First Choice Selection Services Limited – Complaint Upheld (United Kingdom, 2021)

The controller is First Choice Selection Services Limited, a recruitment consultancy ('FC'). In May 2020, the data subject made an access per Article 15 GDPR to the company, requesting: # "All documents sent by [redacted] to First Choice staff; # Any document sent by FC to any third party, including a list of third party agencies to whom FC have disclosed their personal data and a copy of the information FC have disclosed; # Any document sent by a third party to FC; # Any telephone audio file and any audio file or telephone transcription between First Choice and a third party; # All meeting notes whether [they were] present or not. # [Their] complete Personnel Dossier; # Where there has been any event in [their] history over this period from September 2017 to May 2020 which has required manual intervention by any person, [the] disclosure of any indication or notes which have caused or resulted in that manual intervention. # A Genuine copy of any notice of fair use of my data as required by the Data Protection Act 1998. # Copies of all relevant First Choice company procedures and processes. # Total number of shifts worked by [them] at F choice, ## Total amount paid to [them] for those shifts (before and after back pay). ## Please provide the total amount paid to [them] in holiday pay ## Please provide total hours of holiday pay paid to [them]. ## Please provide the calculations used to calculate that holiday pay ## including rates of pay per hour and total. ## Please refer to the exact excerpt relevant text from Ts and Cs." The data controller refused to comply with this access request, on the basis that they had been instructed by the Employment Tribunal "to release no information at this stage and as part of the ongoing case we will be instructed to release appropriate documents to [the Data Subject] as required for the case." The data subject complained to the ICO. The ICO held that First Choices unlawfully failed to comply with the data subject's acces