Businesses warned of soaring cost of employee subject access requests

Report shows quarter of requests involve workers trying to find out what their company holds on them

Visual representation of GDPR and the UK's independence from the EU

Just under half of UK organisations have seen a rise in the costs associated with complying with subject access requests (SARs) coming from their own employees.

Research published to coincide with the one year anniversary of the General Data Protection Regulation (GDPR) showed that 71% of organisations have seen a rise in their own employees making official requests for personal information held. Two-thirds of them, (67%), meanwhile, have increased their level of expenditure in attempting to fulfil them.

Since GDPR was introduced on 25 May 2018, the legal time allowed to fulfil SARs was cut from 40 days under the Data Protection Act 1998 to 30 days. This has led businesses to take a variety of measures to cope with the greater workload, which has increased as a result of growing interest from data subjects to find out what information a company has on them, according to research by law firm Squire Patton Boggs.

The majority of organisations (83%) have implemented new guidelines and procedures, while 27% have hired staff specifically to deal with the higher volume of SARs. Moreover, a fifth of firms surveyed (20%) have even adopted new software to cope.

Advertisement
Advertisement - Article continues below

"The demands placed on organisations are considerable - just the initial process of identifying all the data held in respect of an individual can take weeks out of the one-month period for responding," the report said.

"Each request requires correspondence with the individual, arranging the data platform, IT searches of data held, review of potentially thousands of documents at least twice, redaction or exclusion of information that is privileged, relates to third parties or falls under another exemption set out in the GDPR, and returning to the individual along with a cover letter.

"For the most part, this whole process must take place within one month of receipt."

Just under a quarter of all businesses responding (24%) have seen their own employees making SARs seemingly just to find out what the organisation has on record about them. In most cases, however, organisations have experienced SARs from employees because they were connected to workplace grievances.

The report concluded that given the absence of guidance from the Information Commissioner's Office (ICO) on employee SARs, it is difficult to see the issue disappearing. This is mostly because workers can see the mechanism "as a strategic tool to use where there is a workplace dispute".

Specifically, it may incentivise employers to settle workplace matters more quickly, given the cost implications of SARs. Individuals may also benefit from information that would not otherwise be available to them for several months, the law firm argued.

The ICO has itself also seen a rise in the number of complaints made over SARs not being fulfilled within the statutory 30-day limit since GDPR has come into force.

One high-profile example of this centres on Twitter's failure to comply with an academic's SAR because it was deemed to take 'disproportionate effort'

In November last year, the ICO also received complaints about seven companies including Oracle and Equifax on behalf of Privacy International based on 50 unfulfilled SARs.

Squire Patton Boggs has recommended that all businesses implement clear policies and procedures to allow them to process SARs in accordance with GDPR, and avoid the subsequent attention of the ICO.

Featured Resources

The essential guide to cloud-based backup and disaster recovery

Support business continuity by building a holistic emergency plan

Download now

Trends in modern data protection

A comprehensive view of the data protection landscape

Download now

How do vulnerabilities get into software?

90% of security incidents result from exploits against defects in software

Download now

Delivering the future of work - now

The CIO’s guide to building the unified digital workspace for today’s hybrid and multi-cloud strategies.

Download now
Advertisement

Most Popular

Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/cloud/amazon-web-services-aws/354223/what-to-expect-from-aws-reinvent-2019
Amazon Web Services (AWS)

What to expect from AWS Re:Invent 2019

29 Nov 2019
Visit/business/business-strategy/354252/huawei-takes-the-us-trade-sanctions-into-its-own-hands
Business strategy

Huawei takes the US trade sanctions into its own hands

3 Dec 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019