Employees often use their right to make a subject access request in the context of a dispute with their employer. However frustrating this may be, failure to respond could lead to an unfair dismissal.
The recent decision of the employment tribunal in McWilliams v Citibank NA is a timely reminder to employers of the importance in carrying out an adequate investigation before making a decision to dismiss. In addition, the case demonstrates that a failure to deal with a subject access request (SAR) can render a dismissal unfair.
Ms McWilliams had worked for Citibank since August 1998 and had spent significant time on the FX trading desk. In her role as a trader, she regularly communicated with peers from other banks using the Bloomberg online chat facility. These discussions involved the disclosure of confidential information.
In June 2013, the Financial Conduct Authority (FCA) announced that it was investigating Citibank, along with a number of other financial institutions, in relation to concerns it had about the sharing of confidential data by traders in online chat rooms and the manipulation of exchange rates.
In January 2014, following an internal investigation, Ms McWilliam's line manager was dismissed for inappropriately sharing confidential client information with a trader at another bank and for being on notice that his line report, Ms McWilliams, was doing the same. She was investigated and suspended shortly after this.
She submitted a SAR in which she requested copies of all data related to her stored and collected by 25 named individuals (a number of whom were in her direct management chain). The bank refused to respond to this request saying it was disproportionate. Despite Ms McWilliams providing narrowed search criteria and making clear that the response was vital to her ability to respond to the disciplinary allegations, the bank reiterated its refusal to process her request. She complained to the Information Commissioner.
A disciplinary hearing was held in May 2014 and Ms McWilliams was ultimately dismissed.
During the course of the disciplinary process she argued that her conduct was consistent with usual practice within the bank and that management had demonstrated a lax attitude to compliance. She asked for her disciplinary to be postponed until after the FCA investigation was complete, but this was refused. Limited investigation was carried out prior to the decision being made to dismiss her and although the decision was made in September 2014, this was not communicated to her until November 2014. She appealed her dismissal but this was rejected.
Around the same time the FCA published its investigation findings which confirmed that the bank had failed to exercise sufficient control over its foreign exchange business and that its guidance on chat rooms did not explain in sufficient detail the types of communications it considered unacceptable.
Employment tribunal claim
Ms McWilliams successfully brought claims of unfair and wrongful dismissal against the bank. The tribunal held that the bank had failed to carry out a reasonable investigation in particular, by failing to enquire as to the suggestion that sharing confidential information was general practice among traders and senior managers in chat rooms. The FCA's report supported Ms McWilliams case in this regard.
As regards the bank's handling of the SAR, the tribunal found that given her suspension and the bank's refusal, she was reliant on the sufficiency of their internal investigation (which was inadequate). It considered the bank's conduct in relation to the subject access request unfair as it materially affected her ability to defend herself in relation to the disciplinary allegations.
The tribunal commented that whilst employee requests for information in disciplinary proceedings may sometimes be 'little more than a fishing exercise' this was not the case here.
The tribunal did accept that Ms McWilliams had contributed to her dismissal even though it was deemed to be unfair and this issue will be dealt with at a forthcoming remedies hearing. It also confirmed that it was for the ICO to adjudicate in relation to the non-compliance with the SAR itself.
What this means for employers
This case is only a first instance decision but, it underlines the importance of carrying out adequate disciplinary investigations.
While it is not necessary for an employer to investigate every single point made by an employee in their defence, it should give careful consideration to the context in which an individual is acting and the instructions they are subject to by management. This was Ms McWilliams' primary defence, which she was precluded from advancing due to her suspension and the refusal of the bank to respond to her SAR.
In relation to the bank's non-compliance with the SAR, the tribunal took the view that this should have been responded to despite the fact its purpose was to obtain information as part of the disciplinary proceedings.
In the previous case of Dawson-Damer and others v Taylor Wessing LLP and others  EWHC 2366 (Ch), the High Court refused to enforce a SAR made in the context of on-going litigation. The Court commented that the purpose of the SAR provisions was not to enable a data subject to obtain discovery of documents that may assist them in litigation. Despite this authority, the Courts have a discretion on this point so employers should be wary of rejecting an SAR out of hand simply because there is relevant on-going or potential litigation.
While data controllers are not required to provide copies of data if it would involve disproportionate effort (section 8(2) Data Protection Act 1998) employers should exercise caution before rejecting an SAR without taking specific legal advice, given the potential ramifications of doing so as highlighted by this case.