A wide subject access and erasure request against retention duties
Kestrel Logistics GmbH employs 1,200 people at a depot near Hamburg. On 3 June an employee, Mr A, sends a written request asking for 'everything you hold about me' and for deletion of all sickness-absence records. HR holds: the personnel file, payroll data, a two-year-old performance review, a grievance report about an argument in the loading bay, and absence records. The grievance report contains statements from three named colleagues given on a promise that their names would not be disclosed. Payroll must keep wage records for six years under German tax rules, and the company is defending a pending unfair-dismissal claim in which the absence records are relevant. The HR manager wants to send the whole file unredacted 'to avoid looking obstructive', and to delete the absence records because 'health data is sensitive'. The request arrived on a Friday; the team is short-staffed and asks whether it can simply take three months to reply.
1. What must Kestrel disclose, what may it redact, and does the promise of confidentiality to the colleagues change anything?
Read the worked answer
Scope. Article 15 gives Mr A the right to confirmation of whether his data is processed, a copy of that data, plus the Article 15(1) information (purposes, categories, recipients, retention, rights, source, automated decision-making). The request must be read broadly; 'everything you hold about me' covers the personnel file, payroll, the review, the grievance report and absence records.
What the grievance report is. Information about Mr A in the report, including the allegations, findings and outcome, is his personal data and must be disclosed. The statements are also the personal data of the three colleagues.
Redaction. Article 15(4) and Recital 63 mean the right to a copy must not adversely affect the rights and freedoms of others. The usual approach is to disclose the substance while redacting third-party identifiers where that remains intelligible. Recital 63 also states that the result should not be a refusal to provide all information.
Confidentiality promises. A promise of anonymity does not override Article 15. It is a factor in the balancing exercise: the controller should weigh the colleagues' interests (risk of retaliation in a small depot) against Mr A's need to understand the case against him. Confidentiality is normally protected by redaction, not by withholding the report.
Deadline. Article 12(3) gives one month from receipt, extendable by two further months only where the request is complex or numerous, with the extension and reasons notified within the first month. A blanket three months is not permitted. Identity should be verified, but not by demanding excessive proof.
2. Can Kestrel refuse the erasure of the sickness-absence records? Give the applicable exceptions and the reasoning.
Read the worked answer
Yes, erasure can be refused, but only on identified grounds, documented and explained to Mr A.
Article 17(1) is engaged. The absence records are health data (Article 4(15), Article 9(1)); if they are no longer necessary for their purpose the erasure right arises. The HR manager's instinct to delete because the data is sensitive is the wrong reasoning: Article 9 does not require deletion, it requires a condition for processing, here Article 9(2)(b) (employment law obligations) and Article 9(2)(f) (legal claims).
Exceptions under Article 17(3):
- Article 17(3)(b) - legal obligation. Wage and payroll records must be retained under German commercial and tax law (typically six years, longer for certain documents). Absence data that feeds payroll calculations falls inside that retention.
- Article 17(3)(e) - establishment, exercise or defence of legal claims. A dismissal claim is pending and the absence history is directly relevant, so retention of the specific records in issue is justified.
Limits. The exception must be proportionate. Records that neither feed payroll nor relate to the claim should be deleted or anonymised, and retention should be time-limited to the end of the claim plus any appeal period. The response should tell Mr A which records are kept, on what basis, and for how long (Articles 12(4) and 13).
What is not available. A blanket refusal, silence, or a refusal to confirm what is held. Refusal must be reasoned and Mr A must be told of his right to complain to the supervisory authority and to a judicial remedy (Article 12(4), Article 15(1)(f)).
3. The HR manager proposes sending the full unredacted file to 'avoid looking obstructive'. What is wrong with that, and what should the covering response contain?
Read the worked answer
Sending the unredacted file creates a second, separate violation in an attempt to cure the first.
Problems with unredacted disclosure:
- Third-party data. Names, contact details and identifiable statements of the three colleagues would be disclosed without a lawful basis. Kestrel would be processing their data for a purpose they do not expect, breaching the principle of lawfulness and fairness in Article 5(1)(a).
- Confidentiality undertaking. Disclosing named statements after an express promise exposes the company to a breach-of-confidence claim and an employment-relations dispute.
- Excessive response is not a defence. Article 12 requires the information to be provided transparently; over-disclosure does not satisfy Article 15 and may breach Article 5(1)(c).
What the response should contain:
- An acknowledgement and a dated reply within one month, or a reasoned Article 12(3) extension notified inside that month.
- Confirmation of processing and the Article 15(1) information.
- The copy with third-party identifiers redacted, and a short explanation that redaction protects the rights of others under Article 15(4) rather than withholding information from him.
- The outcome of the grievance process as it concerns him, since that is his data.
- The refusal on erasure, with the Article 17(3) reasons, retention periods and his remedies.
- A record of the request, the decision, the redactions applied and the person who approved them, so the reasoning can be defended to the Hamburg Commissioner or a court.