In conducting a disciplinary process which may lead to dismissal, employers must carry out a fair and reasonable investigation and allow employees to properly defend themselves.
Under the Data Protection Act 1998, employees have the right to access information their employer (as a data controller) holds about them. An employee has the following subject access rights:
- a right to be informed by their employer if their data is being processed;
- a right to a description of the data, the purposes for which it is being processed and the recipients to whom the data may be disclosed;
- a right to have certain information communicated in intelligible form; and
- a right to be informed of the logic of automated decision taking.
This right has become increasingly more onerous with the growth in the quantity of data held by employers and case law has clarified that the main purpose of subject access rights is for an individual to ensure their data is being processed lawfully and does not infringe their privacy.
Despite the Court of Appeal making clear that the primary purpose of subject access requests is not to assist parties in litigation, they are increasingly being exploited in proceedings such as employment disputes. In the recent case of McWilliams v. Citibank the Employment Tribunal held that a refusal to comply with an employee’s subject access request can increase the likelihood of any subsequent dismissal being unfair. This will occur where the refusal materially impairs the employees’ ability to defend allegations against them in disciplinary proceedings. As a result of the refusal in McWilliams, the employee was forced to rely on the employer’s investigation which was held to be inadequate as it did not give due consideration to the Claimant’s arguments. As a result of this and other factors, the dismissal was found to be unfair.
This case reinforces the importance of carrying out fair and reasonable investigations under the general principles of unfair dismissal legislation, including taking into account the employee’s version of events. Employees are likely to continue to enforce their rights to access data held about them both during employment and in the context of litigation after their employment ends. Employers who ignore subject access requests made when a disciplinary process is ongoing may find that doing so, in fact, creates additional risk in relation to any subsequent dismissal.
It should be noted that the new General Data Protection Regulation will come into force next year which will affect the subject access request regime, so look out for further updates on this.