Case law: Employer who did not provide information requested by employee under data protection law in disciplinary proceedings acted unfairly
Employers who fail to provide information requested under data protection law by an employee facing disciplinary proceedings can be acting unfairly, making the employee's subsequent dismissal unfair, a ruling makes clear.
Data protection law gives individuals a right to ask an organisation about personal information it holds on them. The individual exercises this right by submitting a 'subject access request' (SAR) to the organisation. SARs are usually used to obtain a copy of the information, but can be used for other purposes too. An organisation can refuse a SAR on various grounds, for instance, the search required to uncover the data would be disproportionate. Alleged breaches of the SAR rules are judged and enforced by the Information Commissioner's Office.
A bank alleged an employee had breached client confidentiality and started disciplinary proceedings. The employee submitted a SAR but her employer refused to provide the data on grounds of proportionality. She submitted another SAR, limited to certain search terms. Again, her employer refused, saying it was unreasonable. Ultimately, she was dismissed for gross misconduct.
Previously, an employee's SAR submitted in these circumstances had often been judged to be an abuse of process, so that an employer's failure to provide the information requested did not make a subsequent dismissal unfair.
However, in this case the Employment Tribunal (ET) found that the employer's disciplinary process and her subsequent dismissal were unfair because the employee had been suspended during the process and did not have access to the information she needed to defend the allegations against her. The failure to provide the information requested in her SARs had therefore contributed to the unfairness of the procedure.
The ET came to this conclusion without ruling on whether the failure to provide the information requested was justified under data protection law, pointing out that this was a matter for the Information Commissioner to decide.
Employers receiving a subject access request (SAR) under data protection law from an employee facing disciplinary proceedings cannot assume the request is an abuse of process and ignore it, but may have to provide the information to avoid acting unfairly
Case ref: McWilliams v Citibank NA East London Hearing Centre, 19.4.16 (Case No.3200384/15)
Authorised and Regulated by The Solicitors Regulation Authority. Authority number 591294.
For details of the professional rules governing the conduct of solicitors go to www.sra.org.uk/code-of-conduct.page