EMPLOYERS could face increased administration costs and a mountain of paperwork to bring their files on employees into line with new rules on data protection.
The Data Protection Bill, due to come into force later this year, will give employees greater access to data stored on them at work and extends protection to cover paper files as well as computerised data. Companies, and in particular human resources departments, need to act now to ensure records comply with the more stringent requirements.
Under the Data Protection Act 1984, any organisation which holds computerised personal data relating to individuals must apply for registration with the Data Protection Registrar. Personal data includes not only factual information but also expressions of opinion, for example on an employee's abilities.
The new Bill will increase the rights of individuals to gain access to such information. Employers and other organisations must obtain consent from employees and individuals to process any personal data. Some exceptions to this will exist, but as yet the final details of the Bill are unclear. It may be that consent will not be required for the holding of employee or personnel files.
The new Bill also introduces a new category of data called ''sensitive personal data''. This includes information relating to racial or ethnic origin, political opinion, religious or other beliefs, trade union membership, physical or mental health or condition, sexuality and details of any criminal offence. Anyone holding details of this kind will be required to obtain the individual's consent to the holding or use of that information. While there may be some means of avoiding this consent once the Bill comes into force, employers would be well advised to consider how they are to go about gaining employees' consent.
Employers and human resources managers will need to review the information they hold on employees to see whether any of it comes under this category. If so, they will need to be able to show the express consent of employees to hold or process this information has been obtained.
The new rules extend the data protection regime from computerised records to include manual records, until now exempt from legislation. This could have major implications as many personnel records are kept in paper form rather than on computer.
After the Bill is enacted all records collected will be subject to the same data protection principles as computerised data. However, it looks likely that a period of 12 years will be allowed before all manual files have to be brought into line.
It is an enormous task and employers will have to start considering the potential effects the new legislation may have. They will need to look at the information they hold on employees and the way it is held. Particular care will need to be taken in drafting application forms and the type of information requested. It is crucial they ensure that the information gathered does not fall under the sensitive personal data category. If it does, the express consent of each applicant to hold and process that information will need to be obtained.
With employees set to have greater access to personnel files, employers must ensure that records are complete, accurate and up-to-date and contain only information they are happy for employees to see.
This could be important if files contain information on career development or any other matter which the employer would not wish to disclose to individual employees.
Employers face a heavy administrative burden. It is essential to start to address the problem now in order to ensure records are in line with the new requirements and appropriate consent has been obtained by the time the Bill comes into force.
q Sunila Jandial is a solicitor specialising in employment law with Shepherd & Wedderburn.
Why are you making commenting on The Herald only available to subscribers?
It should have been a safe space for informed debate, somewhere for readers to discuss issues around the biggest stories of the day, but all too often the below the line comments on most websites have become bogged down by off-topic discussions and abuse.
heraldscotland.com is tackling this problem by allowing only subscribers to comment.
We are doing this to improve the experience for our loyal readers and we believe it will reduce the ability of trolls and troublemakers, who occasionally find their way onto our site, to abuse our journalists and readers. We also hope it will help the comments section fulfil its promise as a part of Scotland's conversation with itself.
We are lucky at The Herald. We are read by an informed, educated readership who can add their knowledge and insights to our stories.
That is invaluable.
We are making the subscriber-only change to support our valued readers, who tell us they don't want the site cluttered up with irrelevant comments, untruths and abuse.
In the past, the journalist’s job was to collect and distribute information to the audience. Technology means that readers can shape a discussion. We look forward to hearing from you on heraldscotland.com
Comments & Moderation
Readers’ comments: You are personally liable for the content of any comments you upload to this website, so please act responsibly. We do not pre-moderate or monitor readers’ comments appearing on our websites, but we do post-moderate in response to complaints we receive or otherwise when a potential problem comes to our attention. You can make a complaint by using the ‘report this post’ link . We may then apply our discretion under the user terms to amend or delete comments.
Post moderation is undertaken full-time 9am-6pm on weekdays, and on a part-time basis outwith those hours.
Read the rules hereComments are closed on this article