What is a Data Subject Access Request (DSAR)?
Many of you will know that Team Torque is a huge fan of Strictly Come Dancing and so will appreciate our excitement when Strictly collided with our other great love…employment law, of course!
It’s recently been widely reported in the press that former Strictly contestant, Amanda Abbington, has lodged a formal request with the BBC for footage of her rehearsals with her professional dance partner, Giovanni Pernice. You may recall that Amanda Abbington pulled out of the competition this year on medical grounds, so it’s likely she intends to use the footage to back up her assertions that rehearsals detrimentally impacted her mental health.
This form of request is known as a Data Subject Access Request (DSAR).
We’re finding that more and more employees are exercising their right to access their personal data held by their employers. Sometimes a DSAR is used a pre-litigation tool, other times it can be used simply to obtain information about internal discussions relating to an individual’s employment, usually in contentious circumstances.
Either way, receiving a DSAR fills most employers with dread – responding to a DSAR is onerous, time-consuming and challenging. Individuals have a right to access their personal data pursuant to the UK GDPR and Data Protection Act 1998 and, for that reason, there’s very little grounds to refuse to comply with a request; employers simply need to get on and deal with it within the prescribed timescales (within one month of the request save that, if the request is complex, a response may be provided within three months).
A pertinent point that Amanda’s DSAR highlights (and one which is often a surprise to employers) is that personal data isn’t just limited to emails and documents, it extends to any data that relates to an individual and that individual can be identified or identifiable either directly or indirectly from one or more identifiers or from factors specific to the individual. So, video footage, CCTV, photographs, texts messages etc. can all amount to personal data.
The key to limiting the time and cost of responding to a DSAR is to put in place a plan and timetable at an early stage. “Easier said than done” we hear you – that’s true, but we’re here to help guide you through the process and advise you about best practice. Please do get in touch if a dreaded DSAR lands on your desk!
If you want to get ahead of the game, on 22 February 2024, I am hosting a FREE virtual coffee morning about DSARs, the pitfalls and how to respond. Click here to the sign-up page. I hope to see you there!