The report is based on a joint investigation by independent employment specialists Industrial Relations Services and the law firm DLA.
The report claims that 50% of employers are failing to meet their obligations under the legislation by not implementing a control system to ensure HR personnel have access to employees’ personal information only on a “need to know” basis. It also states that 70% have not attempted to get consent from each of their employees to hold sickness absence records and 30% have not sought consent to hold sensitive personal data on their employees.
However, leading data protection law expert Shelagh Gaskill, a partner in Masons, the international law firm behind OUT-LAW.COM, said:
“This report misses the vital point that the provisions referred to are not in force until 24th October this year for most medium-sized and large organisations. So many of the businesses surveyed will likely use the intervening six months to get their data protection procedures in order. The large businesses referred to by the report are highly likely not to be in breach of this Act in the way its authors suggest. This report is a typical example of scare-mongering by lawyers.”
The report was based on a study group of 50 medium-sized and large organisations. Its authors claim that it coincides with the first anniversary of the Act coming into force. The Act relates to the collection, use and disposal of data about individuals. As Shelagh Gaskill observes, “The Act did come into force on 1st March last year – but there is a transitional period giving organisations which were processing data for their business purposes on 23 October 1998 exemptions until midnight on the 23rd of October 2001.”
Click here for the text of the legislation where it describes exemptions available before 24th October 2001.
For more information, see our guide on Data Protection.