Employers should think carefully before refusing a subject access request (SAR) in the context of an employment dispute. In the recent case of McWilliams v Citibank NA, the employment tribunal decided that Citibank should have responded to the SAR received from an employee despite the fact that its purpose was to obtain information as part of disciplinary proceedings.
Ms McWilliams was suspended from her job as a foreign exchange trader at Citibank in early 2014, following an internal investigation relating to breaches of client confidentiality in the use of the Bloomberg online chat facility. Ms McWilliams submitted a SAR under section 7 of the Data Protection Act 1998, requesting copies of all data relating to her held by 25 named individuals. Citibank refused the request on the basis that it was disproportionate.
Ms McWilliams subsequently narrowed the search criteria and made it clear that the response was vital for her to be able to respond to the disciplinary allegations.
When Citibank further declined to process the request, Ms McWilliams complained to the ICO.
Before the ICO had ruled on the complaint, Ms McWilliams was dismissed for gross misconduct.
The employment tribunal held that the dismissal was unfair. Citibank had failed to carry out a reasonable investigation and failed to enquire as to whether it was general practice amongst traders and senior managers to share confidential information in chat rooms.
The tribunal also held that Citibank's rejection of the SAR contributed to the procedural unfairness since it had a material effect on the ability of Ms McWilliams to defend herself in relation to the disciplinary allegations. The tribunal did make the point that employee requests for information in disciplinary proceedings may be 'little more than a fishing exercise'. However, it did not consider this to be the case here because Ms McWilliams had no access to the documents she needed to defend herself following her suspension.
Although this case is only an employment tribunal decision, it highlights the difficulties employers face when presented with a SAR during a disciplinary process, or in anticipation of a claim from an employee.
The previous case of Dawson-Damer and others v Taylor Wessing LLP and others  emphasised that the SAR provisions do not enable a data subject to obtain discovery of documents that may assist them in litigation. However, the courts do have a discretion as to whether or not to order compliance with a SAR so it is risky for employers to dismiss SARs without considering the legal basis of the request.
If an employer is not certain if it can rely on one of the exemptions when faced with a SAR, it would be advisable to enter into a dialogue with the employee (or former employee) to narrow down the scope of the request to a more reasonable level. The employee may of course refuse, but in this situation the courts may be more inclined to back the employer if the request was made in furtherance of litigation.
This publication is intended for general guidance and represents our understanding of the relevant law and practice as at October 2016. Specific advice should be sought for specific cases. For more information see our terms & conditions.