I have an employee who has received some formal complaints. HR have let the employee know that formal complaints have been made & the employee has requested copies of the complaints (not through a subject access request – just to the complaints team). These have been forwarded to me (DPO) for redaction.
I get a little bit confused regarding this so please forgive me if this is has a simple answer but are we required to redact and hand these complaints over or can I deny the request?
Simon
If you’re not treating this as a SAR, and the organisation is taking the employee through a disciplinary process, paragraph 9 of the ACAS CoP (https://www.acas.org.uk/acas-code-of-practice-for-disciplinary-and-grievance-procedures/html) has some guidance for what information should be included for these purposes. You need to provide sufficient information ‘to enable the employee to prepare to answer the case’. I’ve worked with HR Teams in the past to critique and ask ‘is it necessary’ to disclose x, y, and z. There may be circumstances where it is necessary to disclose personal data about the complainant.
The ICO also has helpful advice on dealing with SARs for info held in complaint folders – https://ico.org.uk/media/1179/access_to_information_held_in_complaint_files.pdf
Chris Roberts
I agree totally with Hellen. I would add that (from my experience) maintaining a good relationship with the complainant, whether or not its formal DSAR or not, can help ensure the request is concluded in the best way possible for all. Issues not managed well at the personal level often grow in nature and become more confrontational than they need to be.
HellenB
This is where I would work in concert with a senior HR manager/director and not attempt to do this in isolation. My reasoning is that from a DPO perspective I would consider the request in a purely binary manner: what data is being revealed, what can be redacted that will hide the identity of the complainant (which is more than just their details) and what constitutes personal data whereas HR would add in the nuance of employment law.
You should consider that the complaint is the personal data of the complainant since it reveals more about them than the person being complained about. Therefore you need their permission to share the complaint and the format you are sharing it including redactions.