Irish Data Protection Commission Case Studies

Case study 11: Access request for old records [2011] IEDPC 11 (2011)

We received a complaint from an individual concerning the alleged failure of the Public Appointments Service (PAS) to comply with an access request he submitted in March 2010. The personal data which the complainant was seeking access to related to his candidature in recruitment campaigns carried out by the PAS (formerly the Office of the Civil Service and Local Appointments Commission) in the 1960s and 1970s.

In response to our investigation, the PAS confirmed that it was still in possession of the files relating to the recruitment campaigns in question, campaigns that took place over the course of a decade from 1969 to 1979. It also confirmed that it was in the process of identifying all of the personal data relating to the complainant, but it was not a straightforward process given the age of the files, and the fact that some older files had been amalgamated.

The PAS subsequently provided the complainant with copies of the personal data that it had located, but it informed him that it was applying the exemption set out at Section 4(4A)(b)(ii) to other data. This exemption allows for the withholding of data that constitutes an expression of opinion, in circumstances where the expression of opinion referred to was given in confidence or on the understanding that it could be treated as confidential. The PAS argued that the data was created in the 1970s in a culture of confidentiality, long before the introduction of Data Protection or Freedom of Information legislation. Having examined the data it was satisfied that it would not have been created in the first instance but for the understanding that it would be treated in confidence. The PAS indicated that it had an obligation to honour the guarantee given to the individuals concerned in this case and that it would not be prepared to renege on that commitment, even at this stage.

We requested sight of the documents in question to determine whether the exemption at Section 4(4A)(b)(ii) was validly applied. Following an examination, we informed the PAS that some elements of the documents could be withheld, but the exemption could not be applied to the entirety of the documents in question. The PAS followed our advice and released the personal data on that basis to the requester.

We took this opportunity, given the complaint and the issues highlighted by it, to advise the PAS to re-examine its policies in relation to the retention of personal data for longer than was necessary for the purpose/s for which it was obtained. The PAS informed us that it had a Records Retention Policy in place, in accordance with data protection requirements, which sets out the timeframes for the retention and destruction of records. Records such as those that had been examined by my Office on foot of this complaint have a retention period of three years after the determining of the candidate as suitable, or otherwise, for appointment, but in this instance records had been retained by the PAS for over 30 years. PAS indicated that it had applied for, and had only recently received Certificates of Destruction from the National Archives in relation to these records.

As this case shows, data controllers not only need to have a retention policy in relation to the keeping of personal data, but they must also have an effective mechanism in place to implement that policy. Once an access request is received by a data controller, they must provide the requester with all personal data sought, irrespective of the age of the records, once the data is still in existence. The safe destruction of older records in accordance with a data retention policy is a vital aspect of good data protection practice in any organisation and is a critical tool in ensuring compliance with the law.