Does an individual who is no longer employed by the employer have data access rights, and if so for how long after leaving?
An ex-employee has data access rights under the Data Protection Act 1998. The employer is the data controller and the ex-employee is the data subject and is entitled to make a subject access request in respect of the data held on him or her.
There is no set period for which these data access rights remain. However, the Data Protection Act 1998 states that, under the fifth principle, data shall not be kept for longer than is necessary for the purpose for which it is held. This means that the employer is entitled to delete the data once the information is no longer needed and the employee can no longer gain access to it.
There is no set time period for keeping data and it may be necessary to separate pieces of data for different purposes. The Information Commissioner's Data protection - employment practices code reminds employers that the Act does not override any statutory requirement for retention of records, for example in relation to income tax or certain aspects of health and safety. However, personal information that is no longer relevant should be deleted once the employment relationship has ended. Employers are advised in the code to set standard retention times for different categories of information.
The ex-employee, therefore, has subject access rights to data that is held by the employer for as long as that information is held by the employer.