A ‘subject access request’ is a way of asking your employer, or any data controller, for copies of the personal information it holds about you.
The Data Protection Act 1998 allows individuals to ask organisations for the information they hold about you. In the case of your employer, this can include all your personnel records including your sickness records and absence records, and any staff reports that are held, as well as any emails in which you are mentioned.
Your employer may charge you to send you copies of your records – currently organisations can charge up to £10 for a subject access request. Once the General Data Protection Regulation comes into force in May 2018, employers won’t normally be able to charge a fee.
Why make a Subject Access Request from your employer?
If you believe that you are being treated unfairly, or that you are being discriminated against in some way, it can be helpful to see your employment records and emails. Your records may include notes that have been written about you by your managers or other people in the organisation. Often there is a treasure trove of email information which is derogatory towards an employee. It could have details of meetings that have been about you which you were not involved in.
How to make a Subject Access Request
It’s as well to do your research before you make the request, so you know who to send your subject access request to, and whether there is a fee, so you can include all this with your request. This will reduce delays.
Once you have made your subject access request to your employer, your employer must respond within 40 days from the day they receive the fee from you and have enough information to identify you and the information you need.
If your employer doesn’t respond within 40 days, or doesn’t send all the information you think they are holding about you, you can challenge this. In some cases, though, your employer may be able to keep back some information if it also refers to someone else. In that case, your employer can only give you the information if the other person agrees, or if it would be reasonable to pass on the information without the other person agreeing.
You can make a subject access request to any organisation that controls personal data about you, not just your employer. You can get more information from the Office of the Information Commissioner.
What if your employer doesn’t comply with the Subject Access Request?
Often an employer will try to avoid complying with a Subject Access Request. If you want to push the matter, you could report your employer to the Information Commissioner’s Office (ICO). The ICO has the power to fine an employer. In addition, it is possible for someone to issue court proceedings in the County Court for a failure to adhere to the Data Protection Act 1998.