Data Protection Legislation dictates that an individual shall have the right to obtain, from a data controller, access to all personal data that the controller holds on them. This includes emails, text, written notes, CCTV imagery and personnel file. Anyone can submit a DSAR and the data controller will generally then have one month to respond with the information.
When searching for the requested personal data, it is not unusual for organisations to find information e.g. emails, that contain information that could be perceived as derogatory or offensive, disclosure of which could cause the organisation and the individuals concerned embarrassment, disrepute and open them up to a complaint. It should be noted that organisations may be forced to disclose this to the data subject, unless an exemption applies. Exemptions to a DSAR are generally narrowly interpreted and in most cases, the unsavoury information will need to be disclosed.
Furthermore, separately from disclosures under a DSAR, written communication may end up being disclosed in internal investigations e.g. disciplinary procedure or even external proceedings such as a court action. Organisations and staff within those organisations should bear this in mind and be careful in its approach when documenting information about other individuals.
Keeping Communications Professional
It goes without saying, it is infinitely better not to put an organisation in the unenviable position of having to disclose communications written in an unprofessional manner. Staff should keep all communication professional, respectful and use discretion when using all forms of communications – sometimes it is better to pick up the phone. As more of us continue to work from home during the lockdowns, it is important to remember that this applies to video conferences and online meetings as well. The most obvious place that employees may let their guard down is instant message in apps like Skype, Discord or Microsoft Teams. Don’t be tempted to think that instant messages are private – they are not. Any electronic communication sent via work devices is not necessarily private and could be the subject of a DSAR or required to be disclosed or shared under internal or external investigations.
Last year in Scotland, in the case “B C and Others against Chief Constable Police Service of Scotland and Others”, messages from a private WhatsApp group were deemed permissible in a court case that involved disciplinary procedures against a number of policemen. The Court of Session held that the public interest trumped the right to privacy of the police. Despite the police being held to a higher standard of probity than civilian employees, the case is still relevant, as often former employees use the DSAR process as a method of gathering information to make a claim against a former employer. Moreover, if the employee does take a case, the employer may place a ‘legal hold’ on all the relevant information, meaning the information cannot be deleted or altered in any way. Therefore, any communications sent have the potential to end up in a bundle of evidence in court and subsequently made public by the media.
Likewise, it should be noted that even if staff use a private email address for business purposes, information contained within those emails could also be caught by a DSAR and ultimately disclosable despite them sitting on a private email account. The purpose and context of the processing would have to be taken into consideration, nevertheless it is untrue to suggest that private emails would not be caught by DSARs in all cases.
Ultimately it is very important all staff are aware that all communication sent in the context of their employment could eventually find itself being the subject of a DSAR or having to be disclosed as part of an investigation. As such, any urges in the heat of the moment to write something unprofessional e.g. discussing colleagues in disparaging way should be resisted. Keep communication professional at all times.
Employers should ensure they have set out clearly their expectations of their staff when using work communication facilities typically within the Staff Handbook. It is also recommended to consider best how to remind their staff of this via training or other means.
Insight from Loretta Maxfield Data Protection specialists at Thorntons. For more information contact Loretta or Jennifer on 03330 430350.
