30 Nov 2016

Employers be warned: failure to respond properly to a subject access request (“SAR”) can lead to a finding of unfair dismissal.

Employers be warned: failure to respond properly to a subject access request (“SAR”) can lead to a finding of unfair dismissal.

Dealing with a SAR can be challenging enough. It can become even trickier where the employee (or former employee) may be making an SAR on a ‘fishing expedition’ as a pretext for a subsequent tribunal claim or for those contemplating litigation.

To confuse matters further, previous judgements in this area have upheld the right of employers not to comply with a SAR made in the context of on-going litigation. The traditional view has been that SARs should not and cannot be used as a veil to enable employees (or more widely data subjects) to obtain information that may assist them with litigation. However, rejecting an SAR solely on the basis that there is relevant or on-going litigation is a risky approach, as courts do have discretion as to whether or not to order compliance with an SAR.

The potential consequences are highlighted in the recent case of McWilliams v Citibank. The employee worked for Citibank as a trader who was suspended and then dismissed for disclosing confidential information in online chatrooms to people from other banks – seemingly a fair reason to dismiss. The Employment Tribunal (“ET”), however, took a different view, and held that her dismissal was unfair, partly because of the failure by Citibank to respond to her (albeit wide) SAR. Ignoring the employee’s SAR had ultimately disabled the employee’s ability to respond to the disciplinary allegations, as her suspension meant she had no access to colleagues or documentation required in order to defend the allegations made against her.

It was the total lack of action by Citibank which struck a chord with the ET. It was clear that Citibank had categorically failed to provide any documents by reducing the scope of the request, or indeed to carry out any kind of proportionate search.

The lack of an adequate response to an SAR is likely to lead to complaints to the Information Commissioner’s Office (“ICO”), and possibly fines of up to £500,000 currently. Further, any breach of compliance with an SAR may be relevant to the overall “fairness” of the dismissal in an unfair dismissal claim, especially where it causes prejudice to the employee, as was the case here. The award for a successful unfair dismissal claim is up to a year’s salary as compensation, not to mention the burden of cost and time spent in litigation.

Key takeaways:

From a data protection view…

  • Only in very clear cases of an abuse of process will employers be able to refuse an SAR, even if it is seen as no more than a fishing expedition. In this case, Citibank should have responded to the SAR, despite the fact that its purpose was to obtain information as part of the disciplinary proceedings and tribunal claim.
  • For wide SARs, employers should consider:
    • Negotiating with the employee to narrow the scope of the SAR to a more reasonable level (and to keep a paper trail of this).
    • Making an effort to supply some, even if not all, of the requested documents.

Even where the employee refuses or is not satisfied with the above approaches, the courts are likely to be more sympathetic to employers who have at least attempted to enter into some kind of dialogue with the employee. Therefore, the optics in handling a SAR can prove key in the event of litigation!

  • More broadly, with the increasing use of SARs, staff/HR training in this area – including the exemptions and the consequences of non-compliance – is essential. After all, prevention is always better than cure.

From an employment law view…

  • In this case, one of the employee’s main arguments (which ultimately succeeded) was that she was prevented from defending herself during the disciplinary investigation, due to her suspension and the outright denial of Citibank to respond to her SAR. Employers should carry out a fair and reasonable investigation during disciplinary proceedings. Specifically, employees should be given the opportunity reasonably to defend any allegations being made against them.

For more information, please contact Razia Begum on +44 (0)20 7382 8025.

Razia is a senior associate in the employment team. She specialises in providing commercial and practical advice to clients on employment and data protection issues.