In addition, we would take the opportunity to draw to your attention a number of concerns that have been raised by our Members in relation to the scope of the exemptions.

‘Disproportionate effort’ exemption

In our view, given that subject access requests can be highly resource intensive, the limited operation of the exemptions can result in an imbalance between the interests of the data subject against the effort that the data controller has to take to recover the data.

Take the recent case of a Member who received a subject access request from an employee who was made redundant. The request was in respect of his private correspondence and own emails dating back over many years. The request was received after the termination of employment and the individual initially sought access to his work computer to retrieve certain material. The Member was unwilling to allow the ex-employee to have access to the company IT system for security reasons.

This meant that the Member had no alternative but to provide the data covered by the Act either in hard copy or possibly on disc. It should be noted that the employer had a clear policy prohibiting the private use of company equipment but, perhaps surprisingly, the employer nevertheless remained the data controller of such material.

The search carried out by the Member revealed thousands of personal emails mostly sent to the individual’s wife at work or the individual’s home computer and seemingly of no real importance, including, for example, details of their plans for the weekend, shopping lists and general reminders in relation to events long since past. Having located the emails and documents, the Member then needed to make an assessment of whether they contained personal data covered by the Act, whether they contained personal data relating to third parties and, if so, should this information be withheld or disclosed and what information (other than a copy of the personal data) should be provided in response to the subject access request. This process was extremely time consuming for the Member. The Member felt that the individual was abusing the system.

We accept that the subject access provisions helpfully permit an employer to ask the individual to supply such information as the employer may reasonably require in order to locate the information. This can clearly help to reduce the time spent by an employer in locating the information but does not itself reduce the permitted scope of the request or the time involved in assessing whether the data should be disclosed. The qualification is therefore of limited value as the employer is still required to locate the data and consider whether it should be disclosed, taking into account third party rights, which can be very time consuming. If so, the individual must be provided with a copy of the information requested in a permanent form, unless providing it in that form would involve disproportionate effort in which case the employer need only give access to the information.

In our view, ‘disproportionate effort’ should be taken into consideration when assessing whether the information requested needs to be disclosed at all and should not solely apply to the manner of production of the information. It is the aspect of locating and reviewing the information that will more often involve ‘disproportionate effort’ rather than the actual provision of a copy of the information once it has been located.

Management forecasting exemption

The impact of subject access requests made in respect of redundancy exercises has given rise to concerns. The first difficulty is that the management forecasting exemption is of limited availability and seems only to apply before the event of the redundancy round i.e. in advance of the release of the names of the persons to be made redundant. This means that subject access requests for redundancy assessment forms cannot be resisted between the time of the redundancies and the deletion of relevant records. Clearly, the deletion of redundancy assessment records is not really an option for many employers since they may be necessary in the event that the employer needs to rely on them to defend the redundancy process against challenge. The result is that until the records are deleted, retained staff will be able to have access to their redundancy assessment scores. In one case that we know of, the trade union co-ordinated subject access requests from all staff affected by the redundancy, whether retained or dismissed. The Member would have liked to have refused such requests from the retained employees on the grounds that the disclosure could lead to a severe drop in morale (employees would consider they knew who would be next to go) and because it could lead to unrest where retained employees disagreed with their markings.

The situation described above is an area where we consider that employers should not be required to provide this material in response to a subject access request and a review/extension of the management forecasting exemption would therefore be welcomed. Our proposal would also result in consistency with the relevant case law and employment tribunal practice on disclosure. For example, there is clear authority for and it is accepted practice that an employer is required to disclose to an employee selected for redundancy the details of his or her individual assessments (otherwise the redundancy may be rendered unfair). This does not, however, extend to the employee being entitled to compare his or her own scores with those employees who are to remain. Further, the employment tribunal is unlikely to order disclosure of the forms of the retained employees to an employee challenging his redundancy selection, particularly where the individual appears to be seeking the information to go a ‘fishing expedition’ for specific instances of unfairness, British Aerospace plc v Green & others [1995] IRLR 433.