Coronavirus (UK): Managing the rise of DSARs and redundancies during the Coronavirus pandemic
During the Coronavirus pandemic, there has been a rise in the number of both redundancies and data subject access requests (“DSARs”). This rise has placed increased pressure on HR teams and Data Protection Officers (“DPOs’”), who are having to grapple with this burden alongside the other day to day challenges posed by the pandemic. This article provides a snapshot of the recent trends and some practical tips from our employment team for dealing with them effectively and/or minimising legal risk.
The Office for National Statistics (“ONS”) recently reported that there were 726,000 fewer people in payrolled employment in January 2021 compared to February 2020. More broadly, it has noted that the UK unemployment rate in the last quarter of 2020 was 1.3% higher than in the same period of 2019. In light of such figures, the ONS has commented that “the increase in UK redundancy rates during the Coronavirus pandemic is faster than during the 2008-2009 economic downturn”.
The Chancellor Rishi Sunak stated in his March 2021 Budget that, whilst Government interventions to support jobs have worked, and the Office for Budget Responsibility’s expected peak unemployment rate has lowered from 11.9% to 6.5%, job loss is very much an on-going issue. As many will be aware, the UK Government has extended the Coronavirus Job Retention Scheme (“CJRS”), which pays up to 80% of wages for hours not worked until 30 September 2021. We summarised the key points in our insight 'Coronavirus (UK): detailed guidance published on the extended furlough scheme'.
Whilst this is undoubtedly a challenging time for employees and employers alike, there is some cause for optimism. For example, in April 2020, 7.9 million people were temporarily away from work, but this number fell to 3.9 million in September 2020. Job vacancies have also continued to rise. The ONS has reported that there were an estimated 599,000 job vacancies in the UK in November 2020 to January 2021; 64,000 more than in the previous quarter. It is also hoped that the extension of the CJRS will preserve viable jobs during the summer months as industries begin to recover as lockdown measures are eased.
A recent study showed that three quarters of DPOs were struggling to keep up with their data compliance obligations during lockdown. One of the main drivers behind an increasing workload for DPOs is the growth of DSARs. Due to their very nature, DSARs often arise in an adversarial context such as redundancy situations, which makes the current climate fertile ground for an increase in requests. BCLP’s employment team works alongside BCLP Cubed, a platform which enables employers to respond to DSARs in a timely and complete manner, whilst protecting legal privilege, third party privilege and commercially sensitive information.
Nick Pryor, BCLP’s Innovation Solutions Director, and BCLP Cubed Product Manager, notes that “we have seen a significant increase in DSARs catalysed by business reorganisations and adjustments directly attributable to Covid. Where a cohort of employees are simultaneously impacted by business change, they inevitably share perspectives; as soon as one employee submits a DSAR, it is likely that peers will follow suit. This can quickly overwhelm a business’ internal capacity, as the increase in volume is not distributed in time – all of the DSARs need to be addressed simultaneously to meet their respective deadlines”.
- Identify if there is a redundancy situation: This may sound simple, but before carrying out any redundancy exercise you should check that the facts of your matter amount to a redundancy situation. The relevant legislation is section 139(1) of the Employment Rights Act 1996. If not, employees may not be entitled to a redundancy payment, however there is also a risk that any dismissals will be unfair.
- Know your numbers: If you are proposing to dismiss as redundant 20 or more employees at one establishment within a period of 90 days or less, you should enter into collective consultation with the appropriate representatives of the employees affected by the proposed dismissals. A common misconception is that employees who agree to voluntary redundancy do not count when considering the numbers - they do.
- Know your timings: If you are required to consult collectively, consultation should begin in good time and at least 45 days before the first dismissal takes effect. If less than 100 but at least 20 employees are to be dismissed within a 90 day period, consultation must begin at least 30 days before the first dismissal takes effect.
- Sanctions: It is particularly important to comply with collective consultation requirements because the potential compensation which can be awarded for a failure to comply is significant (up to 90 days’ uncapped pay for each affected employee) and there are also criminal sanctions for breaching notification requirements.
- Automated solutions: If you are dealing with a particularly high volume of redundancies, it may be more cost effective to utilise a technology led platform such as BCLP Cubed. This was the approach adopted recently by a FTSE 100 company to assist with the consultation and settlement agreement process during a large redundancy exercise. By utilising BCLP Cubed, the client was able to benefit from the expertise of BCLP’s employment team alongside an award winning managed services provider to help deliver the project on time and in a cost effective manner.
- Be aware of when a DSAR has been made: Individuals can make DSARs verbally or in writing, including via social media platforms. A DSAR is merely a request for personal information and does not need to include any specific words or refer to legislation. If in doubt, we recommend sending an email to clarify whether a DSAR has been made.
- Know your time limits: You are required to respond to the DSAR without delay and within one month of receiving the request (i.e. the date you receive the DSAR). This deadline can be extended by a further 2 months where the request is complex or where there are a number of requests from the individual. If you need to ask the data subject for clarification then the time limit for responding may be paused until you receive a response. The ICO’s guidance in this area has changed recently and it is worth considering carefully whether it is possible to limit the scope of the request made, either with or without the cooperation of the data subject. This step can significantly reduce the volume of data to be reviewed, minimising the time and cost of responding to the DSAR.
- Be aware of the exemptions: There are specific exemptions (under schedules 2 and 3 of the DPA 2018) which you should be aware of before you commence your DSAR – these include (amongst others), health, education and social work data, negotiations with the regulator, legal professional privilege, crime, taxation, etc.
- Does your request include pictures, text messages and WhatsApp messages? Check your IT and Communications Policy (or similar) to identify whether your company prevents the workforce using work devices for personal appliances such as WhatsApp. If the company policy is silent, or if it does not prevent the use of texting / WhatsApp then you will need to consider how to collect the personal data from your company work devices – for example, is there a main server that downloads and stores information that can be easily collected or will you need to ask employees to collect data on your behalf? For further information on this, please contact BCLP.
- Automated solutions: BCLP Cubed provides an innovative new approach to handling DSARs efficiently and cost effectively. The service leverages a combination of market leading technology alongside experienced employment lawyers to enable you to respond to DSAR requests on time and on budget.
To find out more about how BCLP Cubed can help save your business time and money in managing DSARs please email Nick Pryor or Rebecca Harding-Hill. For complex DSARs outside of the employment context, please contact Kate Brimsted or Geraldine Scali in our global Data Privacy and Security team.
BCLP has assembled a COVID-19 Employment & Labor taskforce to assist clients with employment law issues across various jurisdictions. You can contact the taskforce to help with any employment issues.
You can also view other thought leadership, guidance, and helpful information on our dedicated COVID-19 / Coronavirus resources page.
This document provides a general summary and is for information/educational purposes only. It is not intended to be comprehensive, nor does it constitute legal advice. Specific legal advice should always be sought before taking or refraining from taking any action.