• Facebook
  • Twitter
  • LinkedIn
Call us now: 01243 836 840   [email protected]
Pure Employment Law
  • Who We Are
    • Nicola Brown
    • Peter Stevens
    • David Jones
    • Debbie Poole
    • Linda Nye
    • Brenda Cherry
  • For Employers
    • Advice on HR and People issues
    • Investigations, Hearings and Appeals
    • Restructuring and Redundancy
    • Defending Employment Tribunal Claims
    • Dismissal of Senior Executives
    • Contracts, Handbooks and Policies
    • Employment Law Training
  • For Employees
    • Settlement Agreements
    • Workplace Issues including Disciplinary and Grievance
    • Bringing an Employment Tribunal Claim
  • Employment Law Events
  • Legal Updates
  • Testimonials
  • Vacancies
  • Contact us
  • Search
  • Menu Menu

Q&A – Two tricky subject access request points

20 June 2019

Question marks

The Data Protection Act 2018 (DPA 2018) gave effect to the EU General Data Protection Regulation (GDPR). Many employers have already undertaken data audits, issued privacy notices and updated their data protection policies in light of GDPR, but may not be aware of some of the more tricky provisions under the new legislation. We consider a couple of these provisions in more detail below by answering some frequently asked questions:

  1. An employee has requested a copy of a reference about them, are we obliged to disclose it?

The DPA 2018 gives individuals the right to make a subject access request (SAR) to a data controller relating to the processing of the individual’s personal data. For a summary of the SAR process, see our previous article here.

Under the old DPA 1998, an employer who had given a reference about an employee in confidence did not have to comply with a subject access request to disclose the reference. The employee could, however, obtain a copy of the reference from the person who received the reference (i.e. the new or prospective employer).

Under the DPA 2018, however, both the giver of the reference and the recipient of the reference can potentially rely on an exemption in the legislation and do not have to disclose the reference to the employee. (In order to rely on this exemption you would be well advised to ensure that references you give are clearly marked as ‘confidential’).

On the face of it, this means that it will be more difficult for employees to get hold of copies of confidential references about them, and in turn more difficult to show, for example, that a reference was discriminatory or negligent. However, you should still ensure you take care when writing references, as you may still be required to disclose the reference if there is subsequent litigation, and it is of course possible that a prospective employer may share the reference with the employee anyway, even though they are not required to under the legislation. As we have said before (see our article ‘References – useful guidance for employers’), the rule of thumb is that if you give a reference, it should be “fair, factual and not misleading.”

  1. How do we deal with an employee’s request for personal data where the data also contains personal data relating to another employee?

When responding to a SAR in this situation, the data controller, i.e. the employer, has to balance the rights of the individual making the request against the rights of the other individual whose data is involved. If the other individual has consented to the disclosure of the information, or it is reasonable to disclose the information without their consent (having regard to all the relevant circumstances) then you should disclose the information.

However, if, taking into account all the circumstances, including “the type of information that would be disclosed” it would not be reasonable to disclose the information, then you do not have to disclose it. It may be possible to disclose a redacted version, or it may be justifiable not to disclose the information at all.

We are not aware of any cases having been brought on this point under the new legislation, but we can see that the types of situations covered could include where an employee requests information that could, for example, identify another employee who has made a complaint of sexual harassment, and whether it would be reasonable to disclose that data without the consent of the complainant. It is worth pointing out that there is an assumption that it will be reasonable to disclose information to a data subject in certain health, social work and educational contexts. We would always recommend taking specific advice if you are dealing with a SAR which could involve mixed personal data.

Are you dealing with a subject access request or a difficult reference? We can help – contact our team today for a free initial chat. Please call us on 01243 836840 for a no obligation chat, or email us at [email protected].

Please note that this update is not intended to be exhaustive or be a substitute for legal advice. The application of the law in this area will often depend upon the specific facts and you are advised to seek specific advice on any given scenario.
Share this article
  • Share on Facebook
  • Share on Twitter
  • Share on WhatsApp
  • Share on LinkedIn
  • Share on Reddit
  • Share by Mail

Join our mailing list

* = required field
Mailing Lists


Recent Legal Updates

  • Discrimination found in gender critical belief case 27th July 2022
  • Court of Appeal overturns Tesco fire and rehire injunction 27th July 2022
  • Changes to fit notes 27th July 2022
  • Where are we with the fire and rehire Code of Practice? 27th July 2022
  • Can long Covid be a disability? 29th June 2022
Link to: Contact Us

Any questions? Why not get in touch!

Our advice is always given in plain English without any waffle, and we focus on providing practical solutions to our clients’ problems.

Contact us

LEGAL INFORMATION

Pure Employment Law | 1 Little London, Chichester, West Sussex, PO19 1PH
[email protected] | Tel: 01243 836840

Pure Employment Law is the trading name of Pure Employment Law Limited, registered in England and Wales with company number 07134294 and whose registered office is 1 Little London, Chichester, West Sussex, PO19 1PH. Pure Employment Law Limited is authorised and regulated by the Solicitors Regulation Authority with registration number 533794. A list of the company’s directors is available for inspection at the registered office

DISCLAIMER

The information contained in this website is for general information purposes only. The information is provided by Pure Employment Law and while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.

Privacy Policy | Cookies Policy | Terms & Conditions | How to make a complaint | Sitemap

© Pure Employment Law 2022

Scroll to top

This site uses cookies. By continuing to browse the site, you are agreeing to our use of cookies as defined in our cookie policy.

Accept Cookie Policy

Cookie and Privacy Settings



How we use cookies

We may request cookies to be set on your device. We use cookies to let us know when you visit our websites, how you interact with us, to enrich your user experience, and to customize your relationship with our website.

Click on the different category headings to find out more. You can also change some of your preferences. Note that blocking some types of cookies may impact your experience on our websites and the services we are able to offer.

Essential Website Cookies

These cookies are strictly necessary to provide you with services available through our website and to use some of its features.

Because these cookies are strictly necessary to deliver the website, refusing them will have impact how our site functions. You always can block or delete cookies by changing your browser settings and force blocking all cookies on this website. But this will always prompt you to accept/refuse cookies when revisiting our site.

We fully respect if you want to refuse cookies but to avoid asking you again and again kindly allow us to store a cookie for that. You are free to opt out any time or opt in for other cookies to get a better experience. If you refuse cookies we will remove all set cookies in our domain.

We provide you with a list of stored cookies on your computer in our domain so you can check what we stored. Due to security reasons we are not able to show or modify cookies from other domains. You can check these in your browser security settings.

Google Analytics Cookies

These cookies collect information that is used either in aggregate form to help us understand how our website is being used or how effective our marketing campaigns are, or to help us customize our website and application for you in order to enhance your experience.

If you do not want that we track your visit to our site you can disable tracking in your browser here:

Other external services

We also use different external services like Google Webfonts, Google Maps, and external Video providers. Since these providers may collect personal data like your IP address we allow you to block them here. Please be aware that this might heavily reduce the functionality and appearance of our site. Changes will take effect once you reload the page.

Google Webfont Settings:

Google Map Settings:

Google reCaptcha Settings:

Vimeo and Youtube video embeds:

Other cookies

The following cookies are also needed - You can choose if you want to allow them:

Privacy Policy

You can read about our cookies and privacy settings in detail on our Privacy Policy Page.

Privacy Policy
Accept settingsHide notification only