UK: Subject access requests - employer's refusal to comply contributed to unfair dismissal

Refusing to comply with a subject access request may contribute to the unfairness of a subsequent dismissal, where the tribunal considers that the refusal materially impairs the employee's ability to defend themselves in disciplinary proceedings. In McWilliams v Citibank, the refusal to comply with the SAR meant that the employee had to rely on the employer's own investigation, which the tribunal held to be inadequate, and as a result her dismissal was unfair.

The case serves as a reminder of the risks of refusing a SAR on the ground that its purpose is to obtain advance disclosure of documents relevant to a dispute with the employer. The approach of the courts to orders seeking compliance with what can be viewed as "fishing expeditions" is unpredictable, as demonstrated by two recent cases. The High Court in Gurieva v Community Safety Development (UK) ordered compliance with a SAR on the basis that there was nothing inherently improper in using SARs to obtain early access to information that might otherwise be obtained through the litigation process. In contrast, in Dr DB v General Medical Council, the judge gave guidance that a sole or dominant purpose of use in litigation was a “weighty factor” in favour of refusing to order disclosure (albeit this was within the context of determining whether to disclose personal data of the data subject which contained personal data of a third party (so called "mixed data")). Dr DB also establishes that, in mixed data cases, it will be relevant that the third party whose personal data is included in the information has expressly refused consent to disclosure on privacy grounds.

Employers should also be aware that guidance from the Information Commissioner's Office provides that an employer's belief that a SAR is made for an improper purpose does not relieve it of its obligation to respond, given that the right of subject access is motive blind.