What employers should know about the new General Data Protection Regulation

[et_pb_section admin_label=”Section” global_module=”136″ fullwidth=”on” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off”][et_pb_fullwidth_code global_parent=”136″ admin_label=”Post Header”][Page_Header_Start] Employment Law News[Page_Header_End][/et_pb_fullwidth_code][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][et_pb_column type=”3_4″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” use_border_color=”off” border_color=”#ffffff” border_style=”solid”]

What employers should know about the new General Data Protection Regulation

[post_details]

[Social-Share]

The Government has confirmed that the UK will implement the General Data Protection Regulation in May 2018. Though amendments may be made once the UK leaves the EU, employers should start making preparations now.

Whilst the UK voted to leave Europe in the 2016 referendum, on the Government’s timetable the UK will still be in the EU when the GDPR comes into force on 25 May 2018. The penalties for non-compliance can be very serious; data controllers could be fined up to €20 million or 4% of annual worldwide turnover. Therefore, there is good reason for employers to plan ahead.

Giving notice

As the Information Commissioner recognised, the GDPR gives “people greater control of their data”.

Specifically, employers need to be more transparent about how they use personal data and give employees more information about their processes. Included within that is a requirement that employers must give fuller ‘fair processing notices’.

The notices need to say in clear and concise language: (i) who the data controller and Data Protection Officer are and how to contact them; (ii) why personal data is being processed; (iii) what legitimate interest there is in processing personal data; (iv) who will receive the personal data; and (v) if the data will be transferred outside of the EEA (and if so, where).

At the point where an employer collects personal data from an employee or job applicant, another notice needs to be given to make clear: (i) how long the data will be retained for; (ii) the right to have their data deleted or modified; (iii) the right to withdraw consent to the data being processed; (iv) the right to complain to the Information Commissioner; (v) the consequences of the employee or applicant not giving the data (i.e. if there is a contractual or statutory requirement for them to do so); and (vi) if the data will be used for automated decision-making.

Employers have an obligation to ensure that their employees are aware of these details, so the best approach would be to have a separate document (i.e. not a section squirreled away in a handbook) which you ask the employee or candidate to read.

Getting consent

Having an employee or applicant’s consent is one way to process their data lawfully. However, consent under the GDPR needs to be “freely given, specific, informed and unambiguous”. That means that pre-ticked tick boxes or opt outs will not suffice.

Rather than including a term in employment contracts, employers should provide all the relevant information about data processing in a separate consent form for employees to sign up to. This places less pressure on new and existing employees and lends itself to the argument that consent was freely given.

However, there are murmurs in the EU as to whether consent can ever be freely given in an employment relationship given that employees have less bargaining power than their employers. That being so, it is worth ensuring that one of the other reasons for processing data is present. They are where processing is necessary for:

  • performance of a contract;
  • compliance with legal obligations;
  • protection of the data subject’s interests;
  • tasks in the public interest; or
  • the data controller’s legitimate interests.

In addition to writing to the employee with information about data processing, employers should have a clear policy on data protection. Employers also need to ensure that it is accessible to all staff and that they are aware of it.

Data systems

Data subjects will have the right to ask employers to delete or modify personal data held about them. Therefore, it is important that employers’ IT systems are capable of managing data easily and efficiently. It should be possible to delete data from them permanently and to place restrictions on who can access it.

Employers will also need to know how long data is stored under their system before it is automatically deleted (assuming that it is).

Data security breaches will be treated severely, so employers should ensure that data held is encrypted and kept securely. There should also be a mechanism for employers to be alerted when a breach has taken place, as there is a 72-hour deadline in which to notify the Information Commissioner.

Most employers will be familiar with the rules on data subject access requests as they stand, but the GDPR will bring changes. The deadline for response to a DSAR will be cut down to one month rather than the previous 40-day timeframe (though it can be extended to two months when necessary, employers should always aim for the shorter deadline to be on the safe side). The requirement for a fee to be paid will also be removed.

In order to ensure compliance, employers should check that their systems will permit them to complete a search within the month’s deadline; in larger companies, it may speed the process along to appoint someone specific to deal with DSARs as and when they come in.

Fundamentally, May 2018 is not as far away as it seems, particularly where changes to IT systems or HR procedures are required.

Employers should therefore start to review their systems and schedule any changes which may be necessary.

Even if Brexit happens, Parliament is unlikely to make meaningful changes to data protection laws. To do so would impede trade by conflicting with the EU’s strict rules about transferring data to countries without adequate protection.

[/et_pb_text][/et_pb_column][et_pb_column type=”1_4″][et_pb_sidebar admin_label=”Sidebar” orientation=”right” area=”sidebar-1″ background_layout=”light” remove_border=”off”] [/et_pb_sidebar][/et_pb_column][/et_pb_row][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][/et_pb_row][/et_pb_section]


Data subject access requests and third party information

[et_pb_section admin_label=”Section” global_module=”136″ fullwidth=”on” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off”][et_pb_fullwidth_code global_parent=”136″ admin_label=”Post Header”][Page_Header_Start] Employment Law News[Page_Header_End][/et_pb_fullwidth_code][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][et_pb_column type=”3_4″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” use_border_color=”off” border_color=”#ffffff” border_style=”solid”]

Data subject access requests and third party information

[post_details]

[Social-Share]

Documents containing the personal information of more than one person should not automatically be disclosed on submission of a subject access request. A balancing exercise must be done to determine whether disclosure is appropriate in the circumstances.

P was diagnosed with bladder cancer in 2013 and alleged to the General Medical Council that the incompetence of his general practitioner, DB, delayed the diagnosis by a year. The GMC obtained an expert report into DB’s work as part of the investigation into P’s complaint. The GMC sent a one-page summary of the report to P, after which P put in a data subject access request for the full version. DB refused to consent to disclosure of the full report, though the GMC was minded to disclose it to P in keeping with the transparency of the investigation process. DB brought proceedings against the GMC to prevent that from happening.

The High Court held that the report should not be disclosed to P. Since the report contained personal data of both P and DB, they had competing privacy rights. As DB had withheld his consent to disclosure, the starting position ought to have been that the report would not be shared with P. DB’s right to privacy also included protection of his professional reputation and he was entitled to expect the GMC to uphold it.

Another key factor in the High Court’s determination was that the purpose of P’s request was the intended clinical negligence litigation against DB. This was at odds with the aim of the data protection regime, which is to check the accuracy of data held about the person making the request.

As with most cases involving data protection, this case stresses the need for companies to weigh up parties’ competing interests. Companies should be aware that, though data subjects have the right to request disclosure of their personal information, it does not automatically warrant disclosure of all materials. As the GMC did in this case, it is best to ask for the data subject’s permission before disclosing information. On the other hand, this case tells us to take the withholding of that consent seriously, which the GMC failed to do.

Dr DB v General Medical Council [2016] EWHC 2331

[/et_pb_text][/et_pb_column][et_pb_column type=”1_4″][et_pb_sidebar admin_label=”Sidebar” orientation=”right” area=”sidebar-1″ background_layout=”light” remove_border=”off”] [/et_pb_sidebar][/et_pb_column][/et_pb_row][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][/et_pb_row][/et_pb_section]


Discrimination and sickness absence policies

[et_pb_section admin_label=”Section” global_module=”136″ fullwidth=”on” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off”][et_pb_fullwidth_code global_parent=”136″ admin_label=”Post Header”][Page_Header_Start] Employment Law News[Page_Header_End][/et_pb_fullwidth_code][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][et_pb_column type=”3_4″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” use_border_color=”off” border_color=”#ffffff” border_style=”solid”]

Discrimination and sickness absence policies

[post_details]

[Social-Share]

In order to defend the use of a sickness absence policy in a claim for discrimination arising from disability, the employer must be go beyond justifying having a policy and its terms in a generic sense and be able to justify the specific application of the policy in a particular case.

Mr Buchanan was a police officer suffering with post-traumatic stress disorder, which constituted a disability. The police force managed his long-term sickness absence under the statutory ‘Unsatisfactory Performance Procedure’. The policy had a three-stage procedure for managing absence and included the issuing of ‘improvement notices’. As Mr Buchanan’s PTSD was ongoing, he was unable to meet the return-to-work dates set in the improvement notices given to him. He complained that the way in which the policy was being applied amounted to discrimination arising from disability.

The Employment Appeal Tribunal held that the police force had to justify not simply the existence of the policy itself, but also the way in which it applied the policy to Mr Buchanan. Were it that only the policy itself needed to be justified, discrimination arising from disability claims relating to sickness absence would be much harder to win; employers generally have legitimate interests in implementing absence management policies. Rather, there were several points in which Mr Buchanan’s superiors had to make decisions as to how the policy would apply to him. It was those decisions which required scrutiny.

This decision is a helpful reminder for employers facing problems with sickness absence. One cannot simply rely on the existence of an attendance management policy and apply it in a mechanical fashion to justify actions taken against someone on sick leave. Instead, an employer should, at each stage, be thinking about whether particular decisions taken can be objectively justified. Whether this is the case will depend on several factors, such as whether the standard timeline set by the policy can be fairly adhered to in the light of the employee’s disability.

Buchanan v The Commissioner of Police of the Metropolis UKEAT/0112/16/RN

[/et_pb_text][/et_pb_column][et_pb_column type=”1_4″][et_pb_sidebar admin_label=”Sidebar” orientation=”right” area=”sidebar-1″ background_layout=”light” remove_border=”off”] [/et_pb_sidebar][/et_pb_column][/et_pb_row][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][/et_pb_row][/et_pb_section]


EasyJet roster was discriminatory towards breastfeeding mothers

[et_pb_section admin_label=”Section” global_module=”136″ fullwidth=”on” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off”][et_pb_fullwidth_code global_parent=”136″ admin_label=”Post Header”][Page_Header_Start] Employment Law News[Page_Header_End][/et_pb_fullwidth_code][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][et_pb_column type=”3_4″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” use_border_color=”off” border_color=”#ffffff” border_style=”solid”]

EasyJet roster was discriminatory towards breastfeeding mothers

[post_details]

[Social-Share]

EasyJet’s roster system, which could require cabin crew to work shifts of over 8 hours, was indirectly discriminatory on grounds of sex. This was because it put breastfeeding women at a particular disadvantage without justification.

The two claimants were crew members for easyJet and were breastfeeding after returning from maternity leave. EasyJet’s roster system contained a provision whereby staff could be asked to work for longer than 8 hours continuously. The claimants made flexible working requests; they asked not to work shifts of longer than 8 hours in order to manage the time between opportunities to express milk.

EasyJet refused the requests, pointing to the need for it to manage its flying schedule and avoid flight delays. In response, the claimants went to their GPs and were given fitness to work certificates confirming an increased risk of mastitis if they could not express milk. The certificates recommended that the claimants should not work shifts of over 8 hours.

The claimants seemingly took periods of sickness absence and unpaid leave before they were moved to temporary ground duties. They brought claims of indirect sex discrimination against the airline.

The Employment Tribunal held that the claimants had been indirectly discriminated against on grounds of their sex. The provision whereby crew members could be required to work shifts of longer than 8 hours put women at a particular disadvantage, such that the claimants would either have to work the roster and be unable to express milk or lose out financially by missing shifts.

The tribunal noted that easyJet could not point to any examples where the airline had suffered difficulties from giving a crew member a bespoke roster. Additionally, the claimants did have medical evidence supporting the risks to their health posed by the longer shifts.

As a result, it ordered that the claimants be compensated for their lost wages and given £8,750 and £12,500 respectively for injury to feelings. The tribunal recommended that EasyJet write off any periods of absence and credit back any annual leave the claimants took in that period.

This is a reminder to employers that their obligations to employees who are mothers do not end when they return from maternity leave. More generally, it reinforces that employers arguing that a disadvantageous measure is justified will need to have some degree of evidence to support their positions.

McFarlane and another v EasyJet Airline Company Ltd ET/1401496/15 & ET/3401933/15

[/et_pb_text][/et_pb_column][et_pb_column type=”1_4″][et_pb_sidebar admin_label=”Sidebar” orientation=”right” area=”sidebar-1″ background_layout=”light” remove_border=”off”] [/et_pb_sidebar][/et_pb_column][/et_pb_row][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][/et_pb_row][/et_pb_section]


Asda equal pay claims get a green light

[et_pb_section admin_label=”Section” global_module=”136″ fullwidth=”on” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off”][et_pb_fullwidth_code global_parent=”136″ admin_label=”Post Header”][Page_Header_Start] Employment Law News[Page_Header_End][/et_pb_fullwidth_code][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][et_pb_column type=”3_4″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” use_border_color=”off” border_color=”#ffffff” border_style=”solid”]

Asda equal pay claims get a green light

[post_details]

[Social-Share]

Asda’s female shop-floor workers are able to compare themselves to their male colleagues in the distribution centres for the purposes of an equal pay claim.

The equal pay claims relate to the fact that a number of female workers in Asda’s stores learned that male operatives in the retailer’s distribution centres were paid higher hourly rates. The female employees argued that their jobs were comparable with those in the distribution centres such that there should not be a pay disparity. Asda, on the other hand, argued that the two kinds of job could not be compared for equal pay purposes, in part because terms and conditions for each arm of the business came from different sources.

The employment tribunal held that the retail employees were entitled to compare themselves with employees in the distribution centres. It found that there was a single source for the terms and conditions applicable in retail and distribution. Whilst they were separate operations, the Executive Board had control and oversight over both of them. The terms and conditions under which the retail staff worked were broadly similar to those applicable to distribution staff, and that sufficed to found an equal pay claim.

This case is still very much in its early stages; however, it is helpful to know that workers in different operations within the same large company can be comparators in an equal pay sense. Given the size of the potential award at stake (estimated to be in excess of £100 million), much hinges on this preliminary decision and Asda may choose to appeal.

Brierley and others v Asda Stores ET/2406372/2008

[/et_pb_text][/et_pb_column][et_pb_column type=”1_4″][et_pb_sidebar admin_label=”Sidebar” orientation=”right” area=”sidebar-1″ background_layout=”light” remove_border=”off”] [/et_pb_sidebar][/et_pb_column][/et_pb_row][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][/et_pb_row][/et_pb_section]


Further decision on Northern Ireland ‘gay cake’ case

[et_pb_section admin_label=”Section” global_module=”136″ fullwidth=”on” specialty=”off” transparent_background=”off” background_color=”#ffffff” allow_player_pause=”off” inner_shadow=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off”][et_pb_fullwidth_code global_parent=”136″ admin_label=”Fullwidth Code”][Page_Header_Start][post_title][Page_Header_End][/et_pb_fullwidth_code][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][et_pb_column type=”3_4″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” use_border_color=”off” border_color=”#ffffff” border_style=”solid”]

Further decision on Northern Ireland ‘gay cake’ case

[post_details]

[Social-Share]

A Christian bakery’s refusal to bake a cake bearing a message in favour of legalising same-sex marriage was discriminatory.

Mr Lee went to the Ashers Baking Company in Northern Ireland, which was run by the McArthurs, who were devout Christians. Mr Lee ordered a cake bearing the message “Support Gay Marriage”. The McArthurs refused the order on the basis of their Christian beliefs in marriage. Mr Lee brought a discrimination claim against the bakery.

The Court of Appeal in Northern Ireland held that Mr Lee had been discriminated against. Whilst the religious beliefs of those providing a service are protected, they do not permit the bakery to choose which services it offered to the gay community. The Court of Appeal held that, were that the case, the potential for abuse would be substantial.

An interesting point about this case is that the Court of Appeal determined that Mr Lee had suffered associative rather than direct discrimination. That is to say that, rather than the bakery refusing Mr Lee’s order because he was gay (which he was), they refused the order because of his association with pro-gay views. As the Court of Appeal noted, “many heterosexual people support gay marriage and some gay people oppose gay marriage”.

Lee v McArthur and Ashers Baking Company Ltd [2016] NICA 39

[/et_pb_text][/et_pb_column][et_pb_column type=”1_4″][et_pb_sidebar admin_label=”Sidebar” orientation=”right” area=”sidebar-1″ background_layout=”light” remove_border=”off”]

[/et_pb_sidebar][/et_pb_column][/et_pb_row][/et_pb_section][et_pb_section admin_label=”section”][et_pb_row admin_label=”row”][/et_pb_row][/et_pb_section]