of the formal dispute procedure where the DSAR is not. However, especially if the DSAR is time-limited to the period of the dispute, you cannot object to it as a means of securing disclosure of documentation potentially relevant to that dispute even well before the formal ET disclosure process. Therefore it is next to impossible to argue that an employee’s DSAR has “no real purpose other than to cause disruption”, even if that is true.
In addition, unless you are very sure of your ground indeed, even the mere alleging of “malicious intent” on the part of the employee is a serious hostage to fortune in any proceedings for discrimination or other detriment where compensation for injury to feelings might be awarded.
All of this leaves unanswered the very sensible question of what circumstances, if not these, those paragraphs in the guidance would actually cover. Some decided cases on this (which we do not yet have in sufficient numbers to learn from) would be helpful. In the meantime, while those paragraphs might be used to buy some time in a dispute with your employee, they cannot safely be relied upon as holding the potential defences for employers which they suggest, in anything but the most extreme cases.
