We featured the following article in our recent 2018 Newsletter Issue 2 and since GDPR has been such a hot topic over the last few months, we thought it would benefit our readers, to feature this information in it’s own blog post too.
The table below has been constructed as a guide for employers, outlining their obligations to retain employment data as per certain employment statutes. It is recommended that employers use these statutory retention periods as a guide for the minimum period of time the relevant employee data should be kept. In most cases, the most relevant criteria will be how long the records may be needed to defend against any potential claims.
PERSONAL INJURIES CLAIMS
For example, in the event of a potential personal injuries claim, relevant records for the purpose of defending such a claim would ideally be available for a three year period. A potential breach-of-contract claim would require retaining the relevant records for seven years from the date of breach.
If the claim is specifically threatened or issued, then the employer may hold the records for longer, as is necessary.
In practice, most employers delete former employee data at some point after the end of the minimum required statutory period, but long before the expiry of a seven year period (six years being the period within which an employee could issue a breach-of-contract claim plus one year for the period of time they are allowed to notify the employer of it).
There is no exact science in respect of determining the retention period appropriate for an individual organisation, as it involves a balancing of the data protection risk (ie, of not keeping data for too long) against the risk of being sued by an employee before the expiry of the relevant limitation period.
As such, the recommended approach to satisfy both Irish employment law and GDPR requirements would be to retain the data for the statutory minimum required period. In circumstances where at the end of that period the employer is still concerned about a particular employee bringing a claim, it is recommended to extend that timeframe (to up to seven years). However, in most instances, unless an employee has issued proceedings within the statutory minimum period for bringing a claim (usually six months), the likelihood of a claim is not very high.
The exception to this is occupational injuries claims. It may be projected that employers will develop a practice of reviewing employee data on a regular or annual basis, for example, and, if there is no good reason for retaining such data, such information or any unnecessary element of it will be routinely deleted.
Article by bryan.dunne@matheson.com