GDPR in Employment Disputes

The access request is the discovery tool of Irish employment law. How data rights and workplace disputes actually interlock.

Employment disputes are fought on documents the employee has usually never seen: the personnel file, the investigation notes, the emails between managers, the occupational health referral. Data protection law hands the employee a key to much of that room — the access request — and imposes duties on how the employer gathered the material in the first place. Practising employment law and data protection together, we use each side of that equation daily.

The access request as preparation

Before a grievance escalates, before a WRC complaint issues, before a severance negotiation concludes — an access request maps the terrain: what the file actually says, who said what about you and when, whether the process followed the policy. Employers know this, which is why requests arriving mid-dispute are sometimes met with delay or dubious exemption claims; the dispute does not suspend the right, and enforcement through the DPC or the courts remains available on the ordinary timelines.

Framing matters: a request targeting the relevant systems, custodians and period — the investigation file, communications between named managers concerning you, the referral correspondence — is harder to fumble than 'everything', and faster to fight over when fumbled. Legal privilege will lawfully shield some material once litigation is genuinely in prospect; it does not shield the ordinary personnel record retrospectively.

Investigation files and how they were gathered

Disciplinary and grievance investigations generate personal data at speed — statements, interview notes, monitoring extracts, CCTV stills — and both fairness law and data law govern the file. Two questions recur: was the evidence gathered lawfully (covert monitoring and repurposed CCTV are the usual vulnerabilities — see our monitoring and CCTV guides), and has the employee seen what is being relied on? An access request pointed at the investigation file tests both, and material that was unlawfully gathered or unfairly withheld weakens the process it was meant to support.

References

Irish employers generally have no obligation to provide a reference, and many give bare confirmation of dates and role precisely to limit risk. Where a reference is given, it must be accurate and fair — and it is the subject's personal data, so the departing employee can seek access to what was written, subject to the balancing of the referee's expectations. In settlement negotiations, an agreed reference schedule is the clean answer, converting a data protection and defamation risk into a negotiated document — standard practice in the severance agreements we handle.

The WRC and data protection remedies together

A workplace episode frequently infringes both employment rights and data rights: the unfairly obtained footage that founded a dismissal; the health information circulated beyond need during an absence process; the file disclosed to people with no role. The WRC route addresses the employment wrong; the data protection routes — DPC complaint, court claim for damage — address the data wrong. They are separate remedies with separate tests and clocks, and running them coherently, rather than letting one prejudice the other, is where combined advice earns its place.

Frequently asked questions

Can I make an access request while my disciplinary process is ongoing?

Yes — a live process does not suspend your rights, and the request is standard preparation. Specific material may be withheld under exemptions such as legal privilege, but the request must be processed on the normal timeline.

Is my employer allowed to withhold the investigation file?

Not wholesale. Exemptions apply to particular documents — privileged advice, other people's data requiring balancing — but the ordinary investigation record about you is your personal data, and fair procedures separately require you to see what is relied on against you.

Can I find out what my old employer said in a reference?

You can seek access to a reference as your personal data, subject to balancing of the referee's position. The practical route in exits we negotiate is an agreed reference schedule, which removes the uncertainty entirely.

The disciplinary evidence came from monitoring I was never told about. What are my options?

Challenge it on both tracks: within the process and any WRC claim as unfairly obtained, and as a data protection infringement — with a DPC complaint or damages claim where harm resulted. The two remedies run separately and should be coordinated.

Does a WRC award stop me bringing a data protection claim?

They are different causes of action with different tests, though overlapping compensation for the same loss will be scrutinised. Sequencing and settlement wording matter — advice before signing anything is the safe rule.

Talk to a GDPR solicitor

Mary Molloy Solicitors acts for individuals and organisations across Ireland on data protection matters — access requests, breaches, compensation claims, complaints and compliance. All enquiries are handled through our Dublin office.

This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.