NEW RIGHT TO COMPLAIN GOES LIVE

From 19 June, data subjects have the right to raise concerns about data issues directly with the organisation. In an employment context, this opens another door for your workforce (or other stakeholders like job applicants) to formally complain about anything data related – whether it is misuse of HR data, retention of information, perceived excessive monitoring, or delays/defaults in responding to data subject access requests (DSARs). Complaints about data handling will need to be treated as a structured, time-bound process, similar in discipline to DSARs.

Under the new regime, organisations must be able to acknowledge complaints within 30 days, and investigate and respond “without undue delay”. While somewhat grey, the ultimate goal is to avoid complaints landing on the Information Commission’s desk where they can be resolved beforehand.

While it might involve a little preparation, overall this should give organisations the opportunity to resolve matters before the Information Commission is involved. Much like the appeal stage of any internal employment process, this is a chance to rectify problems, or set the record straight if the outcome is correct.

However, employers should take care to ensure that policies and processes for the right to complain are clear, and that these work alongside appropriate grievance and whistleblowing processes. Complaints about data protection practices can easily stray into protected disclosures, so a careful eye for detail might be needed to ensure all applicable processes are appropriately engaged and that whistleblowers are protected.

Steps to prepare for the new right include:

1. Design your complaints process, including where complaints can be made, who will be accountable for this process and the obligations under it. This should include the acknowledgement within 30 days, the practice of gathering and considering evidence, keeping the subject informed and providing a reasoned explanation with any remedial steps or improvements taken. We also recommend keeping a log of applicable timescales from receipt of a complaint, investigatory steps and outcomes to help demonstrate the lack of any delay. 

2. Consider  how your complaints process sits alongside your grievance and whistleblowing policies. Ensure the complaint managers understand when a protected disclosure has been made, and clear signposting between the applicable processes.

3. Update privacy notices to let individuals know that they have the right to complain and what process they should follow.

4. Complaints can be made to anyone in any format. Upskill staff to recognise a complaint and understand what they need to do if they receive one.

If you have any questions about implementing your complaints process, we would be happy to help.