GDPR subject access request from disgruntled employee

[Trailhead]

We have received a subject access request from an ex employee who was dismissed for breaching confidentiality.

Some of the records we hold for this employee are the investigation notes that name existing employees who have evidence against the ex employee.

Can we with hold their names to protect them? Or must we provide this?

[rog007]

You would usually have to provide all information held about the subject.

If that also might disclose third party details, you would usually get the third party to agree or you would attempt to anonymise.

[Notreallymeeither]

I believe you can redact (black out) the names of the other employees.

[p4cks]

Notreallymeeither said:

I believe you can redact (black out) the names of the other employees.

Indeed you can

[Mr Pointy]

But can you redact information which would allow third parties to be identified?

[Simpo Two]

And if he should then visit them with a baseball bat? Not my department but common sense decrees the names must be witheld.

Or perhaps you threw the records away last week... is there any requirement to keep them after the event?

[davepoth]

https://ico.org.uk/for-organisations/guide-to-the-...

There are a few get-out clauses in this circumstance.

[blearyeyedboy]

Simpo Two said:

And if he should then visit them with a baseball bat? Not my department but common sense decrees the names must be witheld.

More than just names; you can and should redact any information or narrative that can identify a third party. "Xxxx who works two offices down the corridor" is as bad as naming them. Carefully scrutinise your documents for anything like this.

You could argue that you owe a duty of care to your other employees to redact this info, and you could be in worse legal hot water if you don't and your ex-employee does anything to them.

[Australiam]

I would also recommend you document your decision regarding what you withhold, and the logic behind it. Lets assume your requester is out for causing you trouble, then if he/she knows you are withholding anything, they may well make a complaint to the ICO. If the ICO comes to you, you want to be able to explain what you have done, and why. In addition to any exceptions the ICO give you to providing the info, you should ideally do a balancing test, to balance the rights of the individual requesting, with the rights of the individuals who's identity you are trying to protect.

[blearyeyedboy]

Australiam said:

I would also recommend you document your decision regarding what you withhold, and the logic behind it. Lets assume your requester is out for causing you trouble, then if he/she knows you are withholding anything, they may well make a complaint to the ICO. If the ICO comes to you, you want to be able to explain what you have done, and why. In addition to any exceptions the ICO give you to providing the info, you should ideally do a balancing test, to balance the rights of the individual requesting, with the rights of the individuals who's identity you are trying to protect.

This is excellent advice.

[Europa1]

OP, the advice re redaction is pretty sound. Case law was starting to develop under the old Data Protection Act around the right (or rather lack of it) to use a subject access request as a fishing expedition to possible litigation, rather than following the due process of discovery. We are now of course in the brave new world of GDPR. I would seriously recommend investing a few hundred quid in an hour with a specialist data protection lawyer.

[Ilovejapcrap]

What is GDPR ? Why does ex employee want such a thing

Just curious

[Australiam]

Ilovejapcrap said:

What is GDPR ? Why does ex employee want such a thing

Just curious

The GDPR is the General Data Protection Regulation, which is a European regulation that along with the 2018 Data Protection Act (for the UK) replaces the 1998 Data Protection Act (that came fully into force in May this year). It is the rule book surrounding how any organisation must operate when processing any personal information. The regulation gives the individual (known as the data subject) many more rights, which organisations must abide by.

A data subject including an ex-employee may have many reasons for wanting to exercise their rights, for example, to find out what gives a company the right to keep emailing me marketing? Or what data does my ex-employer hold about me, and why? Though generally a good thing for the individual, it is complex for organisations, as its requirements are much more stringent than previous regulation, and there are now significant penalties to organisations that are non-compliant. However it does open the door to abuse from individuals who's sole purpose is to make life difficult, and companies have little choice but to respond to the requests of the individual. For that reason organisations are working through their processes to make the whole thing as smooth as possible, and to ensure they are compliant.

Edited by Australiam on Tuesday 16th October 13:01

[Tuna]

I'm not certain the information you're holding automatically falls under GDPR:

From here: https://www.lexology.com/library/detail.aspx?g=e58...

Article said:

There are circumstances in which you may not have to respond to a SAR (subject access request):

• if a SAR is "manifestly unfounded or excessive", you can charge a fee or refuse to respond, but in line with the emphasis on transparency and accountability, you will need to be able to provide evidence as to how you reached that conclusion and must also tell Tian of the possibility of complaining to the supervisory authority and taking legal proceedings;
• you could withhold personal data if disclosing it would "adversely affect the rights and freedoms of others" (guidance suggests that this could extend to intellectual property rights and trade secrets); and
• if Tian has made the SAR for the primary purposes of causing trouble and expense to the employer or is insisting on production of information with no conceivable value, you may be able to rely on the doctrine of abuse of rights and refuse to respond to the SAR.