#BTColumn – Dear HR . . . the right to have information deleted

Disclaimer: The views and opinions expressed by the author(s) do not represent the official position of Barbados TODAY. 

by Carol-Ann Jordan and Jacqueline Belgrave

Under the Data Protection Act 2019 an individual (data subject) has several rights.
One such right is to erasure. That’s is, you can ask an employer (data controller) to delete the data the company holds about you.

In HR activities, the data collected relates to individuals who are either current, former, or prospective employees as well as interns or volunteers. These HR activities include recruitment, hiring, performance of the contract and activities after employment has been terminated.

WHEN CAN I ASK FOR MY DATA TO BE DELETED?
The right to erasure only applies to data held at the time the request is received. It does not apply to data that may be created in the future.

As an employee the right applies in the following circumstances:
1. The personal data is no longer necessary for the purpose which it was originally collected or processed.
2. You have withdrawn your consent for the data being held and there is no other lawful reason for holding the data.
3. Where the employee objects to the processing of the data.
For example:

• During the recruitment process, personal data is collected. This data includes the candidate’s name, contact details, educational background, data on professional experience and any other data provided in the resume.
Where the individual is not selected for employment, the data is still retained by the employer.

The employer has the obligation to delete the information or obtain the consent of the candidate, who has not been selected, for storage of data even though retaining the data is with the intent of contacting the persons concerned in the event of a vacancy.

• You enrolled in the company’s medical plan but no longer wish to be a part of the plan.

• During this COVID-19 pandemic employers may have to manage data about employees’ vaccination status, information about actual infection, and what information can be disclosed to staff, public health professionals or authorities.

Under the data rules there are no restrictions which prevent staff from being informed about actual infections.

This is because employers are obligated to care for their workforce’s health and safety and it may be necessary to inform immediate team members of their colleague’s diagnosis, for example, for contact tracing purposes.

However, care must be taken not to volunteer more information than necessary.

THE RIGHT TO ASK FOR PERSONAL DATA TO BE DELETED IS HOWEVER NOT ABSOLUTE
The right is not absolute and applies only in certain circumstances. It does not apply where
• The employer is required to retain information in compliance with the law or is required to do so in the public’s interest or in the exercise of official authority vested in the employer; or
• For the establishment, exercise or defence of legal claims.
So even though an employee may want to have the data erased, the employer maybe under legal obligation (under other pieces of legislation) to retain the information for specified periods of time.

In such cases they have to ensure that the information is kept safely and securely, with minimal risk of being seen or used by unauthorised persons.

TIPS ON HOW TO MAKE THE REQUEST FOR THE ERASURE OF DATA
• You should make your request in writing
• Include enough details which will enable the receiver of the request to identify you;
• Express that you are exercising your right to erasure under the Data Protection Act 2019;
• Outline the personal data you want erased.

Once the request is made for erasure of personal data, the data controller (employer) must comply without undue delay.

Hence the company must a have data policy and procedures which include a plan of how to respond to employees’ requests timely and effectively.

The plan should also include the process to be employed when there is a legal basis to deny a request.

Given this individual right to erasure, it is important for employers to keep a list of which data is processed, for which purpose data is processed, where the data originated and with whom the data was shared.

About Lifeline Labour Solutions: Lifeline Labour Solutions is a boutique partnership providing people management solutions to workplace challenges. Partners Carol-Ann Jordan and Jacqueline Belgrave are established practitioners with a wealth of knowledge and experience in Employment Relations, Labour Relations and Human Resource Management between them. Email: info@lifelinelabour. com; Tel: 1(246)247-5213