AAB ruled that data access request made by an ex-employee properly complied with by the ex-employer and upheld the Privacy Commissioner's decision not to issue enforcement notice on breach of DPP5 by the ex-employer as a result of the latter's taking of remedial action in adopting a written policy on personal data privacy consequent upon the complaint.
An employee's contract of employment with a public body was terminated - she made several data access requests for reasons of her dismissal - alleged failure of the public body to comply with her data access requests and contravention of the requirements of all data protection principles - section 19 and DPP5
The Complaint
The complainant was an employee of a public body and her contract of employment was terminated prior to normal expiration of its contractual term. She made five data access requests to the public body for reasons of her dismissal but was not satisfied with the personal data provided to her. She complained that the public body had contravened section 19 of the PDPO in withholding the requested personal data and also alleged breach of data protection principles 1 to 6 on the part of the public body.
Findings of the Privacy Commissioner
Having completed the investigation of the complaint, the Privacy Commissioner found that the public body had already complied with all the complainant's data access requests made in accordance with the PDPO. However, the Privacy Commissioner found that the public body had contravened DPP5 in that the public body did not have a written policy on personal data privacy at the material time. As the public body had consequent upon the investigation adopted a written privacy policy statement, the Privacy Commissioner having satisfied that there was unlikely to be a repetition of the contravention of DPP5 and hence exercised his discretion not to issue an enforcement notice. The complainant appealed.
The Appeal
In relation to the five data access requests allegedly made by the complainant, the AAB ruled that three of them could not be construed to be data access requests properly made under section 18 of the PDPO. As regards the remaining two data access requests, the AAB ruled that according to the facts of the case the Privacy Commissioner was right to find that the public body had adequately complied with the said two requests. Under the PDPO, the Commissioner was given the discretion to decide whether to issue an enforcement notice even where there was a contravention of the PDPO. The AAB decided that the reasons given by the Privacy Commissioner in not issuing the enforcement notice on breach of DPP5 were proper.
AAB's decision
The AAB upheld the Privacy Commissioner's decision and the appeal was dismissed.