ICO (UK) - First Choice Selection Services Limited
| ICO (UK) - First Choice Selection Services Limited | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 02.03.2021 |
| Published: | 07.09.2021 |
| Fine: | None |
| Parties: | First Choice Selection Services Limited |
| National Case Number/Name: | First Choice Selection Services Limited |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | Frederick Antonovics |
The ICO held that a recruitment consultancy contravened Article 15 GDPR for failing to comply with the data subject's access request under Article 15 GDPR, as the company could not evidence its claim that the Employment Tribunal instructed them not to provide any documentation.
English Summary
Facts
The controller is First Choice Selection Services Limited, a recruitment consultancy ('FC').
In May 2020, the data subject made an access per Article 15 GDPR to the company, requesting:
- "All documents sent by [redacted] to First Choice staff;
- Any document sent by FC to any third party, including a list of third party agencies to whom FC have disclosed their personal data and a copy of the information FC have disclosed;
- Any document sent by a third party to FC;
- Any telephone audio file and any audio file or telephone transcription between First Choice and a third party;
- All meeting notes whether [they were] present or not.
- [Their] complete Personnel Dossier;
- Where there has been any event in [their] history over this period from September 2017 to May 2020 which has required manual intervention by any person, [the] disclosure of any indication or notes which have caused or resulted in that manual intervention.
- A Genuine copy of any notice of fair use of my data as required by the Data Protection Act 1998.
- Copies of all relevant First Choice company procedures and processes.
- Total number of shifts worked by [them] at F choice,
- Total amount paid to [them] for those shifts (before and after back pay).
- Please provide the total amount paid to [them] in holiday pay
- Please provide total hours of holiday pay paid to [them].
- Please provide the calculations used to calculate that holiday pay
- including rates of pay per hour and total.
- Please refer to the exact excerpt relevant text from Ts and Cs."
The data controller refused to comply with this access request, on the basis that they had been instructed by the Employment Tribunal "to release no information at this stage and as part of the ongoing case we will be instructed to release appropriate documents to [the Data Subject] as required for the case."
The data subject complained to the ICO.
Holding
The ICO held that First Choices unlawfully failed to comply with the data subject's access request under Article 15 GDPR, as the company could not evidence the claim that the Employment Tribunal instructed them not to provide any documentation containing the requested information as part of ongoing proceedings.
It concluded the company had either:
- wilfully sought to mislead the Commissioner by claiming that the Employment Tribunal had given instructions not to release the information contained in the subject access request when the Tribunal had given no such instructions; and/or
- Was in breach of the accountability principle under Article 5(2) GDPR because it was unaware of the extent of its data protection obligations.
Comment
This is notably the only ICO ruling on non-compliance with an access request, which seems to indicate either
1. Widespread compliance with DSARs in the UK (which may be wishful thinking)
2. A lack of enforcement of Article 15 GDPR cases by the ICO
3. A lack of publication of actions taken related to Article 15 GDPR.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
Action we've taken/
Enforcement/
First Choice Selection Services Limited
First Choice Selection Services Limited
Date
07 September 2021
Type
Enforcement notices
Sector
General business
First Choice Selection Services Limited has contravened Article 15 of the EU GDPR, and Article 15 of the UK GDPR, in that it has failed to inform the Data Subject, without undue delay, whether their personal data is being processed by or on behalf of the controller and, where that is the case, has failed without undue delay to provide access, in an intelligible form, to such personal data, and to the information as set out at Article 15(1).
Further Reading
First Choice Selection Services Limited
Action we've taken
PDF (919.2K)
Action we've taken/
Enforcement/
First Choice Selection Services Limited
First Choice Selection Services Limited
Date
07 September 2021
Type
Enforcement notices
Sector
General business
First Choice Selection Services Limited has contravened Article 15 of the EU GDPR, and Article 15 of the UK GDPR, in that it has failed to inform the Data Subject, without undue delay, whether their personal data is being processed by or on behalf of the controller and, where that is the case, has failed without undue delay to provide access, in an intelligible form, to such personal data, and to the information as set out at Article 15(1).
Further Reading
First Choice Selection Services Limited
Action we've taken
PDF (919.2K)
EnglishCymraegEnglishCymraeg
