Request Denied

[jakejb79]

At a company I am currently working at two people have requested to see their HR file, one because of lack of training opportunities and one because of a current illness.

They both made subject access requests under GDPR but both deadlines were missed, I'm just wondering if this is just lazy management or does it point to something they want to hide.

 

[Pickman's model]

Or both

 

[Argonia]

Are you really 7 years old, jakejb?

 

[FridgeMagnet]

At a company I am currently working at two people have requested to see their HR file, one because of lack of training opportunities and one because of a current illness.

They both made subject access requests under GDPR but both deadlines were missed, I'm just wondering if this is just lazy management or does it point to something they want to hide.

I wouldn't get too hung up on the exact "why" - often incompetence covers up for deliberate secrecy anyway. If they've missed the deadline that's all that's important. It means they have not fulfilled their legal requirements under GDPR.

 

[Teaboy]

At a company I am currently working at two people have requested to see their HR file, one because of lack of training opportunities and one because of a current illness.

They both made subject access requests under GDPR but both deadlines were missed, I'm just wondering if this is just lazy management or does it point to something they want to hide.

How big is the company? How professional are they? What is HR like?

I'm pretty sure my company would be unable to produce a HR file on anyone because they wouldn't know what one looks like.

 

[alex_]

I wouldn't get too hung up on the exact "why" - often incompetence covers up for deliberate secrecy anyway. If they've missed the deadline that's all that's important. It means they have not fulfilled their legal requirements under GDPR.

Id write back point out they’ve missed their 30 days, ask if they intend to fulfil this request or even to reply.

ie ask if they want a bit more time or if you should go to the ICO ?

All that’s going to happen in the first instance is the ico is going to send them a letter reminding them of their obligations, so you might as well give them a second change so you can tell the ico you’ve done this.

Alex

 

[equationgirl]

they may not have realised that the GDPR changed some deadlines and tightened them up , being charitable. Or they may just be crap. Or both. But my money is on them not being aware of their legal obligations.

If there is an information security team, speak to them, they would want to know this.

 

[farmerbarleymow]

Id write back point out they’ve missed their 30 days, ask if they intend to fulfil this request or even to reply.

ie ask if they want a bit more time or if you should go to the ICO ?

All that’s going to happen in the first instance is the ico is going to send them a letter reminding them of their obligations, so you might as well give them a second change so you can tell the ico you’ve done this.

Alex

Good advice. The ICO will normally expect people to go through the internal process within the organisation before raising it with them. So in this case a reminder would be appropriate, and it is reasonable to say that they expect a response within x days or they'll report the matter to the ICO.

The ICO keep tabs on data controllers that have a history of being shit at compliance, so if this organisation is one of them they'll get more heavy if your colleagues complain.

 

[jakejb79]

Are you really 7 years old, jakejb?

No, I entered my date of birth wrong, I only Changed the date and year.

 

[jakejb79]

How big is the company? How professional are they? What is HR like?

I'm pretty sure my company would be unable to produce a HR file on anyone because they wouldn't know what one looks like.

They company is in London and the South East but with about 50 employees, apparently that when GDPR law came in the the HR manager deleted all staff records before that date..... Someone had to point out to him that probably wasn't the best idea.

 

[jakejb79]

How big is the company? How professional are they? What is HR like?

I'm pretty sure my company would be unable to produce a HR file on anyone because they wouldn't know what one looks like.

All HR files are kept in a locked cupboard in the directors office, so it's just the turn of three keys (maybe they've lost them all)

 

[equationgirl]

They company is in London and the South East but with about 50 employees, apparently that when GDPR law came in the the HR manager deleted all staff records before that date..... Someone had to point out to him that probably wasn't the best idea.

Now that's not encouraging. I hope the records were reinstated, because having no records will look very off for a business with 50 employees.

 

[equationgirl]

Dp

 

[BigTom]

Now that's not encouraging. I hope the records were reinstated, because having no records will look very off for a business with 50 employees.

HMRC will want pay and tax records kept for 7 years at the very least. No idea what company law says about retention of other records but I would guess that they would be required to keep some records of employees for 7 years as well. Potentially very illegal.

 

[equationgirl]

HMRC will want pay and tax records kept for 7 years at the very least. No idea what company law says about retention of other records but I would guess that they would be required to keep some records of employees for 7 years as well. Potentially very illegal.

The GDPR act does specify some limits. For example, if someone applies for a vacancy but is unsuccessful, there's a limit to how long you can keep that record for. All a general deletion would do is highlight that the company is ignorant and might be in breach elsewhere.

 

[BigTom]

The GDPR act does specify some limits. For example, if someone applies for a vacancy but is unsuccessful, there's a limit to how long you can keep that record for. All a general deletion would do is highlight that the company is ignorant and might be in breach elsewhere.

but if the deletion included deleted worked hours/wages/tax records then this would breach HMRC rules about retaining financial records for 7 years.

 

[equationgirl]

but if the deletion included deleted worked hours/wages/tax records then this would breach HMRC rules about retaining financial records for 7 years.

Indeed. So before anything was deleted there should have been a plan made identifying what the had, what needed to be kept and what didn't. It's recognised that different records need to be treated differently within the Act, and that other regulations might trump the GDPR, in effect, like the tax ones.