Tag Archives: DSAR

New post-Brexit DSAR guidance – still no bonfire (UK)

Back in March 2020 we reported here on some new guidance from the Information Commissioner’s Office concerning DSARs.  In particular, we looked at what it said about the employer’s rights not to comply with a DSAR to the extent that it was manifestly unfounded or manifestly excessive, and concluded that despite the superficially encouraging words … Continue Reading

Proposed new EU regulatory regime for Artificial Intelligence – more relevant to HR than you might think (UK)

For the last year or so the EU Commission has been working on the world’s first serious attempt to create a regulatory framework around the use of AI, the Artificial Intelligence Act.  The Proposal itself runs to over 100 pages of dense type and no pictures, so is a fairly off-putting read at first look.  … Continue Reading

Employee Data Subject Access Requests in the UK: Part 4 – how to deal with mixed data

In part 1 of this blog series, we asked how employers facing a Data Subject Access Request (DSAR) should be dealing with ‘mixed data’ cases, i.e. when a third party’s personal data is intertwined with that of the requester? Mixed data comes in many forms; for example, an email from John to a colleague saying … Continue Reading

Employee Data Subject Access Requests: Part 3 – DSARs and proportionality – limiting the search (UK)

Some DSARs can be wonderfully straightforward: “Can I have a copy of my personnel file?” “Absolutely, here you go” “Can I have a copy of the notes from my appeal hearing?” “Of course, all yours. Any time” However, a large number of DSARs submitted by employees are far more taxing: “Can I have all personal … Continue Reading

Employee Data Subject Access Requests: Part 2 – It’s complicated – extending the DSAR deadline (UK)

In the second of our five part blog series on Data Subject Access Requests (DSARs), we examine the notion of “complexity” and how that might affect the way you respond as an employer to a DSAR. What is “complex”? Under the General Data Protection Regulation (GDPR), data controllers must respond to DSARs “without undue delay … Continue Reading

Employee Data Subject Access Requests: Part 1 – where are we now and what questions remain? (UK)

Just when we thought we were getting to grips with some of the stickier issues around Data Subject Access Requests (DSARs), then along comes the EU General Data Protection Regulation (GDPR) and numerous new ambiguities over how its DSAR provisions might work in practice.  We are waiting for the ICO’s guidance and update on its … Continue Reading
LexBlog