The Data Protection Act 2018 (DPA 2018) contains three provisions that allow an employer to resist subject access requests (SARs) from employees.
Confidential references become more confidential
The Data Protection Act 1998, under the heading “Confidential references given by the data controller“, stated that personal data were exempt from the right of access:
“if they consist of a reference given or to be given in confidence by the data controller for the purposes of … employment, or prospective … employment, of the data subject” (emphasis added) (paragraph 1, Schedule 7). Continue reading