Under the provisions of the Data Protection Act 1998, an employee has the right to make a Subject Access Request to their employer for copies of data held by the employer regarding them. There are complex rules under the Act as to the data which has to be disclosed, as well as the time frames and conditions which an employer can impose, and employers who receive a Subject Access Request should really seek advice on their obligations.
A Subject Access Request is something which employees or former employees often make when there is a dispute. That is what happened in the recent case of McWilliams v Citibank NA (2016). Ms McWilliams was a foreign exchange trader at Citibank who was suspended from work pending a disciplinary hearing. The reason for the suspension was that she was suspected of disclosing confidential client information to traders from other banks via an online chat room. Prior to the disciplinary hearing, Ms McWilliams made a Subject Access Request for all data held by Citibank relating to her. She named 25 individuals whose communications she included within the scope of her request, and several of those people were within her direct management line. Citibank refused to respond to the request on the grounds that it was disproportionate, and Ms McWilliams therefore narrowed down her request to data including 38 search terms which were relevant to the allegations which she faced. Citibank still refused to respond, and as a result Ms McWilliams complained to the Information Commissioner. Citibank then provided some, but by no means all, of the data requested.
Citibank then called the disciplinary hearing, and amongst other things Ms McWilliams claimed that she had been unable to properly prepare because she did not have any access to Citibank’s systems, and Citibank had failed to properly respond to her Subject Access Request. Following the disciplinary hearing, Citibank carried out limited additional investigation before dismissing Ms McWilliams for gross misconduct. She then instigated claims of unfair and wrongful dismissal.
The case was heard by the Employment Tribunal, who found in Ms McWilliams’ favour. They found that Citibank had not properly investigated her defence, which was in essence that her managers knew what she was doing, and indeed they were behaving in a similar manner. In addition, the Tribunal found that Citibank’s refusal to respond properly to Ms McWilliams’ Subject Access Request meant that she in effect had to rely on them to carry out a proper investigation. As such, the Tribunal held that their behaviour materially affected Ms McWilliams’ ability to fully respond to the allegations against her. However, the Tribunal also held that Ms McWilliams’ conduct contributed to her dismissal, and that any compensation should be reduced to take account of this. The percentage of reduction has yet to be reported, but it could in theory be 100%.
This case is, as is so often the case in the Employment Tribunal, very fact specific. However, it does show that a failure to respond to a Subject Access Request can be a factor for a Tribunal in determining the fairness or otherwise of a dismissal. Employers receiving Subject Access Requests often consider them to be a fishing expedition from a disgruntled employee or ex-employee hoping that their files will give them some evidence against their employer, but this case is a reminder that, however burdensome they may be, failing to respond is probably not a sensible option.
If you would like to talk through a situation you are dealing with, or if you need advice on any aspect of employment law, please contact any member of the Pure Employment Law team (01243 836840 or [email protected]).