Insufficient evidence to show that the ex-employer had failed to comply with a data access request made by an ex-employee
Data access request (DAR) made by ex-employee covering two categories of data - ex-employer repeated answer previously given in respect of category I data requested under Code on Access to Information - category II data were not supplied as they were third parties data or erased data - DPP6, sections 18 and section 19(1)
The complaint
The complainant made a data access request to her ex-employer on 21 April 2005 for (i) records of her resignation and not conducting assessment meeting with her in relation to her three appraisal reports referred to under the ex-employer's file reference (category I data); and (ii) records of her ex-employer "in obstructing her attending court proceedings to testify after her injury at work" and she asked for personnel records of her two colleagues (category II data). The complainant had made similar request before under the Code on Access to Information for which her ex-employer had replied by agreeing to supply her with part of the documents but for the other parts, the ex-employer replied that it could not supply her and with reasons given. In responding to the DAR on 30 May 2005 (i.e. within the 40 days statutory time limit), the ex-employer confirmed agreement to provide her with those parts of Category I as replied before and refused to supply her with data contained in Category II as they contain personal data of third parties. The complainant did not pay the fee to collect the personal data and lodged complaint with the Privacy Commissioner on non-compliance of her DAR.
Findings by the Privacy Commissioner
Enquiry was conducted and having reviewed the answer given by the ex-employer and having also examined the documents that the ex-employer refused to provide the complainant, the Privacy Commissioner found no prima facie evidence of contravention of the requirements of the PDPO by the ex-employer. Dissatisfied with the findings, the complainant lodged an appeal with the AAB.
The appeal
The complainant argued that the purported compliance of her DAR by the ex-employer by relying upon the previously given reply made in response to the Code on Access to Information was made on an erroneous basis and that the other parts of the data contained mainly her personal data such as her sick leave records and medical certificates that should be supplied to her.
The AAB took the view that from materials before the Board, there was nothing to suggest that the provisions of the Code on Access to Information relied upon by the ex-employer in the present case were inconsistent with the principles under the PDPO. As for the complainant's allegation that the other parts of the data requested by her contained her personal data, the Board did not accept that there was any evidence of any intention on the part of the ex-employer to mislead. In relation to category II data, the Board took the view that the requested documents were not her personal data and that there was no consent of these individuals to release the information to her. Moreover, the request was premised on her ex-employer "obstructed her attendance to testify in court proceedings" and there was no evidence to substantiate that premise.
AAB's decision
The appeal was dismissed..