Case study: A public healthcare
organisation


Under UK data protection laws, individuals have the right to request access to information that is about or relates to them (personal data). In the context of an ongoing employment dispute, our client received subject access requests from multiple employees relating to complex grievance and disciplinary investigation reports prepared by the client and external investigators on the client’s behalf.

Each report comprised the personal data of multiple individuals and was based on a large quantity of underlying documentation, including meeting recordings, material stated to have been provided in confidence (or in relation to which assurances of confidentiality had been provided), and emails. Much of the content was sensitive, either from a legal or practical perspective.

How we helped

The client required substantial assistance to understand its obligations, review the materials, and ensure that its disclosure was limited to what was legal and appropriate in all the circumstances. Drawing upon our expertise, we:

  • Advised the client on the complexities around pseudonymised and anonymised data, and explained the risks for both employees and for the client if data was erroneously disclosed.
  • Explained and explored with the client the exemptions to disclosure that could be applied to different categories of data in this case.
  • Conducted a thorough examination of the reports and underlying materials, to identify excludable content.
  • Provided tactical advice as to how and in what format potentially damaging data should be disclosed.
  • Supported our client in its compliance with applicable statutory deadlines and procedures.
Our experience

Outcomes

Substantive disclosure in response to the requests was made appropriately, within the applicable deadlines. The client was confident that it had protected the rights of all individuals concerned, and was able to respond positively and constructively to regulatory queries and individual complaints regarding its approach. The client was able to counter allegations that it had not complied with some individual’s data rights, and the individuals ultimately accepted the disclosure made was appropriate.

Data protection hub

View the hub now to explore additional legal resources.
Go to the hub

Stay informed

Our latest articles, events and webinars on data protection law.
Read more