Access when information about third parties is involved

The following diagram shows how to deal with subject access requests when the identity of a third party, i.e. a person other than the worker making the request, might be revealed within the personal information being released to the worker.

The employer must decide whether on balance the worker’s right to know what information is held about him or her and its source outweighs the right to privacy of the third party who can be identified through releasing the information.

Factors to weigh in this balance include:-

• whether the information can easily be edited to remove the part that reveals the identity of a third party without significantly changing its likely value to the worker.
• whether releasing the information would breach a duty of confidence owed by the employer to the
  third party. (NB: When considering the release of references it is hard to see how releasing factual
  information about the worker such as his or her sickness record or allegations which have been or
  ought to have been put to him or her by an employer would breach such a duty.)
• whether the third party has expressly refused consent to release of the information and the reasons given, if any.
• what the third party was told when the information was supplied about its possible release or, if told nothing, what the third party’s reasonable expectations would be. (NB: those asked to give references should not be led to believe and cannot expect that their references will be kept confidential in all circumstances. They may, for example, have to be released under disclosure procedures in the event of a claim of unlawful discrimination.)
• the impact the information has had or might have in the future on actions or decisions affecting
  the worker.
• the nature of the information, in particular whether its release could be damaging to the third party
  or whether it would reveal sensitive data about the third party.
• the extent to which the worker is likely to be aware already of the information.
• whether the information includes facts which the worker ought to be made aware of because he
  or she might dispute them.
• whether the information identifies the third party in a business or personal capacity. (NB: When
  considering the release of references the third party’s right to privacy is greater if he or she is the
  author of a personal reference rather than of a corporate one).
• the fact that if information is released in error the error cannot subsequently be corrected, but if
  information is withheld the error can subsequently be corrected by its later release, perhaps on the
  order of the Information Commissioner or a court.

The Commissioner’s view is that, where the information from which a third party can be identified consists of an employment reference received by the employer it should normally be released to the
worker unless the referee provides some compelling reason as to why it should be edited or not released at all. If, in other cases, the release of such information would breach a duty of onfidentiality owed by the employer to the third party, the information should only be released if its nature is such that it has had or is likely to have a significant adverse impact on the worker.