Case Study: The Importance of Data Protection in Employee Leave Requests
Background
A recent case involving a trainee solicitor highlights the vital intersection of data protection and employment practices and law. A trainee solicitor, Stephanie Merrill, was involved in a personal legal matter regarding planning permission, and needed to attend a court hearing. To do so, she requested a day of annual leave from her law firm, Lanyon Bowdler, giving the need to take a relative to a hospital appointment as the reason for her leave.
Incident Details
Her employer approved the leave. However, the employer later discovered the actual reason for her leave was to attend a court hearing where Cheshire East Council was granted an injunction against her for planning breaches on land she occupied. A week after the leave, the law firm was notified about the court hearing, prompting an internal investigation. From the Law Gazette article and the Solicitors Regulation Authority (SRA) online record of the case, we don’t know exactly how the employer came to learn about the court hearing.
During the investigation, the trainee provided a “statement of truth” claiming she only learned about the court date at the last minute, necessitating a change in her plans. She also submitted a doctored hospital appointment letter to support her claim. The investigation concluded that Merrill had acted dishonestly, leading to her dismissal for gross misconduct. The Solicitors Regulation Authority (SRA) found that she had acted without integrity and barred her from practice.
Data Protection Considerations
This case raises important questions about data protection and the handling of employee data regarding annual leave:
- Lawful basis: Why did the trainee solicitor provide a reason for her annual leave in the first place? Did her employer have a policy of requiring reasons for leave, or did she volunteer the information herself? She wasn’t new to the organisation (she’d worked there for a while before starting her role as a trainee solicitor) but as she was in a junior role, did she feel she had to give a reason, or was she asked? Neither is appropriate – there is no clear lawful basis for even asking an employee about their plans for their leave.
- Transparency and Fairness: Employers must be transparent about why they collect certain data and how it will be used. Employees should be informed – usually via an Employee Privacy Notice – about their rights and the employer’s obligations under data protection laws, and the lawful basis for the processing of their data by the employer. Again, if the employer was asking, or implying the employee should tell them, about her reason for taking a day’s leave, they had no clear lawful basis.
- Integrity and Trust: The case underscores the importance of integrity in both employee conduct and employer practices. Of course the employee shouldn’t have lied (and definitely shouldn’t have shared her relative’s health information in a doctored letter!) but her employer shouldn’t have put her in that position. If she hadn’t been asked, or she simply said “it’s a personal matter” or similar, she likely wouldn’t have ended up being barred; there was nothing in the SRA record that suggested she was barred because of the planning permission matter, but only because she lied about taking a relative to hospital.
Lessons Learned
- Review Policies: Employers should review their annual leave policies to ensure they do not infringe on employee privacy by requiring a reason for leave.
- Data Minimisation: As always, #StartWithPurpose and collect only the data that is absolutely necessary for the specific purpose and identify – and communicate – a clear lawful basis before collecting the data.
- Training and Awareness: Both employees and employers should be trained on data protection principles – as this case shows, even lawyers sometimes overlook data protection law!
This case serves as a reminder that data protection is not just about securing data but also about ensuring that the collection and use of data are justified and lawful in the first place.
Feel free to share this case study with your HR colleagues to start the conversation around employee leave requests. If you have any further questions or or comments, give me a shout! Clare@cpdataprotection.com