Data protective jurisdictions tend to guarantee the right of individuals to contact an organization directly and find out whether personal data is being tracked. Access procedures and acceptable exceptions (such as business secrecy) are determined by law and may be subject to the control of data protection authorities. In the context of HR, personal data access requests can include information tracked by the company as well as data tracked by third-party solutions, such as background check vendors.
In New Zealand, individuals have the right to ask whether employers (or other agencies) hold personal information about them as well as the right to request access to their personal information. When an employer receives a request from an employee, or other individual, the employer must consider the request and determine what (if any) costs will be imposed and inform the individual within 20 days of receipt. In cases where a large amount of information is requested, the employer must inform the individual:
Employers may refuse personal information requests when the information is evaluative material. Evaluative material is information compiled solely for the purpose of determining the suitability, eligibility or qualifications of the individual to whom the material relates for: employment (or appointment to office); promotion or to continue in employment (or office); or, for the removal from employment (or office).
Employers can refuse access requests in additional circumstances. The circumstances that would most likely apply to apply to employer include when:
If individuals are given access to personal information, they must be informed that they have the right to request the correction of their personal information (Privacy Act 2020, Information Privacy Principle 6).
If an individual requests that their information is corrected and that request is rejected by the employer, the individual has the right to request a statement of correction. If the employer corrects information or attaches a statement of correction to the information, the employer must, if reasonable, inform all other parties who received the personal information (Privacy Act 2020, Information Privacy Principle 7).
HR Best Practices: When processing an access request from an employee, make sure not to disclose information connected to other employees. Establish official procedures and contacts for employee requests.