Data Protection Principle 6 - Rights of data subjects

There are seven specific rights defined in the DPA:

• the right of access to personal data
• the right to prevent processing likely to cause damage or distress
• the right to prevent processing for purposes of direct marketing
• rights in relation to automated decision-taking
• rights of data subjects in relation to exempt manual data
• the right to seek rectification, blocking, erasure and destruction of inaccurate data
• the right to make a request for assessment.

Only the first of these rights has a particular application in the context of payroll.

The right of subject access was originally introduced in the first Data Protection Act, in 1984. It provides a fundamental right for a data subject to approach any data controller who the data subject believes may be processing personal information about the data subject.

Current and former employees may make a written subject access request to an employer of theirs and pay a fee of up to £10 if the employer requests it. Within 40 days of receiving the request, the employer must respond, providing a description of the data being processed and a copy of the data along with any codes needed to understand it.

Although such requests are infrequent, the work involved to comply can be considerable. All of the payroll records stored on computer, for as many years as they are stored, must be interrogated and printed out. Any supporting documents that contain personal data about the employee and that are stored in a "relevant filing system" must also be provided. See the earlier definition of "relevant filing system".