Right of access: how should this right be interpreted?
To date, the Belgian Data Protection Authority (DPA) has not issued guidelines on the exercise of the right of access to personal data. In a recent decision, the DPA provided further clarification, confirming that the right of access is not absolute and that the rights and freedoms of other employees must (also) be taken into account.
The facts
Following an incident with a volunteer, an employee working for an organisation active in social welfare received a warning letter. Several months later, a meeting took place between the employee on the one hand and the general director and HR director on the other.
After this meeting, the employee requested access to her personnel file. Believing that her file was incomplete, she filed a complaint with the DPA. The DPA ruled that the employer had to respect the right of access and provide the employee with access to her personnel file, including her evaluations. After this decision, the employee indicated that she preferred to receive a copy rather than (only) on-site access.
After receiving the copy, the employee noticed that, among others, (1) the minutes of the evaluation meeting and (2) the report with complaints from colleagues about her behaviour were missing. She again requested a copy of these documents.
The employer refused this request. After the employment relationship ended due to retirement, the employee
claimed that the (former) employer had not sufficiently complied with her access request and filed another complaint with the DPA.
Decision of the DPA’s Litigation Chamber
In its decision, the DPA clarified how an employer must handle a request for access and/or a copy of personal data without infringing the rights and freedoms of others. The DPA had previously emphasised that such a balancing exercise can never result in withholding all information from the employee concerned. In the first place the employer must examine whether the rights of others can be sufficiently safeguarded by anonymising their personal data in the response.
- Right of access to notes in the personnel file
The employee requested access to the notes from the evaluation meeting, which the general director and HR director allegedly made. The employer acknowledged that the meeting took place several months after the warning letter but argued that the directors’ personal notes were not part of the personnel file and did not constitute formal evaluation documents.
According to the DPA, notes created in a professional context by a representative of the employer, and which may affect the professional evaluation of the employee, must indeed be considered personal data.
Although the employer must ensure that the right of access does not infringe the rights and freedoms of others, the DPA found that in this case no valid reason was provided for withholding the notes. To meet the purpose of the right of access, the employer should have justified why the notes could not be disclosed. By failing to do so, the employer violated the right of access.
- Right of access to complaints from colleagues
Moreover, the employee requested access to a report containing bundled complaints from colleagues describing conflicts with her. The DPA agreed that complaints from (former) colleagues do not necessarily have to be disclosed in full in response to an access request, as the employer must take into account the rights and freedoms of others.
The DPA considered that the colleagues had provided their statements with an expectation of confidentiality. It also noted that there may be exceptional circumstances where statements from colleagues could have significant consequences for the employee, in particular where the employee risks being prejudiced because he or she is unable to take note of the statements and to respond to them.
In this case, the consequences for the employee were limited, as no formal dismissal proceedings had taken place. The DPA stressed that specialised external prevention services can play a legitimate and proportionate filtering role in such situations.
Although restrictions on the right of access must be interpreted narrowly, the DPA concluded – considering the concrete circumstances – that no violation could be established.
Sanction
Since the employer did not provide access to the notes of the general director and HR director, the DPA imposed a reprimand. It also decided to publish the identity of the employer given its significant public funding.
Key message
To date, the DPA has not issued guidelines on the right of access. More and more (former) employees are requesting access and/or copies of their personal data. This decision provides clarifications on how an access request may be restricted based on the rights and freedoms of other employees.
Where complying with an access request risks infringing the rights and freedoms of others, the employer is advised to – in first instance – anonymise third-party personal data. However, the DPA confirmed that the right of access may be restricted in some cases, for example when colleagues have confidentially reported concerns about an employee’s behaviour. An alternative approach could be to paraphrase the complaints to protect the identity of colleagues.