Buddy says: Broadly speaking, if you are an employer (the data controller), and are in possession of personal data relating to an employee (the data subject), then subject to the employee satisfying the correct approach for a request, you will be required to produce the information.

An individual’s right to make a request for information arises from the Data Protection Act 1998 (“the Act”). The Act applies to personal information held in structured paper files and processed automatically, i.e on a computer. The Act entitles the Data Subject to find out whether the Data Controller holds information about them and also allows the Data Subject to obtain a description of what the data covers, including:

• The purposes for which the personal data is processed.
• The recipient or classes of recipients of personal data to whom the data may be disclosed.
• The information which comprises personal data.
• Any information available to the employer on the source of the data.

Employer information: A request must be made in writing to the Data Controller who can request an upfront fee of up to £10 for the purposes of locating and copying the information. As it is important that the Data Controller knows the exact identity of the individual, an employer can ask for information that will satisfy this. This is especially pertinent if the employee no longer works for the employer. A request should not be accepted of it is on behalf of an ex-employee or current employee. A request may come in the form of a general request for all information held regarding an employee or may be a specific request for information. When a non specific request is made, the employer should consider it as a request for all information held.

The Data Controller has a duty to respond expediently and within 40 days of receipt of the request or, if later, within 40 days of receipt of: 

• The £10 fee;
• Evidence to satisfy the identity of the individual making the request; and
• Any information necessary to locate the information sought. 

Once a request has been made, the employer then has to know where to find the information. As the fee for the whole access request process is £10, employers should be keen to ensure that they have up to date systems in order to easily locate the information. Typically, automated personal data will be stored in the following places; databases, emails, cctv, word processors, telephone records, payroll and internet logs.

You are under no obligation to provide the Data Subject with a document such as a letter containing the personal data. All that is required is information contained within the document that constitutes the personal data. The information must be legible and in a permanent form, unless it is not possible or would involve “disproportionate effort”. It is permissible to transfer the information onto a spread sheet or to copy it onto a CD. When giving the information to the Data Subject, it should be clear who the source of the information is (i.e. if the information relates to the employee's salary and benefits, the source of this information would most likely be the accounts/payroll department). There can of course be more than one source of information.

Care should be taken to ensure that information relating to third parties is not disclosed, such as the fact that the third party is the source of the information. The identity of the third party should be deleted or blacked out as far as possible. An employer should provide as much information as possible without disclosing the identity of a third party. Where possible, the employer could consider obtaining consent from the third party before disclosing the information.

Where the Data Controller fails to comply with a request under the Act, the Data Subject can do the following: 

• Make a statutory request to the Information Commissioner asking for a determination as to whether the request has been carried out.
• Make an application to the court, alleging a breach of the data protection rules and seeking an order for compliance.
• Make an claim for damages against the employer. 

Employers are only able to defend claims if they can show that they have taken such steps as were reasonable in the circumstances to comply with the request.

For more information, see our Buddy fact sheet “Dealing with subject access requests”.