Category Archives: Data Protection/Privacy

The Data Protection Act and Victimisation

The Data Protection Act 2018 has broadly been described as a positive re-inforcement of the data rights of individuals, including workers. This is a fair summary but it is not a completely positive development in that the Act has actually curtailed the rights of an worker to see what their employers and former employers have written about them and provides cover for unscrupulous employers to evade their accountability for discriminatory conduct.

Before explaining why it is helpful to recap on how one category of victimisation claim presents itself, by means of a hypothetical scenario. A worker has been subject to discriminatory behaviour by an employer, perhaps complaining about how a colleague sexually harassed them. After the employer conducts and whitewashes an internal investigation the worker resigns in disgust at the employer’s failure to confront endemic sexual harassment in their organisation. The worker is not however keen to pursue a sexual harassment case and just ones a fresh start at a new employer.

She applies for many positions, for which she is well qualified, but despite performing well at interview is never offered a job. She suspects that her former employer has provided an unfair reference, perhaps alleging performance or misconduct issues that have put off potential employers in retaliation at her for having made a complaint of sexual harassment. In fact, that is precisely what the former employer was done.

Under the old Data Protection Act (1998) if this worker made a subject access request for a copy of any references the former employer could (I think unreasonably) refuse to provide these but this get out did not apply to the employer’s a worker made an application to so that a copy of the reference and the retaliatory negative reference could be obtained. With that evidence in hand the worker’s suspicion of unlawful and discriminatory victimisation has a solid basis in evidence and she can be more comfortable that she has a good case of victimisation against her former employer under the Equality Act 2010.

However, under the Data Protection Act 2018 – paragraph 24 of Schedule 2 to be precise – both former and prospective employers are explicitly told they can refuse to provide a worker a copy of a confidential employment reference without any other proportionality considerations needing to be considered. So now a worker who thinks their former employer has unlawfully discriminated against them by providing an inaccurate and vindictive reference to a former employer on the basis of that employee having had the temerity to challenge for employer about how it discriminated its staff finds themselves hamstrung.

While they can of course still claim discrimination they will be much less likely to be confident bringing such a claim when their only evidence is their gut feeling that something is amiss which will inevitably mean good cases are not brought and bad employers will evade scrutiny. For workers subject to post-employment victimisation from former employers at least the Data Protection Act’s plaudits of advancing employee’s data protection acts ring hollow.

To date there has been no reported decisions (that I have been able to find) on the compatibility of  the reference caveat to subject access requests with human rights or the GDPR itself. Hopefully the harshness will in due course be mitigated or Parliament will see sense and repeal paragraph 24 of Schedule 2 of the DPA 2018.

Time for Celebration? The employment law implications of the Cliff Richard Judgement

privacyAside from the pathetic pun the title of this post is also misleading, I don’t think there are any significant employment law implications of Cliff Richards recent Human Rights Act victory against the BBC. However, I do think the judgement, if it stands (I am not sure it will upon appeal), could have some significance for some ordinary workers. But first a brief reminder of the facts of the case.

Cliff Richard was being investigated by South Yorkshire Police (SYP) in respect of an historic sex offence allegation that had been made against him. The SYP were planning to search Cliff Richard’s property. Motivated by fear that the BBC would report on this before the fact SYP cooperated with the BBC and as the search was being effected the BBC filmed this from outside, including the use of helicopter images – the story was subject received substantial media coverage. At no time was Cliff Richard actually charged by SYP for the offence.

Cliff Richard brought an action against both the BBC and SYP for a breach of his privacy and data protection rights under both the Data Protection and Human Rights Acts of 1998. In the event it was only necessary to consider his claim under the Human Rights Act. The BBC’s argument focussed much on Article 10 (Freedom of Speech/the Press) would be unduly interfered with if found wrong given the public interest in the matter. The finding of the judgement was that as a general principle a person who is subject to a police investigation up to and including arrest has a right to privacy that that investigation should be private and engaging that individual’s Article 8 (privacy and family life) rights. It should have been in Cliff Richard’s case, even though he was a public figure, and even if the investigation is in the public interest to be disclosed it does not follow that the subject of the investigation is.

The BBC have complained that the judgement “creates new case law and represents a dramatic shift against press freedom and the long-standing ability of journalists to report on police investigation.” Other commentators are equally critical such as  David Hencke and Robin Callender-Smith. The issues are real but for my part I think this is a good judgement that prevents tarnished reputations based n little more than speculation, and rumour.

But what relevance has this to employment relationships, I hear you ask?

As I said I do not think the impact on employment law per se will be telling, although it could provide an interesting factor on the reasonableness of an investigation in cases such as Cooper in which a Police force provided an employer with details of an employee’s arrest which then relied on this information to base a misconduct investigation.

In my time as a union representative I have represented a number of persons whom have been ‘outed’ by media outlets about their arrest for criminal investigations. These cases always follow the same route. The fact of an investigation / arrest is either reported in the press, with some salacious context that is frequently inaccurate. Or alternatively, the employer is informed of police investigations and the story then finds its way into the media one way or another.  The employee is suspended – which they are assured is only a ‘neutral act.’ The investigation proceeds, with the employee normally unable to contribute or respond to the allegations given to do so may prejudice his or her case (since no sooner has a response been given than it will be whisked off to the police). The employer refuses to defer the investigation until after the criminal investigation is concluded and so makes a decision on the (completely one-sided) evidence they have. The employee is dismissed with the major reason being that the employer has can no longer have trust and confidence in the employee, given the backdrop of criminal allegation or that the actions (even if not criminal) have brought disrepute upon the employer.

As a representative these cases are difficult, because for good reason the employee has followed their defence solicitor’s advice had not given a positive defence to the allegation or context. The only real arguments that can be advanced are procedural and these will rarely be sufficient to avoid dismissal – if dismissal is not an actual inevitability it is certainly the very likely outcome.

And this is where I think the Cliff Richard judgement is a cause of a certain degree of optimism. If the fact of an criminal investigation or even arrest encompasses the employee’s right to privacy the likelihood of these types of cases manifesting themselves by being reported in the media or even reported by the police under common law disclosure. As such the impulse for an employer to initiate an early investigation is much less likely to present themselves unless the employee reveals an investigation against them to their employer voluntarily. And if it does happens perhaps the employment tribunal will begin getting more serious about applying human rights in employment tribunal proceedings.  Time will tell …


Unfair Dismissal because of Subject Access Request failure

The Data Protection Act 1998 allows any person to request a copy of the personal information an organisation holds on them, this includes a request from an employee to their employer. Making such a request is termed a ‘subject access request’. Once an employer receives such a request they must – subject to a few exemption the legislation – supply the information within 40 days of receiving the request. This right is due to be strengthened in May 2018 when The General Data Protection Regulation 2016/679 is implemented into UK law (which I hope to do a separate post on). 

Subject Access Requests can be a useful tool in an employee’s arsenal when they are undergoing formal disciplinary or grievance proceedings and it is one I often recommend an employee makes – sometimes the outcomes can reveal strong grounds of appeal. For example, in one case I have seen evidence of a senior manager has instructed a disciplinary investigator on what outcome  her investigation must reach before the investigation had even begun. In another a manager committed in writing to another manager that contrary to the stated reasons to the employee the actual reason he was not making reasonable adjustments for an employees disability was because he planned to dismiss her, he was just waiting for an opportunity to do so.

Needless to say having such information in one’s hands in the course of a disciplinary process can be advantageous. In the first case because of management delays an employee’s warning was overturned on appeal as the information was received before the appeal hearing while in the second a disability discrimination complaint before the ET was fairly quickly settled. One of the difficulties with subject access requests however is the time allowed to respond, by the time the 40 days have elapsed many disciplinary and appeal processes have run their course (under the GDPR things will be a little better as the response time is 30 days), meaning if there is a ‘smoking gun’ it will be useless except as material for a employment tribunal claim(if the employee has the right to make such a claim).

This brings us the unfair dismissal case of McWilliams v Citibank (2017) a first tier decision. The facts of the case can be briefly stated. Ms McWilliams had been an employee for many year, she regularly communicated with other traders, including outside of the company, and involved sharing confidential matters. Citibank initiated a disciplinary investigation against Ms McWilliams.

In order to prepare a defence Ms McWilliams, while suspended and therefore unable to access her own records, submitted a subject access request which the employer refused to provide because it was disproportionate. She then submitted a narrowed down request  explaining this was necessary for her disciplinary case. Citibank again did not supply the information (and Ms McWilliams complained to the ICO – the data protection regulator). The employer refused to adjourn the disciplinary hearing and Ms McWilliams was dismissed.

At the tribunal a finding of unfair dismissal was reached on the specific basis that the employer’s treatment of the subject access request – which was a request for disclosure of information to enable Ms McWilliams to answer the charges against her – and the convening of a disciplinary hearing without that disclosure made the dismissal process procedurally unfair.

At root it was not the fact that a subject access request had been refused that made the dismissal unfair per se, it was that the employer had deprived the employee of a realistic prospect of presenting a defence to the allegations against her (a defence that it was subsequently established was supported by the FCA – that the conduct was conduct alleged was condoned by senior managers). Therefore, this case certainly does not mean that if a subject access request is refused or not complied with at the date of a disciplinary hearing the proceedings are unfair (but that is not to say I would not at least raise the issue) but the case is a helpful one and where there is a direct relevance of the subject access request – in this case her suspension made this more crucial – this is an issue that employees can raise in the course of proceedings.