ICO (UK) - First Choice Selection Services Limited

From GDPRhub
Revision as of 14:21, 15 December 2021 by FA (talk | contribs) (→‎Comment)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
ICO (UK) - First Choice Selection Services Limited
LogoUK.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law: Article 15 GDPR
Type: Complaint
Outcome: Upheld
Started:
Decided: 02.03.2021
Published: 07.09.2021
Fine: None
Parties: First Choice Selection Services Limited
National Case Number/Name: First Choice Selection Services Limited
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): English
Original Source: ICO (in EN)
Initial Contributor: Frederick Antonovics

The ICO held that a recruitment consultancy contravened Article 15 GDPR for failing to comply with the data subject's access request under Article 15 GDPR, as the company could not evidence its claim that the Employment Tribunal instructed them not to provide any documentation.

English Summary[edit | edit source]

Facts[edit | edit source]

The controller is First Choice Selection Services Limited, a recruitment consultancy ('FC').

In May 2020, the data subject made an access per Article 15 GDPR to the company, requesting:

  1. "All documents sent by [redacted] to First Choice staff;
  2. Any document sent by FC to any third party, including a list of third party agencies to whom FC have disclosed their personal data and a copy of the information FC have disclosed;
  3. Any document sent by a third party to FC;
  4. Any telephone audio file and any audio file or telephone transcription between First Choice and a third party;
  5. All meeting notes whether [they were] present or not.
  6. [Their] complete Personnel Dossier;
  7. Where there has been any event in [their] history over this period from September 2017 to May 2020 which has required manual intervention by any person, [the] disclosure of any indication or notes which have caused or resulted in that manual intervention.
  8. A Genuine copy of any notice of fair use of my data as required by the Data Protection Act 1998.
  9. Copies of all relevant First Choice company procedures and processes.
  10. Total number of shifts worked by [them] at F choice,
    1. Total amount paid to [them] for those shifts (before and after back pay).
    2. Please provide the total amount paid to [them] in holiday pay
    3. Please provide total hours of holiday pay paid to [them].
    4. Please provide the calculations used to calculate that holiday pay
    5. including rates of pay per hour and total.
    6. Please refer to the exact excerpt relevant text from Ts and Cs."

The data controller refused to comply with this access request, on the basis that they had been instructed by the Employment Tribunal "to release no information at this stage and as part of the ongoing case we will be instructed to release appropriate documents to [the Data Subject] as required for the case."

The data subject complained to the ICO.

Holding[edit | edit source]

The ICO held that First Choices unlawfully failed to comply with the data subject's access request under Article 15 GDPR, as the company could not evidence the claim that the Employment Tribunal instructed them not to provide any documentation containing the requested information as part of ongoing proceedings.

It concluded the company had either:

  1. wilfully sought to mislead the Commissioner by claiming that the Employment Tribunal had given instructions not to release the information contained in the subject access request when the Tribunal had given no such instructions; and/or
  2. Was in breach of the accountability principle under Article 5(2) GDPR because it was unaware of the extent of its data protection obligations.

Comment[edit | edit source]

This is notably the only ICO ruling on non-compliance with an access request, which seems to indicate either

1. Widespread compliance with DSARs in the UK (which may be wishful thinking)

2. A lack of enforcement of Article 15 GDPR cases by the ICO

3. A lack of publication of actions taken related to Article 15 GDPR.

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the English original. Please refer to the English original for more details.


        

    
        
            
    
        
                
                        Action we've taken/
                
                
                        Enforcement/
                
                
                        
                            First Choice Selection Services Limited
                        
                
        
    
                First Choice Selection Services Limited
            
        
    
        
        
            
                        Date
                            07 September 2021
                        Type
                            Enforcement notices
                        Sector
                            General business
            
        
    

    
        
            

        

                
            First Choice Selection Services Limited has contravened Article 15 of the EU GDPR, and Article 15 of the UK GDPR, in that it has failed to inform the Data Subject, without undue delay, whether their personal data is being processed by or on behalf of the controller and, where that is the case, has failed without undue delay to provide access, in an intelligible form, to such personal data, and to the information as set out at Article 15(1). 

        

        Further Reading
            
                
                    
                        First Choice Selection Services Limited
                            
                                    Action we've taken
                                    PDF (919.2K)
                            
                        
                    
                
        

        
    

    
    
        
            
    
        
                
                        Action we've taken/
                
                
                        Enforcement/
                
                
                        
                            First Choice Selection Services Limited
                        
                
        
    
                First Choice Selection Services Limited
            
        
    
        
        
            
                        Date
                            07 September 2021
                        Type
                            Enforcement notices
                        Sector
                            General business
            
        
    

    
        
            

        

                
            First Choice Selection Services Limited has contravened Article 15 of the EU GDPR, and Article 15 of the UK GDPR, in that it has failed to inform the Data Subject, without undue delay, whether their personal data is being processed by or on behalf of the controller and, where that is the case, has failed without undue delay to provide access, in an intelligible form, to such personal data, and to the information as set out at Article 15(1). 

        

        Further Reading
            
                
                    
                        First Choice Selection Services Limited
                            
                                    Action we've taken
                                    PDF (919.2K)
                            
                        
                    
                
        

        
    
EnglishCymraegEnglishCymraeg