Can an employer satisfy a subject access request by allowing a former employee to search their own email inbox?
It is a common tactic for an ex-employee to make a subject access request before initiating Tribunal proceeding.
Some (perhaps suspiciously minded folk!) believe this is just done to increase the hassle factor and often is used as a negotiation tactic to increase any financial offers, others, appreciate that it is an opportunity to gather evidence at an early stage before the tribunal schedule and disclosure timetables are set.
A question often raised, is, rather than having to set the named data controller the lenghty and often painstaking task of sifting through all documents (whether electronic or hard copy) to find anything that references the employee, could the employer simply allow the employee access to his or her old email inbox.
The short answer, is no, this does not comply with the necessary GDPR obligations for a subject access request, but you can of course agree for the employee to withdraw the request and accept this as an alternative. Practically the employer would need to invite the ex-employee into the office to review their inbox and then provide copies of items selected by the employee. The employer would then need to consider issues such as whether (and if so, how) to limit the ex-employee's access to the employer's system and/or confidential information.
Posted on 06/06/2019 by Ortolan
