Employee Data Privacy

Do individuals have the right to access their personal information? 

Data protective jurisdictions tend to guarantee the right of individuals to contact an organization directly and find out whether personal data is being tracked. Access procedures and acceptable exceptions (such as business secrecy) are determined by law and may be subject to the control of data protection authorities. In the context of HR, personal data access requests can include information tracked by the company as well as data tracked by third-party solutions, such as background check vendors.

In New Zealand, individuals have the right to ask whether employers (or other agencies) hold personal information about them as well as the right to request access to their personal information. When an employer receives a request from an employee, or other individual, the employer must consider the request and determine what (if any) costs will be imposed and inform the individual within 20 days of receipt. In cases where a large amount of information is requested, the employer must inform the individual:

• if an extension is necessary to respond to the request; and,
• the reason for the extension.
  
  

Employers may refuse personal information requests when the information is evaluative material. Evaluative material is information compiled solely for the purpose of determining the suitability, eligibility or qualifications of the individual to whom the material relates for: employment (or appointment to office); promotion or to continue in employment (or office); or, for the removal from employment (or office).

Employers can refuse access requests in additional circumstances. The circumstances that would most likely apply to apply to employer include when:

• the information requested doesn’t exist or cannot be found, despite reasonable efforts to locate it;
• disclosing the information would involve the unwarranted disclosure of personal information of another individual or deceased person;
• giving access would likely pose a serious threat to the life, health, or safety of any individual or, to public health or safety;
• giving access would create a significant likelihood of serious harassment of an individual; or,
• giving access would include disclosure of information about another person who is the victim of an offence or alleged offence; and, the disclosure would likely cause significant distress, loss of dignity, or injury to feelings.

If individuals are given access to personal information, they must be informed that they have the right to request the correction of their personal information (the Privacy Act 2020, Information Privacy Principle 6).

If an individual requests that their information is corrected and that request is rejected by the employer, the individual has the right to request a statement of correction. If the employer corrects information or attaches a statement of correction to the information, the employer must, if reasonable, inform all other parties who received the personal information (the Privacy Act 2020, Information Privacy Principle 7).