Two local business and employment experts have warned of the potentially crippling risks of data protection obligations as many businesses prepare for widespread redundancies.
GDPR rules introduced in 2018 state that any employee can make a Subject Access Request (SAR) to request disclosure of emails concerning them as individuals.
Now, as businesses look to make redundancies following the end of the Government’s furlough scheme, Hale-based GDPR consultant Sam Alford and Jill Bottomley of The HR Dept Trafford and Warrington have jointly warned of the extra, little-known and costly implications that business owners may face at this challenging time.
How does a business owner know if they have risk and what can they do about it?
“The starting point is GDPR, which is all about protecting personal information about living people” explains Sam Alford, a GDPR Consultant and author of ‘GDPR a Game of Snakes and Ladders.’
“You should have already let people know what data you have, how long you will keep it, what you plan to do with it, who you share it with and how you delete it and most importantly what the lawful reason/purpose is for having it.
The people about whom you hold data, whether they are staff, customers or others have the right to know all those things before you process their data. They have the right to ask for you to provide a copy of the information you hold on them and you have to reply within 30 days unless the request is vexatious or manifestly unfounded”.
What many business owners may not realise is that a SAR can be raised at any time by an employee, requesting disclosure of emails sent between managers, or from or to external advisors or consultants, where the employee is named. This also extends to copies of hard copy files, notebooks, SMS and messages on work phones and all electronic files.
So how can SARs be a risk if making redundancies?
Jill Bottomley, Director of The HR Dept Trafford and Warrington, one of the network of HR Dept franchise offices providing outsourced HR to circa 7000 small and medium size businesses across the UK, explains
“In some situations, an employee made redundant may believe that they have been unfairly selected for redundancy, or they could claim that the process was a sham, where an outcome had already been pre-judged.
An employee could submit a SAR (it doesn’t cost anything) to try and find evidence to support their belief. A company has to respond to a SAR, trawling through all data and disclosing information where the employee is named. If an employer has been found to have pre-judged the outcome of any process and it has not been fair e.g. a manager naming an employee in an email to another manager that the individual would be selected from amongst others for redundancy before any fair process is followed; this could lead to a claim of unfair dismissal.
Naming and scoring employees on a redundancy matrix spreadsheet too early in a process, before finalising the proposed selection criteria with employees, or before consultation has ended, could be disclosable under a SAR and used in evidence in any tribunal claim for unfair selection/dismissal.”
Sam Alford stresses “GDPR has not gone away. Businesses need to be alive to what data they hold on people and aware of the potential consequences of mismanaging it.” Her advice is “Ensure that appropriate GDPR policies are put in place, and all managers are aware of their obligations, the risks, and consequences of what they communicate in electronic form and that they have had appropriate training. Fundamentally, they need to be aware that what they think is private correspondence, may not be.”
With employment tribunal claims soaring, Jill Bottomley advises
“Business owners may be unaware of the risk contained in emails sent between members of their management team. If employees have been named in a situation that could be regarded as having been pre-judged, this could cause serious and costly business problems.
Usually companies have nothing to hide or fear; however, the time and cost, if you have to respond to a SAR, can be very disruptive regardless and something that many business owners could do without the distraction of, especially during current, difficult times.
Companies without in-house HR or GDPR expert advice should seek professional support and follow ACAS processes for redundancies and any disciplinary matters.”
If considering naming individuals in emails ‘if in doubt, put nowt’ is something businesses might want to adopt, to avoid unwanted disclosures in the event of any potential Subject Access Request.
For further information contact:
Jill Bottomley – Director – HR Dept Trafford & Warrington – jill.bottomley@hrdept.co.uk
Sam Alford – Director PPP Management – sam.alford@pppmanagement.co.uk
https://www.pppmanagement.co.uk/
