The Data Protection Act gives various rights to individuals whose personal information is processed. One of the most important is the right to know what information their employer holds on them.
In order to have access to this information, an individual must make a request in writing. The employer has 40 days to comply with the request, and is entitled to ask for a fee of up to £10. The most straightforward way for an employer to meet a request is to supply the individual with a copy of the information that is held, and an explanation of any information that would not otherwise be intelligible. The employer must also let the individual know the source of the information, the purposes for which it is being processed, and the people or organisations to whom it may be disclosed. The Data Protection Code (code of practice ) gives guidance on handling subject access requests. In particular, it advises employers to check the identity of the person making the request, to ensure that information is given only to the person entitled to it.
An employer does not have to disclose information that includes information about another individual or that identifies a particular person as the source of the information, unless the other person consents to the disclosure, or it is reasonable in all the circumstances to comply with the request without the other person's consent. This may mean, for example, that the employer need not disclose a confidential reference that it has received from a current or former employer. The Data Protection Code (code of practice ) gives detailed guidance on this. Confidential references that the employer has itself given are also exempt from disclosure.
An employer need not disclose information that is processed for the purposes of management forecasting or management planning, if that would be likely to prejudice the conduct of the business. This means that information about proposed redundancies, mergers, promotions or reorganisations may be exempt. Likewise, there is no obligation to disclose information that records the employer's intentions in relation to negotiations with the individual, if disclosure would be likely to prejudice the negotiations. An employer may therefore not need to disclose information about its negotiating position on a salary increase or a severance package.