CASE STUDY 3/97

Employees sought access to consultants’ study

A company engaged consultants to evaluate some of its senior management posts. Knowing that the consultants’ reports were kept in computerised form, the occupants of a number of these posts made a request to the consultants, under section 4 of the Act, for copies of the information relating to themselves. The consultants did not respond within the period of 40 days provided for in section 4(1)(a), and the employees concerned complained to me.

In keeping with my practice – which I have outlined in previous Annual Reports – of seeking in the first instance to resolve cases by agreement between the parties, I invited the consultants to meet me. They explained to me that this was the first time they had encountered a request under the Act for access to data arising from their work. As consultants they acted as agents for other organisations, which made their position sensitive. Furthermore, some of the information they kept – consisting of "scores" assigned according to certain criteria – derived from the application of proprietary methods, and they had some concern that disclosing it would amount to revealing commercial information of their own.

While I appreciated their concerns, I explained to them that section 4 clearly provided for the complainants’ right of access to their personal data. Following my discussions with the consultants they responded to the access requests to the satisfaction of the individuals, who informed me that the matter was resolved as far as they were concerned.

The issue raised by this complaint is one that occurs from time to time. Data controllers, faced with an access request under section 4, sometimes argue that there are special circumstances which in some way entitle them to respond either in a limited way or not at all. In such cases, I point out that the only restrictions on the individual’s right of access are those laid down specifically in section 5. If none of the provisions of that section apply, then the request must be responded to no matter how inconvenient or disagreeable it may be for the data controller to do so.