Data Subject Access Requests (DSARs): An invaluable tool for Employees?

Welcome to my latest LinkedIn newsletter! In each issue, I will be sharing Employment Law insights on important topics with my connections and followers.

DSARs are, depending on who you speak to, an invaluable tool for individuals seeking access to their personal data held by their employers.

DSARs can be made for various reasons, although they are often used to elicit critical information that may be hidden beneath the surface in the vast array of databases controlled by Companies. They are undoubtedly useful when considering whether to issue an Employment Tribunal claim.

In this article, I consider the practicalities of submitting a DSAR to your employer or former employer and their use as a tactic in settlement negotiations or getting a claim off the ground.

What is a DSAR?

A Data Subject Access Request is a legal right granted by data protection legislation, namely the General Data Protection Regulation (GDPR) and Data Protection Act 2018, which permits individuals to request access to the personal data that organisations, including their employers and ex-employers, hold about them.

Often, an employer will store 1,000s of pieces of data about you on multiple databases, including email, instant messaging and online conferencing software. If you are involved in a dispute with your employer, submitting a DSAR can be a tactical move to uncover important information that can make a real difference to your case.

Pros and Cons of making a DSAR

It is relatively simple to submit a DSAR. There is no prescribed form, and they do not need to be in writing (although this is advisable for clarity). There is also no longer a cost to making a DSAR, and there is, therefore, little disadvantage to doing so, either at the pre-claim stage or as part of settlement negotiations.

Employers must respond to your DSAR ‘without undue delay’ and at the latest within one month, although this deadline can be extended by up to two months in the case of complex requests or if you have made multiple requests. This sets a clear timeframe for obtaining necessary information and can be invaluable in helping you prepare your case. However, employers may attempt to delay sending the data or dispute the complexity of the request, leading to potential delays in receiving the information.

You should factor any possible delays into your timetable and not rely on your employer or former employer providing the information you seek before the deadline for submitting your claim, which is typically within 3 months from the date of the act you are complaining about. Employers are wise to this strict timeframe and will often delay their response for tactical reasons, citing one of the reasons above (among other reasons; see more below). A word of advice: don’t leave a DSAR until the last minute.

Currently (and subject to a number of reforms proposed in the Data Protection and Digital Information Bill which is going through parliament,) your employer can refuse to respond to a DSAR if it believes the request is ‘manifestly unfounded’ or ‘manifestly excessive’, but it will depend on the circumstances and the terms. These terms are not defined anywhere in the legislation, although guidance can be found on the ICO website. However, it can be difficult to apply the guidance in practice.

A request can be manifestly unfounded if it is clear that it is being made maliciously or that you do not intend to do anything with the information provided. Manifestly unfounded exceptions are rare, but you should take care not to phrase your DSAR in such a way or accompany it with threats/comments that could lead your employer to seek to rely on this ground for refusal. A manifestly excessive DSAR could be when it is clearly unreasonable and disproportionate. This does not mean, however, that a request for a wide range of information will be excessive. Subject access rights are considered a critical component of our data protection framework, and the threshold to refuse is likely to remain high.

When making your DSAR, and to avoid it being challenged, you want to strike a balance between requesting solely that information that is relevant and helpful to your case and ensuring nothing is missed, and your employer is doing an extensive search. Beware, however, that if your employer provides too much information, this may not be helpful, as finding the ‘smoking gun’ may be like finding a needle in a haystack. Your employer can also ask you to narrow down your request or be more precise about what you are looking for. And remember that the more complex the request, the greater the delay may be in you receiving that information.

One drawback of a DSAR is that you cannot directly take action against an organisation if it fails to respond or does not respond to your DSAR within the required response time. You do, however, have the option to escalate the matter to the Information Commissioner's Office (ICO) if you do not receive a response to your DSAR, and the ICO may take enforcement action and other remedial steps against an organisation, including issuing a fine. From experience, the ICO tend to focus on the bigger fish. Therefore, be warned this threat may sound good in theory, but unless your employer is already in the ICO’s firing line in practice, a complaint might amount to next to nothing.

Privacy Rights

When responding to a DSAR, employers must balance your right to access your personal data and the right to privacy and confidentiality of other individuals and the employer's need to protect its confidential information. In practice, this means that employers may choose to redact or withhold certain information to protect ‘sensitive’ data. This means that relevant evidence may not be disclosed or disclosed in full, leaving you to piece together information. But all is not lost; these scraps or data gaps may provide more information than you think, as they may direct you to areas to focus on. The good news is that if you proceed to issue a claim, this redacted information can be challenged as part of the disclosure process, which is much more rigorous and demanding than any DSAR process. ?

Organisations must justify redactions and demonstrate that they are necessary to protect the privacy of individuals or the company’s confidential information. If you think the redactions are unjustified, you can challenge them through the ICO in the first instance but, more importantly, during your Employment Tribunal or Court proceedings, where it will be much more difficult for the employer to resist.

Deploying a DSAR

DSARs are a powerful tool, both at the pre-claim stage and also during settlement negotiations. Submitting a DSAR can reveal internal communications, performance reviews, emails, and other documents that shed light on your employer's actions or motivations, strengthening your case and making it harder for your employer to mount a defence.

The threat of the ‘smoking gun’ that could be revealed by a DSAR may push employers into negotiating a settlement rather than defending a claim and facing any potential reputational damage from the information that is disclosed in response.?

Even where employers are confident, rightly or wrongly, that they have nothing to hide, a DSAR, whether actual or threatened, can put pressure on them to settle, if only to avoid the considerable work and costs in time and money involved in responding to such requests. Employers will be well used to employees ‘trying it on’ and making empty threats of court proceedings to extract a settlement – submitting a DSAR is a simple and cost-effective step that can show your employer that you do, in fact, mean business.

To conclude...

Submitting a DSAR can be a strategic and powerful move for employees considering issuing proceedings against an employer or former employer or attempting to negotiate a fair settlement. The information revealed by a DSAR could be the ‘smoking gun’ that gets your case off the ground and, at the very least, may encourage your employer to enter settlement negotiations rather than deal with your request.?

While there are limitations in the DSAR process, including response time, possible redaction of information, and privacy concerns, the potential to uncover critical evidence and the pressure put on the employer will generally outweigh any drawbacks.

A DSAR can be a powerful weapon in your arsenal and can make all the difference in achieving a satisfactory resolution of your dispute.

Feel free to Get In Touch if you are an employee experiencing problems at work and are contemplating submitting a DSAR, either in anticipation of submitting a claim or as part of an exit strategy. I will be happy to assist you and discuss tactics going forward.

Thanks for reading, and please subscribe. I'd love to know your thoughts in the comments below.