Pavel is bringing an equality claim through his union against his employer on the grounds that he is not getting the same terms and conditions of employment as his Irish colleagues. Pavel and his union representative are building a case but they would like to have access to his employment file which is in the possession of the employer. What are Pavel’s rights on access to his personal data and how does the Data Protection Act of 1988 and 2003 assist him?
Personal data is any information that relates to an identifiable, living individual. It includes any data held in paper files, on computer, on CCTV records or even on sound files.
The company have a duty to keep the personal details of Pavel private and safe. This is what is meant by 2data protection2 under the legislation under Section 4 of the Acts. He has a right to obtain a copy, clearly explained, of any information relating to him on file by the company. He needs to write to the company and ask for it under the Data Protection Acts. His Union representative will assist with this.
A sample request letter from the Data protection Commissioner’s site at www.dataprotection.ie/docs/Making-an-Access-Request reads:
I wish to make an access request under Section 4 of the Data Protection Acts 1988 and 2003 for a copy of any information you keep about me, on computer or in manual form in relation to.... (Pavel should send in as much information as possible to assist the company to locate the data that he is interested in accessing e.g. staff number, or location, grade etc.
Pavel may be may be asked to pay a fee by the company for supplying copies of the data, but this cannot exceed €6.35.
Once he has has made his request, and paid any appropriate fee, he must be given the information within 40 days.
Yes, in certain circumstances. For example, a company can claim legal privilege and withhold a communication between lawyers and the company on legal advice that might be given in defending the Equality claim. Also a request for access to information on Pavel’s colleagues may be restricted.
He can ask the company to inform him of any opinions on him given by individuals and recorded on file unless the company considers that the opinions are confidential. The nature of the extent of confidentiality can be investigated subsequently by the Data Protection Commissioner.
If the company does not comply with a valid access request from Pavel, then it it is open to him to make a complaint to the Data Protection Commissioner. Before doing so the Data Protection Commissioner would recommend to him that he would contact the company to establish the circumstances and to indicate his intention to complain to the Commissioner. If there is no response, or maybe an unsatisfactory response, the Commissioner will investigate the matter with the view to ensuring his rights are upheld. The Commissioner does not have the power to award compensation but can give a declaration that rights were breached.
Pavel, assisted by his union representative if necessary, should send an email or formal letter to the Data Protection Commissioner. The communication should include the following
name the company he is complaining about;
describe the steps taken to have his concerns dealt with;
give details of any response which he may have received; and
provide copies of any letters or emails exchanged between him and the company.
The Commissioner will investigate Pavel’s complaint and seek to find a resolution to the matter. If efforts at resolution fail, and the Commissioner agrees with his complaint, he will try to make sure that the company complies with the law by sending out the requested data. The Data Protection Commissioner can be contacted at:
The Office of the Data Protection Commissioner