Ex employer has ignored my subject access request

[bwills34]

On 12th June, I submitted a SAR to my ex employer and they didn't respond. My understanding is that they have 30 days to respond under GDPR, or let me know if it will take them longer to get the information I'm asking for.

As they haven't responded, what's my next step? FYI, I'm taking them to employment tribunal and the SAR is relating to that as I wish to see what they have on file on me.

 

[tony84]

https://ico.org.uk/your-data-matters/your-right-of-access/

https://ico.org.uk/make-a-complaint/

 

[bwills34]

Should I move straight to making a complaint or chase them again? I don't want to be too heavy handed.

 

[Blaby Loyal]

Consider sending them a "seven-day letter" setting out their statutory obligations following your request and that, on the face of it, they are in breach and what you will do if they don't comply within the seven days.

Be clear and set a time and date deadline in your letter e.g. " ... by no later than 4:00pm on Friday 27 July 2018".

If they still fail to comply then consider going ahead with a complaint and you should probably include the failing in your points of claim for the Tribunal.

 

[bwills34]

Great, thank you. I'll give them another 7 days.

 

[tony84]

I would crack on with the complaint personally.
You have given them a deadline, they ignored it. Why give them another week?

You are not being heavy handed, you are just getting on with it.

 

[obscure]

......Why give them another week?

Because courts/tribunals etc like to see that you have been reasonable and have made every effort to settle a dispute. If you ask and someone ignores you you ask again (with a reasonable deadline). If the matter ends up in court this record of rebuffed/ignored attempts at negotiation kill any chance they have of claiming that the original transgression was a simple mistake or that they were misunderstood.

 

[bwills34]

I've sent the email now giving them another 7 days and notifying them that they're already passed the deadline. Fingers crossed that they respond now.

In a way, it doesn't surprise me they haven't responded.. they wouldn't respond when I got ACAS involved, my ET claim form didn't reach them from the court (apparently...) and now they've ignore my SAR.

 

[bwills34]

I’m fairly certain I won’t get a response from my ex employer in relation to my SAR. I have my formal complaint to the ICO ready to go tonight/tomorrow.

Is it worth adding my emails to my employer to the employment tribunal bundle?

 

[cjd]

For disputes in legal matters everything like this should really be sent by post, preferably by recorded delivery to prove service.

But of course, add the email to your bundle it shows bad faith.

 

[Chris Ashdown]

I would be surprised if they have much written down, companies a very nervous of these things now, so may just return the basic facts, and keep the comments verbal to be used

Its simple for them to say we destroyed all information on the person one month after dismissal, but at the meeting each witness could say from memory" I said, He Said etc"

Just possibilities that could happen

One thing though the GDPR is a minefield that will be exploited to the maximum far more than intended

 

[GraemeL]

For disputes in legal matters everything like this should really be sent by post, preferably by recorded delivery to prove service..

Absolutely spot on. Emails can always get lost or not reach the intended recipient, so there the a valid defence for not responding within deadlines.

 

[bwills34]

Absolutely spot on. Emails can always get lost or not reach the intended recipient, so there the a valid defence for not responding within deadlines.

Quite right - however I've emailed a person directly and I've tracked it so I know it's been opened. I can even show the dates and times it's been opened by using hubspot sales free email tracking software.

 

[bwills34]

Would a solicitor ever advise an organisation not to respond to a SAR?

 

[Chris Ashdown]

There seems to be no Confidential escape from the GDPR and the potential fine is well out of proportion to the offence

 

[mattk]

What have you asked them to disclose as part of the SAR?

 

[bwills34]

Conversations that were had with colleagues and management where I have been the topic.

They also stated they have my person text messages and photos backed up to my laptop and that they were accessed by my colleague. I have asked for the messages and photos that they have, and also any images of the messages or photos that were shared.

They initially said that they would only delete the messages and photos if I agreed to their settlement agreement and dropped my right of appeal against my dismissal, I refused.

 

[AlanJ1]

Quite right - however I've emailed a person directly and I've tracked it so I know it's been opened. I can even show the dates and times it's been opened by using hubspot sales free email tracking software.

Be careful about this, Hub Spots email tracking is fantastic and works well, but you haven't got permission to track the email and may throw some spanners in the works if you go onto claim legally they ignored you even though you have proof.

 

[paulears]

Not wishing to pile on the agony, but I would doubt very much if they will provide you with anything negative to their case. Files get lost, misplaced, accidentally deleted and all that will happen is that they'll respond "To the best of my knowledge, there are no files matching the content you have requested. Very sorry." How can you prove they have what you only surmise, not know for certain. You think they have this data. They could have deleted it when things got warm, and now they are hot, they're long gone. Nobody will own up to having what you need. Many years ago I had a dispute over some files my old boss claimed I had not created. By this time I had left and didn't have access to my office computer - but they had looked at it and not found them. Last year I found an old drive in the shed that said office backup 2001, and on it was the file I had never created. Proof 17 years too late.

 

[mattk]

Conversations that were had with colleagues and management where I have been the topic.

They also stated they have my person text messages and photos backed up to my laptop and that they were accessed by my colleague. I have asked for the messages and photos that they have, and also any images of the messages or photos that were shared.

They initially said that they would only delete the messages and photos if I agreed to their settlement agreement and dropped my right of appeal against my dismissal, I refused.

Have you had any contact from the company? Have you spoken to their Data Protection Officer? I doubt any company would supply you with copies of emails which contain other people's personal data.

I don't think the company have any obligation to provide you with "personal" text messages and photos that are on a company laptop.

 

[fisicx]

I don't think the company have any obligation to provide you with "personal" text messages and photos that are on a company laptop.

This has been discussed at length in their other threads. It’s not at all clear what they hope to achieve with this. Even if the company complied with the SAR I doubt very much it will provide meaningful answers.

 

[bwills34]

NHow can you prove they have what you only surmise, not know for certain. You think they have this data.

They have told me, on email, that they have it.

Have you had any contact from the company? Have you spoken to their Data Protection Officer? I doubt any company would supply you with copies of emails which contain other people's personal data.

I don't think the company have any obligation to provide you with "personal" text messages and photos that are on a company laptop.

But if they're personal, then they belong to me so surely they're obligated to provide me with my personal data if I do ask for it? However I'm no GDPR expert so I'm really not certain.

They're ignoring my email. I've followed the route that they state in their privacy policy and I've also copied the HR Manager in on the email and they're just not responding. Their privacy policy asks that SARs are submitted by email.

 

[bwills34]

This has been discussed at length in their other threads. It’s not at all clear what they hope to achieve with this. Even if the company complied with the SAR I doubt very much it will provide meaningful answers.

What are the other threads as I've tried to find stuff on here relating to GDPR but I can't find it.

 

[Newchodge]

Your other multiple threads.

 

[sjbeale]

If the paperwork is needed for your claim the employment tribunal will take a dim view of the respondent failing to disclose it. I would write to the employment tribunal about their failure to disclose. You could ask for a strike out. Hopefully you will be offered a preliminary hearing to discuss the matter. This is in addition to writing to the ICO.

 

[mattk]

They have told me, on email, that they have it.



But if they're personal, then they belong to me so surely they're obligated to provide me with my personal data if I do ask for it? However I'm no GDPR expert so I'm really not certain.

They're ignoring my email. I've followed the route that they state in their privacy policy and I've also copied the HR Manager in on the email and they're just not responding. Their privacy policy asks that SARs are submitted by email.

No. If you have saved personal files onto your work laptop, then it is your responsibility to retrieve them before you hand the laptop back. These wouldn't fall within the remit of GDPR.

As for your request, I fear it is too wide ranging. I am surprised the company has ignored it completely and not replied giving you a reason for not responding. As I said, I think you need to be specific in your request and preferably speak to the appropriate person to ensure they agree that what you are asking fall within GDPRs remit.

If what you really want is not data related to you as the data subject, but in fact copies of more general information about discussions involving you, then I think you need to discuss this with the appropriate parties.

 

[Blaby Loyal]

Set out and evidence in a clear and concise manner the other side's failings as far as you are concerned and get on with your claim to the Tribunal.

 

[fisicx]

If what you really want is not data related to you as the data subject, but in fact copies of more general information about discussions involving you, then I think you need to discuss this with the appropriate parties.

This is the key bit.

If there was an email with a your name in the content relating to the use of a company laptop you would not be able to get this. But if you asked for the records HR hold them you might have more luck.

What you want and what they are obliged to hand over are two different things.

 

[bwills34]

Your other multiple threads.

Sorry, I misread the post. I thought I was being directing to other relevant threads about GDPR

 

[Mr D]

They have told me, on email, that they have it.



But if they're personal, then they belong to me so surely they're obligated to provide me with my personal data if I do ask for it? However I'm no GDPR expert so I'm really not certain.

They're ignoring my email. I've followed the route that they state in their privacy policy and I've also copied the HR Manager in on the email and they're just not responding. Their privacy policy asks that SARs are submitted by email.

So they at the time of the email had some data.

The laptops I've returned to work when leaving (or getting new laptops) I wiped in advance of any data and the employer also took action to wipe data before issuing again or disposing of it.
I'd expect them to wipe the laptop of non-business stuff at the very least and use again.

 

[bwills34]

So they at the time of the email had some data.

The laptops I've returned to work when leaving (or getting new laptops) I wiped in advance of any data and the employer also took action to wipe data before issuing again or disposing of it.
I'd expect them to wipe the laptop of non-business stuff at the very least and use again.

And that’s true. They may have wiped it and if they have, good! That’s what I want.

 

[fisicx]

And that’s true. They may have wiped it and if they have, good! That’s what I want.

But if they haven’t there is nothing you can do about it.

 

[bwills34]

But if they haven’t there is nothing you can do about it.

But surely that’s what what gdpr is there to help me with?

 

[fisicx]

But surely that’s what what gdpr is there to help me with?

Nope. Not at all.

In this case GDPR is about the personal data they hold relating to your employment. It's not going to help you manage data you put on a work computer.

If you had made a list of your friends and their contact numbers and saved it on the work computer then its your responsibility to manage that data. It's not data the company holds about you, this was something you did yourself. You chose to use company property for your own personal data. You were responsible for that data and its security not the company. They are not obliged to tell you if the data is still accessible, what they have done with the data or even if the laptop is still in use.

 

[Chris Ashdown]

There may be conflicts of interest as well, I doubt they can pass on say emails or meetings, as it would involve giving you access to data, the other person mentioned does not what to give permission to release

Say a email about you from Fred in HR to Steve as MD, if these two people don't give their approval to distribute to a third party it raises a catch 22 situation, they are protected under GDPR and you are denied under it as well

 

[NicoJ]

As far as I'm aware (and I don't profess to be an expert) GDPR relates to ALL data that could reasonably connect you to an individual, not just a certain aspect of personal data. I would therefore disagree with fisicx about the obligation they have with regards to personal information on the laptop.
I think they do have an obligation to inform the OP what they have done with the data and delete it if requested to do so. (They should have automatically done so as another poster noted above).

 

[bwills34]

Thank you all. I was also under the impression that it was any data that could be identified as being yours but I can't be certain.

I've had a response back from them today stating they've considered my request and that they feel it will take a while to search the data (over 40 days ago I sent my initial request...) so they will need a 2 month extension. I've also spoken to the ICO and they've said their response is too late as should have been within the 30 days and without undue delay if they were looking an extension. The ICO are working through a backlog so not certain when they'll get to it but he said they'll assign a case manager and they'll get in touch with the organisation directly.

I've let them know it's now with the ICO. I had already sent my complaint in before they responded today as I hadn't had a response or even an acknowledgement to my 2 previous emails. Although on today's communication, they've acknowledged receiving both.

 

[Chris Ashdown]

You may be digging a big hole for yourself in the future if references are ever required and word gets passed around not always on official channels, maybe a ex worker at the same place

 

[bwills34]

You may be digging a big hole for yourself in the future if references are ever required and word gets passed around not always on official channels, maybe a ex worker at the same place

That's completely correct however I think that ship sailed a while ago! Sad really as I haven't found myself in this position before.

 

[Nico Albrecht]

Quite right - however I've emailed a person directly and I've tracked it so I know it's been opened. I can even show the dates and times it's been opened by using hubspot sales free email tracking software.

I don't think you know and understand how email tracking works at all. There is actually no proof at all that the email was opened. It is an indication at best. Any request like that only posed and singed for.