Search

How can we help?

Icon

DSAR: Do I need to provide names if requested?

Under the General Data Protection Regulation (GDPR), in both the EU and UK versions, employees have the right to request access to their personal data from their employer called a Data Subject Access Request (DSAR).

The employee is entitled to be given a copy of their personal data together with certain information which includes information as to ‘the recipients or categories of recipients to whom data has been or will be disclosed’.

Many employers when responding to such requests prefer to provide the ‘categories of recipients’ rather than specific names and, as such, may refer to groups such as ‘business contacts’ or ‘HR’.

However, this point has come up recently in the EU case of RW v. Osterreichische Post (OP)

The facts on this DSAR case

The data subject in this case made a data access request to OP. The company OP had provided general descriptions of the recipients of the data (e.g. “business customers for marketing purposes”) but the data subject did not believe this was good enough and asked OP to specifically identify the third parties that his personal data had been shared with.

The Advocate General’s opinion

The Advocate General usually gives an opinion prior to the European Court of Justice handing down its own judgment. The Judgment does typically follow the opinion but it does not have to.

In the Advocate General’s opinion, the EU GDPR requires an employer to provide information as to the specific recipients, if it is requested to do so by the employee. It recognised that the EU GDPR allows a choice between categories or specific recipients but said that this choice was for the employee to make, not the employer.

Louise Keenan

Associate

View profile

+44 118 960 4614

Many employers when responding to such requests prefer to provide the ‘categories of recipients’ rather than specific names and, as such, may refer to groups such as ‘business contacts’ or ‘HR’.

What this means for the UK GDPR?

Firstly, this is an opinion by the Advocate General and may not be followed by the European Court of Justice at all. Secondly, this is an EU case involving interpretation of EU law (the EU GDPR) and is not, therefore, binding on the UK. However, as the UK GDPR uses the same wording it is arguable that this case could have some impact on the way the UK GDPR is interpreted.

It is unclear how specific the requirement is in this specific case, but it could be argued from this case that if an employee requests the names of those in HR who have seen his data, rather than just accepting a ‘HR’ categorisation, then an employer may need to provide it. This makes compliance with such requests even more onerous for organisations.

It will be interesting to see how this point plays out in the UK, particularly given the government’s recent consultation on data protection (including access requests) which is aimed, in part, at reducing the burdens on organisations. For further support with your data subject access requests contact our employment solicitors.

About this article

Disclaimer
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.

Louise Keenan

Associate

View profile

+44 118 960 4614

About this article

Read, listen and watch our latest insights

Pub
  • 22 September 2023
  • Employment

Talking Employment Law: New family friendly rights

In this first podcast in the ‘Talking Employment Law’ series, Lucy Densham Brown and Rebecca Dowle, members of the employment team summarise some of the big new family-friendly Bills that are working their way through parliament.

art
  • 20 September 2023
  • Commercial Real Estate

Commercial buyers beware of residential Stamp Duty Land Tax

This article discusses a recent case in which a property buyer calculated the Stamp Duty Land Tax due on the purchase at a lower rate, due to the mixed-use purpose of the property.

art
  • 19 September 2023
  • Privacy and Data Protection

Organisations’ use of social media: Data protection

Social media applications (or commonly known as ‘apps’) are being developed all the time and we are constantly being introduced to new social media platforms, some of which take almost no time to gain huge popularity.

art
  • 14 September 2023
  • Immigration

Entrepreneurial Dreams: What is the Innovator Founder Visa?

In an era defined by innovation and entrepreneurship, the United Kingdom has made a substantial effort towards fostering its reputation as a global hub for start-ups and innovators. The introduction of the UK’s ‘Innovator Founder’ route has marked a pivotal moment in the country’s immigration policy.

art
  • 11 September 2023
  • Corporate and M&A

Changes to the tax treatment of Employee Ownership Trusts

The government published a consultation on 18 July 2023 seeking the public’s views on its proposals to reform the tax treatment of Employee Ownership Trusts and Employee Benefit Trusts. Parties are invited to express their opinions via email via the government website until the consultation closes on 25 September 2023.

art
  • 08 September 2023
  • Immigration

Navigating the Latest Immigration Rules for Overstayers in the UK: A Comprehensive Guide for 2023

Staying beyond the expiration of your UK visa is a serious matter that, in most cases, can result in significant and long-lasting repercussions.