Protection of your Personal Data

Pavel is bringing an equality claim through his union against his employer on the grounds that he is not getting the same terms and conditions of employment as his Irish colleagues. Pavel and his union representative are building a case but they would like to have access to his employment file which is in the possession of the employer. What are Pavel’s rights on access to his personal data and how does the Data Protection Act of 1988 and 2003 assist him?

What is personal data?

Personal data is any information that relates to an identifiable, living individual. It includes any data held in paper files, on computer, on CCTV records or even on sound files.

What is data protection and how does Pavel access his data held on file?

The company have a duty to keep the personal details of Pavel private and safe. This is what is meant by  2data protection2 under the legislation under Section 4 of the Acts. He has  a right to obtain a copy, clearly explained, of any information relating to him on file by the company. He   needs to write to the company and ask for it under the Data Protection Acts. His Union representative will assist with this.
A sample request letter from the Data protection Commissioner’s site at www.dataprotection.ie/docs/Making-an-Access-Request reads:

Dear ...
I wish to make an access request under Section 4 of the Data Protection Acts 1988 and 2003 for a copy of any information you keep about me, on computer or in manual form in relation to.... (Pavel should send   in as much information as possible to assist the company to locate the data that he is  interested in accessing e.g.  staff number, or location, grade etc.

Pavel may be may be asked to pay a fee by the company for supplying copies of the data, but this cannot exceed €6.35.

Once he has has made his request, and paid any appropriate fee, he must be given the information within 40 days.

Can a company lawfully withhold certain information?

Yes, in certain circumstances. For example, a company can claim legal privilege and withhold a communication between lawyers and the company on legal advice that might be given in defending the Equality claim. Also a request for  access to information on Pavel’s colleagues may be restricted.

He can ask  the company  to inform him of any opinions on him  given by individuals and recorded on file  unless the company  considers that the opinions are confidential. The nature of the extent of confidentiality can be investigated subsequently by the Data Protection Commissioner.

What if the company refuses to respond to Pavel’s access request?

If the company does not comply with a valid access request from Pavel, then it it is open to him  to make a complaint to the Data Protection Commissioner. Before doing so the Data Protection Commissioner would recommend to him   that he would contact the company to establish the circumstances and to indicate his intention to complain to the Commissioner. If there is no response, or maybe an unsatisfactory response, the Commissioner will investigate the matter with the view to ensuring his rights are upheld. The Commissioner does not have the power to award compensation but can give a declaration that rights were breached.

How does Pavel make a complaint to the Data Protection Commissioner?

Pavel, assisted by his union representative if necessary, should send an email or formal letter to the Data Protection Commissioner. The communication should include the following

• name the company he is complaining about;

• describe the steps taken to have his concerns dealt with;

• give details of any response which he may  have received; and

• provide copies of any letters or emails exchanged between him and the company.

The Commissioner will investigate Pavel’s complaint and seek to find a resolution to the matter. If  efforts at resolution fail, and the Commissioner agrees with his complaint, he will try to make sure that the company complies with the law by sending out the requested data. The Data Protection Commissioner can be contacted at:

The Office of the Data Protection Commissioner
Canal House
Station Road
Portarlington
Co. Laois.

LoCall: 1890 252 231
Tel: 057 868 4800
Fax: 057 868 4757
Email: info@dataprotection.ie
Website: www.dataprotection.ie