Last week, Kilgannon & Partners LLP had it’s first HR Forum, an opportunity for Senior HR Leaders from a variety of different organisations to get together and discuss a particular topic. This week we talked about Data Subject Access Requests (“DSARs”) which have been on the rise since the GDPR was introduced last year.
Emily Kidd, our GDPR expert, gave some practical tips about dealing with such requests, how to respond and what you need to disclose. Here are four things that you might not be aware of:
1. A DSAR can be made orally.
In practice, we imagine that this would be difficult to prove as with any other verbal request. However, data controllers should be aware that if a person telephones you or calls you into a meeting and requests their data, you should treat this as you would ordinarily treat a written DSAR.
2. IP addresses and browsing data is covered.
Personal data does not necessarily mean that the data subject is personally named. If you monitor your staff’s browsing history, this would be classed as personal data if it can be traced back to the individual (as opposed to a shared computer). In particular, you will need to be very careful about this type of monitoring where an individual works from home and uses their own device.
3. Retention periods
One of the things that you need to tell data subjects when responding to a DSAR is how long you intend to keep their data. You need to make sure that you have a suitable retention policy in place but, most importantly, that your organisation is adhering to that retention policy. It’s no good having a lovely policy tucked away in a drawer than nobody is aware of.
4. References
There is no longer any obligation for a reference given in confidence to be disclosed in response to a DSAR whether you are the giver or recipient of the reference.