ICAEW.com works better with JavaScript enabled.

Case law: Employer who did not provide information requested by employee under data protection law in disciplinary proceedings acted unfairly

Employers who fail to provide information requested under data protection law by an employee facing disciplinary proceedings can be acting unfairly, making the employee's subsequent dismissal unfair, a ruling makes clear.

Legal Alert

This update was published in Legal Alert - October 2016

Legal Alert is a monthly checklist from Atom Content Marketing highlighting new and pending laws, regulations, codes of practice and rulings that could have an impact on your business.

Data protection law gives individuals a right to ask an organisation about personal information it holds on them. The individual exercises this right by submitting a 'subject access request' (SAR) to the organisation. SARs are usually used to obtain a copy of the information, but can be used for other purposes too. An organisation can refuse a SAR on various grounds, for instance, the search required to uncover the data would be disproportionate. Alleged breaches of the SAR rules are judged and enforced by the Information Commissioner's Office.

A bank alleged an employee had breached client confidentiality and started disciplinary proceedings. The employee submitted a SAR but her employer refused to provide the data on grounds of proportionality. She submitted another SAR, limited to certain search terms. Again, her employer refused, saying it was unreasonable. Ultimately, she was dismissed for gross misconduct.

Previously, an employee's SAR submitted in these circumstances had often been judged to be an abuse of process, so that an employer's failure to provide the information requested did not make a subsequent dismissal unfair.

However, in this case the Employment Tribunal (ET) found that the employer's disciplinary process and her subsequent dismissal were unfair because the employee had been suspended during the process and did not have access to the information she needed to defend the allegations against her. The failure to provide the information requested in her SARs had therefore contributed to the unfairness of the procedure.

The ET came to this conclusion without ruling on whether the failure to provide the information requested was justified under data protection law, pointing out that this was a matter for the Information Commissioner to decide.

Operative date

  • Now


  • Employers receiving a subject access request (SAR) under data protection law from an employee facing disciplinary proceedings cannot assume the request is an abuse of process and ignore it, but may have to provide the information to avoid acting unfairly

Case ref: McWilliams v Citibank NA East London Hearing Centre, 19.4.16 (Case No.3200384/15)

Disclaimer: This article from Atom Content Marketing is for general guidance only, for businesses in the United Kingdom governed by the laws of England. Atom Content Marketing, expert contributors and ICAEW (as distributor) disclaim all liability for any errors or omissions.