Our enquiring reader is this time an employee within a large organisation. He suspects that there may be certain information which concerns him in his personal file which is being kept from his knowledge. He is asking whether, as an employee, he has the right to know what personal data is being kept about him, and if so, what he can do about it.
Indeed our reader is touching on one of the fundamental rights of every citizen under data protection legislation - the right of access. Employees, both in the public and the private sector, have a right to be granted access to information that is kept about them by the data controller, in this case the employer.
Employers collect personal data on their employees for various purposes, like payroll and tax information, sickness records, disciplinary records, performance reviews, interview notes, appraisal reports and other information. All records make up a personal file, whether this is held electronically or in the traditional paper format.
How does an employee exercise his right of access? Simply by making a written and signed request to the employer who shall provide the employee, without excessive delay, at reasonable intervals and at no cost, written information in an intelligible manner - on the actual information about the employee which is processed, where the information has been collected, the purpose of the processing, whether the information is passed to third parties and in the case of automatic processing, knowledge of the logic involved.
This does not mean that the employee has the right to have physical access to the file or to have copies made of the documents, but he has the right to have full information about the documents and other data which may be contained in the file. Although they are not obliged to, some organisations have adopted a policy, or may opt in certain cases, to give physical access to the file or provide copies of documents.
Some exemptions from the right of access in relation to employment include: information held by management for plans to promote, transfer or make a worker redundant, to the extent that such access is likely to prejudice the conduct of the employer's business; information on the intentions of the employer about negotiations with a worker insofar as that access would prejudice these negotiations; information held for the prevention or detection of crime, the apprehension or prosecution of offenders, where access could prejudice these matters; information that identifies third parties other than the employee.
Where an employee feels that his right of access has not been fully granted, he may lodge a complaint with the Commissioner who will investigate the case and intervene where necessary.
Apart from the right of access, employees also need to know which data the employer is collecting about them, and what is the purpose of this processing. It is important that staff with responsibilities in the handling of personal data are aware of data protection and receive proper training, otherwise there could never be proper respect for the privacy of the employees in the workplace.
The Office of the Commissioner is currently holding regular meetings with representatives of employers and employees for the development of guidelines in the employment sector.
Readers are invited to address any queries on data protection, which may be discussed in this column, to the Office of the Commissioner for Data Protection by e-mail commissioner.dataprotection@gov.mt or at its address, 2, Airways House, High Street, Sliema SLM 16.