On 27 October 2020, the litigation chamber of the Belgian Data Protection Authority (DPA) ordered an employer to give an employee access to the appraisal documents contained in her file. The employer was late in responding to the employee’s requests, while invoking the exemption under Article 15 of the General Data Protection Regulation (GDPR), i.e. this right of access may not adversely affect the rights and freedoms of others.
The DPA, however, found that, pursuant to recital 63 of the GDPR, this right should be exercised “easily” and that this exemption should not be a refusal to provide any and all information to the employee. It is up to the employer to remove or anonymize third parties’ personal data beforehand, as the case may be.
Does that mean that employees’ right of access is absolute and applies whatsoever to any and all documents and records containing employees’ personal data?
No, other considerations can be invoked by an employer, such as the possibility to request an employee to specify the information or processing activities to which his/her request relates or even a refusal when the request is manifestly unfounded or excessive. Also, the scope of the above exemption does not only relate to third parties’ personal data; it can include, without being limited thereto, trade secrets or intellectual property and in particular the copyright protecting the software.
In any case, employers should be prepared since responding to employees exercising their GDPR rights can be time-consuming and expensive. Having a procedure in place will ensure employers to deal therewith as efficiently and consistently as possible.
The decision (in Dutch) of the DPA (N° 70/2020) can be found on:
https://gegevensbeschermingsautoriteit.be/publications/bevel-nr.-70-2020.pdf