Employee DSAR Covering Investigation File, CCTV, and Loyalty Data
Priya has worked in store operations at Northwind Retail for four years and is also a loyalty member. She emails the privacy office demanding 'every piece of data you hold about me' within 30 days. Her request follows a disciplinary investigation into expense claims and a customer complaint. Likely records include HR files, manager notes, investigation interview transcripts, CCTV from the stockroom, till receipts, loyalty purchase history, and email metadata. Two colleagues are named in the investigation notes and have not consented to disclosure. The company operates in the UK and Ireland. The privacy team has 10 working days left. Priya's manager asks whether they can refuse because the request is 'obviously a fishing expedition'. The company has a legal hold on the investigation file and a policy of not disclosing CCTV unless required.
1. How should Northwind scope Priya's request and apply exemptions? Address the investigation file, third-party data, CCTV, and customer data.
Read the worked answer
Scope must cover all personal data about Priya across HR, store operations, loyalty, CCTV, and email systems, regardless of whether she is acting as employee or customer. The request is not limited to HR records, so the loyalty database and till receipts are in scope. The company should search by name, employee ID, loyalty number, and known aliases, and document the systems searched.
Exemptions must be applied narrowly. The investigation file may be withheld only to the extent necessary to protect legal claims or the rights of others; a blanket refusal is risky. Manager notes and interview transcripts should be disclosed with third-party names redacted unless those colleagues consented or their identities are essential. CCTV is personal data and should be disclosed unless a specific exemption applies; Northwind's policy is not itself a legal basis to refuse. Customer complaint data about Priya should be disclosed, but data about the complainant should be redacted. The legal hold does not suspend the DSAR; it may support withholding portions while litigation is reasonably contemplated. Each redaction and withheld item should be logged with the legal basis. The 'fishing expedition' label is not enough to refuse; manifestly unfounded or excessive requests require strong evidence.
2. What is the timeline and what practical steps should the privacy team take in the remaining 10 working days?
Read the worked answer
The statutory deadline is one month from receipt, so the team has 10 working days. It should acknowledge receipt immediately, verify Priya's identity proportionately, and clarify scope only if genuinely needed, without asking why she wants the data. It should issue a data-collection notice explaining sources and categories.
In the remaining days, assign a search coordinator, run searches across HR, payroll, CCTV, loyalty, email, and investigation folders, and freeze deletion. Review documents for third-party data and legal-claims exemptions. Prepare a schedule of records, redactions, and withheld items with reasons. If the request is complex, the team may extend by two months, but it must inform Priya within the first month and explain the delay. Do not wait until day 30 to start redaction. Provide a copy of the data plus supplementary information such as purposes, recipients, retention, and source. If any data is withheld, tell her about the exemption and her right to complain to the ICO or the Irish DPC. Log the response, searches, and decisions as accountability evidence.
3. How should the company respond to the manager's 'fishing expedition' argument and to the legal hold?
Read the worked answer
The manager's view is not a legal test. A request is manifestly unfounded or excessive only if it is clearly abusive, repetitive, or aimed at causing disruption, and the burden is on the controller to prove that. A broad request after a disciplinary process is common and does not itself meet that threshold. Refusing on that basis would likely lead to a complaint and regulatory scrutiny.
The legal hold changes the analysis only for specific records. It can justify withholding material that would reveal the company's litigation strategy or prejudice legal claims, but it does not suspend the DSAR or allow blanket non-disclosure. The privacy team should separate the investigation file into disclosable factual material and genuinely privileged or exempt material, document each decision, and provide a redacted copy where possible. The company should also avoid telling Priya that the request is a fishing expedition; instead, it should explain any extension or exemption neutrally. If the team concludes that a narrow exemption applies, it should still disclose the rest and inform her of her rights.