If you know about GDPR, can you pop in here please?

[Letterkennie]

The new GDPR rules - do they mean I can have all the files my employer has on me?

What about stuff from a third party, eg a contractor my employer uses?

Both are big multi national companies.

Please help! How can I get my files? I need them for a legal thing.

Nothing to do with GDPR - you've always had the right! Ask for a subject access request.

What sort of info are you looking for, your employment records, sickness, references?

That would be a Subject Access request. However you may have been entitled to any files under a Freedom of Information request before the recent gdpr regulations came in.

I thought Subject Access Request was only on state/govt organisations?

I want my HR file plus any correspondence which may concern me between my employer and their suppliers/contractors.

Sorry I’m in a bit of a state

Applies to any organisations.

Nothing to do with GRPR. Ask them for the info you want.

However you may have been entitled to any files under a Freedom of Information request before the recent gdpr regulations came in.

FOI did, and still does, only relate to information held about decisions made by public bodies. Nothing to do with persona data at all.

The fore-runner to GDPR was the Data Protection Act.

Crikey! I didn’t know!

So they have to send me everything that refers to me, even if it puts them in a bad light?

What about their contractors/third parties/suppliers?

Am excited now.

Freedom of Information Act is for public sector organisations, Subject Access Request (SAR) is for any organisation. You can def ask for your HR file and correspondence - depending on what’s in there they may be able to withhold/redact some info (eg if it constitutes a third party’s personal data) and if there is a lot of info they can ask you to narrow the request. It’s best to make the request as specific as possible, while still covering what you want.

The company's data protection policy(which may be available or linked to via their website) should included the process of making a SA request. This should include information shared with 3rd parties.

I thought Subject Access Request was only on state/govt organisations?

Wrong. SAR was part of Data Protection Act, now part of GDPR.

I want my HR file plus any correspondence which may concern me between my employer and their suppliers/contractors.

They don’t have to give you everything. They can redact information which is about other people and some can be withheld if it’s commercially sensitive. Your HR file only has to hold certain things too.

I think thy can object if your request will is so broad that it will cost them a disproportionate amount to provide it all too.

So they have to send me everything that refers to me, even if it puts them in a bad light?

No.

SAR applies to any organisation. FOI public sector only.

Yes they do have to supply everything, but some words/sections might be redacted in some circumstances (E.g. to avoid revealing personal information about someone else).

Third parties may have to consent to sharing any information, you can Google all this on the gdpr website, subject to access, what is personal data, third parties, it's all there to read.

Yep. Except there's a chance they won't have filed that kind of thing, or you'll be referred to in such a way that doesn't identify you directly to an outsider, that kind of thing. Companies are getting savvy about what they hold.

More info: ico.org.uk/your-data-matters/your-right-of-access/

Ahhh

So they can refer to me as just LK and then I can’t access it?

I’m fairly certain there are emails between the company’s security firm and my HR mgr which outline that they want to get rid of me and please have a look for evidence, that kind of thing.

So if I wrote to the security firm they would send me the stuff that pertains to me too.

Game on.

Thankyou for this. I know it’s out there under google but I got into such a state I couldn’t think straight and need to hear it in plain language.

You are entitled to know what information they hold about you in recorded format (so electronic files and hard copy records). You are entitled to see that information, either by going in to view it or them sending you a copy. Some information may be exempt from disclosure - for example, information about third parties which would constitute personal information. The GDPR and the resulting Data Protection Act 2018 simply strengthened existing data protection law and added some new rights for individuals and obligations on people holding personal data. You have always had the right to make a subject access request.

FOI is completely separate to DPA/ GDPR

Have a look at the Information Commission website - www.ico.org.uk for how to make a subject access request.

However, if you are represented by a Solicitor get them to make the request.

You may also be entitled to see some information if you issue a claim against your employer under the disclosure rules.

I’m seeing my solicitor next week - why is it better if it comes from them? Because it shows I mean business?

What are the disclosure rules?

Yes!