28 January 2002
Data protection: Information Commissioner's Office has published a code of practice for subject access requests
30 August 2013
14 August 2013
21 February 2014
10 September 2013
27 November 2013
At the risk of appearing alar-mist, the Data Protection Act 1998 (DPA) impacts on every type of business and a failure to appreciate its import may lead to criminal convictions. The act came into force on 1 March 2000 and replaced the Data Protection Act 1984, the Access to Personal Files Act 1987 and some of the Access to Health Records Act 1990. Its impact has been minimised to date due to complex transitional arrangements, but those transitional arrangements ceased on 24 October 2001.
The DPA essentially regulates the processing of personal data, whether stored electronically or in a relevant (manual) filing system, which relates to a living individual who can be identified from that data. The act stipulates eight principles that must be complied with.
In order to assist in the interpretation of the statute, the Information Commissioner issued a draft code of practice. This caused widespread concern and anxiety, to such an extent that it was eventually withdrawn. We were then promised a revised draft by Easter 2001, which never materialised. The current proposal is that the draft code will now be divided into five parts, the first of which deals with DPA issues arising from the recruitment of staff. Although promised in September, it actually materialised in December and has already been the subject of considerable comment.
The most 'headline-friendly' aspect of this code is the right it appears to give job applicants to demand a copy of the employers notes taken at any interview, if such notes contain personal data which relates to them. It is difficult to envisage how notes taken at such an interview will not relate to the person being interviewed and the Assistant Commissioner David Smith has confirmed that "virtually all notes of job interviews will be open to access by the applicants".
Clearly there is scope for intense embarrassment if derogatory personal statements are written down. However, from an employer's viewpoint the most serious consequences arise when considering how such notes might be utilised in supporting a discrimination claim.
It has, of course, always been the case that someone who felt that they had been discriminated against at an interview could commence a claim and obtain copies of the notes through the process of discovery. What the new code will enable interviewees to do is obtain those notes at a much earlier stage in the process. In fact, this will probably become the first stage of any such claim.
The code may also increase the number of claims being made. It is possible that someone who requests a copy of the notes out of curiosity, without the intention of commencing litigation, may find comments made which give rise to claims being made. Such curiosity may be curtailed by an administration fee of up to £10.00, which the employer can levy.
Comments such as 'unmarried mother' or 'will they fit in?' or 'needs time off to go to hospital' may have damaging consequences. Evidential issues will be raised for an employer who will need to prove that the non-selection of that candidate was on the basis of something other than a discriminatory attitude held, even subconsciously, by the interviewer.
The code is undergoing a final pre-publication check and is due to be issued early this year. However, the Information Commissioner has stated in the past that the codes assist only in the interpretation of the DPA and therefore, since 24 October 2001, any requests received from interviewees to see notes have to have been complied with or a business could find itself being challenged for breach of the DPA, resulting in an award for damages and/or a criminal conviction.
Employers must ensure that everybody involved in the recruitment process is aware of the implications of the DPA and how it interacts with the discrimination legislation.
It is possible that the Information Commissioner chose to issue the code of practice on recruitment first, believing it to be one of the less emotive areas that the DPA covers. But this has not turned out to be the case and it must be with a sense of foreboding that the commissioner prepares to issue the code of practice on employee monitoring later this year.