Subject Access Requests and Disciplinary Records

What information do I have to disclose in a Subject Access Request and can I provide redacted copies of evidence to keep the anonymity of those involved?

With all employees now more aware of their rights to access information held on them from GDPR training, I have had a request for a subject access request from an employee that has recently been disciplined.

The basis of the discipline was on reported behaviour from a number of other employees. At discipline or the disciplinary hearing, I chose to withhold the employee's names as it served no purpose to disclose. It would only cause more negative behaviour in the working environment and the testimony was such that the behaviour was undisputed.

Seamus: This is interesting in terms of subject access requests. If it has just been received post-25th of May, it'll be under the new GDPR regime. We know from that there's a reduction in the time to provide the response to that to four weeks rather than six. And you can no longer charge for it as well. Those are the preliminary points on that.

This is a typical situation that arises in disciplinary whereby maybe somebody confidentially comes to their own manager, makes a complaint and would be very uncomfortable with their details being provided or sometimes even on a general risk assessment, you can say to yourself it wouldn't be wise to provide the details of the complainant to this person. Maybe sometimes what happens is people will anonymise their statements or they will redact the statements. Alternatively, they will take parts of the statement and create one block page with maybe five or six of the comments that were contained within statements.

Really, what we need to look at is the fairness of that. It's a twofold test really, it's data protection rights of the person that the allegation has been made against because they'll be saying if this is about me, I'm entitled to know. It’s that versus the rights of the anonymity for the other parties.

Scott: Also, controlling the process because this caller here, this listener here knows the situation. There's no indication from the email I got that it was the witnesses themselves were saying, "Keep me anonymous." This was a manager who decided look, "For the sake of good employment relations, I'm going to pour oil on troubled waters. We know what's happened here. We don't want people falling out in the corridor. I'm going to keep them quiet and anonymous." I can understand that.

But from a complainant's point of view, you're saying, "Well, hold on. I want a fair trial. How do I know that these witnesses don't have it in for me in some way that their bona fides are genuine, that there isn't an ulterior motive? If I don't know who they are, I don't know if it's because I've done something bad to them or they've done something bad to me. You don't know if they're bullies. There's a whole series of issues there when you come to anonymity, particularly if in this case or as in this case, it's not the witnesses saying we are scared of this complainant. It's the employers saying, "You know what? I just want to keep a lid on it."

Seamus: Yeah. Absolutely understandable. You can see a circumstance where possibly a manager will say, "I think I can keep a lid on this. I think I can control this. I can get a resolution for all of these parties. Because the reality is they're all going to have to work together tomorrow. This business, this organisation needs to keep functioning. So there are those aspects. I suppose the real test will come down to if there was ever an employment tribunal claim taken and the LRA Code of Practice does have some guidance on witnesses.

Scott: Anonymity.

Seamus: Anonymity on it. Also, in relation to whenever you get to hearing and the right for the person to have a fair trial. Part of that aspect absolutely could be that they were never allowed to cross-examine witnesses. They never knew who the witnesses were. There could be allegations these witnesses don't like the individual itself. There are all sorts of issues that can arise there. Really sometimes it's hard at times to make correct decisions and to make right decisions unless you see the whites of the eyes and the person is sitting in front of you.

Certainly, there's no doubt in the best of the world that you would have a fair trial, even at the disciplinary stage where you maybe have witnesses attend the disciplinary hearing and allow cross-examination to take place. Where the circumstances permit that and where that is a reasonable and sensible action to take, I think it should be taken, where you are the manager and you're of the view that isn't something that you're going to be able to do, that there's maybe threats that have been made or there's maybe a concern there would be . . .

Scott: History of violence or something.

Seamus: Yes. You have those sorts of issues. You as the manager will have an understanding of that, where specifically the person who's coming to you and saying, "I want to raise a complaint, but I want this to be kept anonymous." It can be hard to guarantee that the individual that at the time. Really, what you need to do is weigh it up and assess it. It comes down to your justification and if it is justified and if it's the correct decision to make based on the circumstances, I think that should be recorded at the time in writing so that if it is challenged at a later date, you say, "Well, look, this is the circumstance that I was presented with at the time and I believed this was the right step to take."

Scott: Just before we move on, we've got another GDPR question coming in on the chat box. There's nothing, really that would in law allow a witness to say you can never use my name at any stage. The bottom line is this could be discovered if it goes to tribunal. It seems to be an internal disciplinary matter. It's not dismissal and so on. If it were to go to that level, there's a very good chance that information would be discovered and there's a very good chance the tribunals would look at the Walkers Snack Foods case and they'd look at the Linfood Cash and Carry case about what you do when you have to anonymise witness statements.

Really, they're looking at a big justification of threats of violence and such towards witnesses about steps the employer would have to go through to make sure they trust the witnesses and so on before they go forward. There's a very stiff burden, if you like, on that. The witnesses would not be able to block on the other side either. They wouldn't be able to block an employer from saying, "Hold on a second. You can't use my witness statement because it involves my name and I've got a right under the GDPR that you can't divulge that to somebody else." The GDPR is not there to stop the efficient process of discipline and grievance procedures.

Seamus: Absolutely not. It is a practitioner, it's a question that you get asked quite a lot and people do have concerns about their information and even from the advice I would give to HR advisors that would call through to me, that is definitely a concern they would have. You would say look, it's a balancing exercise. It's about sitting down and working through the ups and the downs, the rights and wrongs and hopefully arriving at a fair decision. But it does come down to fairness and ultimately, I suppose, there would be an entitlement at a tribunal stage.

I've been on many a case where we've had to go down before the employment judge and argue our case as to why documents, full documents on redacted documents should be provided and times why they shouldn't be. The employment judge will always encourage the sides to agree it themselves. But where they have to, they'll make a decision and it will be based on the principles as we talked about in the Walkers Snack Food case.