This this guide notes outlines the procedure for employees to make a Subject Access Request (SAR) to their employer, detailing the rights and responsibilities of both the data subject (employee) and the data controller (employer).
At the end our members will find a template SAR to use.
Index:
How the RequestShould be Presented to the Employer?
Introduction
When an employer fails to respond to a SAR, it can be indicative of non-compliance with data protection laws, which may be brought to the tribunal's attention. Furthermore, if an employer provides additional data during the litigation process that was not included in their initial SAR response, this discrepancy can be disputed when agreeing on the court bundle. Such inconsistencies can undermine the employer's credibility and may be used to challenge the completeness and accuracy of the evidence they present.
It is essential to meticulously review the data provided in response to a SAR and compare it with any further disclosures made during the tribunal proceedings. Any omissions or new information can be strategically addressed to support your case.
Making a Subject Access Request
How to do SAR and gather evidence from an employer?
An employee may make a SAR either orally or in writing, including via social media or using the Information Commissioner’s Office (ICO) online service. Read your contract of employment to see if you bound by specific provisions.
The request should clearly state that it is a SAR and specify the personal data being requested. Not narrowing the data may cause delays and in the cases of discrimination or any other potential claims the standard time limits apply which employee should be aware of for all the time.
The employee should provide sufficient information to verify their identity and to assist the employer in locating the requested data. This is best achieved by providing a copy photo ID and a letter confirming address. In large corporations it will be useful to provide employee number and branch location.
Presentation of the Request
The employee should present the SAR to the Human Resources (HR) department or their direct manager.
The request can be submitted in person, via email, or through any other communication channel recognised by the employer. However, due to potential lack of evidence, in the case of refusal or failure to respond to the SAR, the verbal request is not advisable. You should always try to put your request in writing via email or recorded post.
Employer's Responsibilities
The employer must acknowledge receipt of the SAR promptly and provide the requested information within one month of receipt.
If the request is complex or numerous, the employer may extend the response period by a further two months, provided the employee is informed within the initial one-month period.
The employer must ensure that all staff, particularly those in HR and management, are trained to identify and handle SARs correctly.
Employee's Rights
The employee has the right to obtain confirmation as to whether their personal data is being processed, access to their personal data, and information about the purposes of processing, categories of personal data, and recipients of the data.
The employee has the right to request rectification of inaccurate personal data and the erasure of personal data under certain conditions.
Data Protection Officer (DPO)
The employer should designate a Data Protection Officer (DPO) or a responsible person to oversee compliance with data protection laws and handle SARs.
Record Keeping
The employer must maintain a record of all SARs received and how they were handled, including the dates of receipt and response, and any correspondence with the employee.
Complaints
If the employee is dissatisfied with the response to their SAR, they have the right to lodge a complaint with the ICO or seek judicial remedy.
---------------------------------------------------------------------------------------------------------------
SAR Template Form [this template is specifically designed to make SAR but not uncovering the purpose of it]
Employees are encouraged to use the following template form when making a SAR to ensure all necessary information is provided:
[Employee's Name]
[Employee's Address]
[City, Postcode]
[Email Address]
[Date]
[Employer's Name]
[Employer's Address]
[City, Postcode]
Subject: Subject Access Request
Dear [Employer's or relevant person Name],
I am writing to formally request access to my personal data that your organisation holds, processes, or shares, in accordance with the UK GDPR and Data Protection Act 2018. Please provide the following information:
a) Confirmation that my personal data is being processed.
b) A copy of my personal data. [ specify the scale of the data sought relevant to your potential claim(s) it might be a date range ][do not specify why you seek this information as this may undermine your case]
c) The purposes for which my personal data is being processed.
d) The categories of personal data concerned.
e) The recipients or categories of recipients to whom my personal data has been or will be disclosed.
f) The envisaged period for which my personal data will be stored, or, if not possible, the criteria used to determine that period.
g) The existence of my right to request rectification or erasure of personal data, or restriction of processing of personal data concerning me, or to object to such processing.
h) The right to lodge a complaint with the ICO.
i) Any available information as to the source of the personal data, if it was not collected from me.
j) The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for me.
Please provide the information in a commonly used electronic format to the email address provided above.
Thank you for your assistance.
Yours sincerely,
[Employee's Name]
Comentários