Furloughed employees may seek to understand the reasons why they have been selected for furloughing by making a request to their employer to be provided with their personal information.
Below are our five top tips for managing data subject access requests (DSARs) from furloughed employees include:
- Track – keep a log of the DSARs which you receive and the deadlines for responding to them. DSARs can made either verbally or in writing and you normally have to respond within one month. However, in light of Covid-19, extensions to this deadline may be appropriate.
- Triage – assess whether any of the DSARs are being made for the purposes of assisting the employee to bring a claim against the company or if are you aware of any potentially embarrassing material. Build time into your response schedule so as to allow for communications lines or briefings of stakeholders to take place prior to disclosure.
- Data extraction – personal data of the applicant may be held in a number of different locations within the business ranging from email accounts, to hard copy personnel files and bespoke customer relationship management (CRM) software. Depending on the scope of the request, each of these locations may need to be reviewed for personal data. Understanding these sources and testing how the extracts run could be done in advance of receiving DSARs.
- Extensions of time – either due to the volume of DSARs or working from home, problems with accessing and reviewing these documents may require an extension of time for responding to the DSAR or an explanation provided to the applicant as to why some documents have not been reviewed. Identifying these data sources and building proposals on the continued access to these documents (if possible) will allow you to respond to the applicant with a realistic time frame or explain the reasons why personal data cannot be provided. Producing template COVID-19 extension letters may assist with this process.
- Redactions – consideration and preparations can be made now to ensure you have a process for removing third party personal/privileged data from the documents to be provided to the applicant. If redactions are normally done on hard-copy documents then a different approach may need to be adopted. Similarly, redactions done on laptops may take longer to apply,
WBD utilises an e-DSAR platform which allows for documents to be reviewed quickly and in a cost effective manner which seeks to assist with the above challenges. To discuss how WBD can help support your business on DSARs, please get in touch.