Governance, Procurement & Information Article
14 September, 2021
On 07 September 2021, the Information Commissioner's Office published an enforcement notice against First Choice Selection Services Ltd for failing to comply with a subject access request made during the course of employment tribunal proceedings.
An individual originally submitted a subject access request to First Choice on 07 May 2020, which was during the course of employment tribunal proceedings against First Choice. A manager responded to the request on the same day stated that they had no intention of providing the information requested and would release the information, as the tribunal designates, at the required time. The individual replied to remind First Choice of its obligations to comply with a subject access request and the manager again responded to confirm that they would provide all the information relating to their claim when instructed to do so by the tribunal.
The individual complained to the ICO about First Choice's refusal to comply with the subject access request. Subsequently the ICO, wrote to First Choice on four separate occasions to confirm that First Choice was in breach of data protection law by failing to respond to the request. First Choice responded to the fourth letter from the ICO to state that the tribunal had instructed them to release no information to the individual at this stage. Further correspondence between the ICO and First Choice then ensued and the ICO requested evidence that the tribunal had ordered that no documentation was to be disclosed. At a later date, an email from the tribunal was provided to the ICO which stated that the tribunal had no jurisdiction to deal with matters relating to data protection requests.
Following receipt of that email, the ICO determined that First Choice at breach data protection law for failing to comply with the subject access request. The ICO found that First Choice had sought to avoid comply with the subject access request on the basis that the tribunal had instructed it not to provide any documents to the individual. The ICO found that this was wilfully misleading and breached requirements under the GDPR to comply with subject access requests and the accountability principle.
In light of those findings, the ICO issued First Choice with an enforcement notice. The enforcement notice required First Choice to comply with the subject access request within one calendar month. Failure to comply with an enforcement notice can result in a fine of up to £17,500,000 or 4% of annual global turnover, whichever is higher.
It is important to note from this enforcement notice, that subject access requests must be complied with and the presence of any ongoing legal or employment tribunal proceedings does not mean that an organisation can refuse to comply with a subject access request. The GDPR only permits an organisation to refuse a subject access request if the request is manifestly unfounded or excessive. Whilst the presence of ongoing legal or employment tribunal proceedings will clearly be a key consideration when dealing with the request and applying exemptions, it is not a valid reason to refuse to comply with the request.
It also highlights that disclosure as part of legal or employment tribunal proceedings is a different regime to disclosure of personal data under a subject access request and organisations should have appropriate processes in place to recognise and respond to such requests.
Schools and colleges undoubtedly on occasions have to deal with both employment tribunals from members of staff and legal proceedings from students (for example if there has been an accident in school). It is now a common tactic for those bringing claims to submit a subject access request prior to a claim being commenced and even during the course of proceedings. If this occurs, you will need to ensure you have a process in place to deal with the subject access request ensuring you apply exemptions relating to legal professional privilege and negotiations carefully to ensure that you are not disclosing information you do not need to, which may ultimately prejudice your claim, or any defence to a claim being brought against you.
Learn more about our Education department here