Topics covered in this month's webinar include:

• Discipline and Grievance
• Redundancy
• GDPR
• Sickness Absence

Scott Alexander, Head of Learning and Development at Legal Island, discusses your Northern Ireland employment law questions and topical HR issues with Seamus McGranaghan and Hannah McGrath from the employment team at O'Reilly Stewart Solicitors.

Questions in this webinar include:

• If a panel, either a grievance or a disciplinary panel, makes a mistake, which is discovered after the outcome letter has been sent to the employee, what recourse does the employee have to reconvene the panel to correct the mistake?
• Can you advise what is deemed to be a reasonable amount of time for a first formal written warning on an employee record? Is 12 months deemed excessive?
• If a redundancy situation arises and the post-holder is on maternity leave, can they be made redundant?
• Does commission need to be factored in when calculating redundancy payments?

Don’t forget to visit the ‘Seamus Says – Employment Law Discussion’ section on the employment law hub, which provides answers to over 130 employment-related questions addressed throughout this webinar series.

Log in to watch the recording and read the full transcription.

Transcription

Scott: And welcome to the webinar with O'Reilly Stewart Solicitors. We have Seamus McGranaghan and Hannah McGrath. We're going to be dealing with a number of questions today looking at discipline and grievance, redundancy, and GDPR.

If you have any queries at all, please send them through the little message box that you'll see on your screen and we'll try and get through as many live as we can. At the end of this, you can listen back to the stream on the website. It should be up this afternoon I would hope, and then we'll have a transcript ready in a week or two as well that you can access through the resources section and through the section on the website that has the O'Reilly Stewart webinars in it.

Discipline and Grievance

So we're going to start off here, Seamus, with a question on discipline and grievance.

If a panel, either a grievance or a disciplinary panel, makes a mistake, which is discovered after the outcome letter has been sent to the employee, what recourse does the employee have to reconvene the panel to correct the mistake?

And this could be because they perhaps strayed outside of their terms of reference, or more importantly, if they come up with a decision which is contrary to law, and by implementing the decision would mean a breach of law.

Seamus: Well, the question itself is in two parts, and just taking the first part, really, where it asks if there is a mistake that has been made. So, often, whenever there's any outcome issued by an employer, the employee might not always agree with the outcome and the employee could classify it as being a mistake or that it's incorrect. And it would be the usual processes that would be open. We're unsure from the question whether this is a decision that has been issued after an appeal, but certainly usually after the first process, the outcome, there will be a right to appeal.

Scott: So if it's an appeal, in effect the employee would say to the appeal panel, "Look, there's been a procedural error here that has to be rectified". And there are loads of case law by how an appeal panel could rectify that: by reconvening, do the whole thing properly again, making sure that those changes are done.

But assuming that it is an appeal process or a final internal one here, there's been a mistake, the employee can't reconvene the panel. The employer reconvenes a panel. What else might they do, the employee, or what would their approach be?

Seamus: The gift here is in the employer's hands. If the employee comes back and raises an issue in terms of the outcome, the employer should consider that attitude. You know, it shouldn't just say, "Well, look" . . .

Scott: "The process is finished".

Seamus: . . . "we're done here. Sorry", and close the door to it. I think that there should be a consideration of it. Because ultimately, the employer wants to keep itself right. And specifically, you know, there's reference here to the terms and conditions of the terms of reference that are provided to the panel at the time, just to ensure that they have kept within those.

As you'll be aware, there are some circumstances where you will start off in a process in the terms of reference may widen. But that should always be . . . it shouldn't be a shock to the employee. That should be notified. And often, you might need to go back a step, first of all, and then reconvene in the terms of your panel. But ultimately here, the employer is the one that needs to take this on board.

If you've been through the appeal process and it's really come back to your contract of employment, it depends on the industry and on where you work. Sometimes within these contracts there will be a final right of appeal to, for instance, the Labour Relations Agency's Independent Appeal Tribunal. There's a possibility to go there. Alternatively, you may wish to raise a grievance at this point, and the employer as code of practice from the Labour Relations Agency, is always obliged to take the grievance and to investigate.

It could be that even though you've been through a disciplinary process or even if it has been a grievance, ultimately you're going back with a final complaint. And it may be that you're sending the final complaint to the ultimate authority within the organisation, whether that's the MD or the chairperson, whoever it is.

There also could be recourse that if your decision has come from one of the statutory bodies, whether it's the Labour Relations Agency's Independent Appeal Tribunal or if there's some sort of right of appeal to a regulator, for instance, you've always got the right to look at the possibility of a judicial review. The judicial review is based on the public authority's decision, so you need to be careful that you're covering your bases there, but it may be that you're looking at a request for judicial review.

Scott: I suppose the point here is if there has been a genuine mistake or somebody has made some kind of ultra vires decision, say outside the terms of reference or whatever authority the individual has, it's in the interest of the organisation to get the right decision, because ultimately, it could be appealed to the courts or tribunals. And the courts and tribunals are going to look pretty askance at an employer who says, "You know what? I'm going to ignore all this extra evidence that, I'm sorry, we didn't have".

It may, ultimately, in an unfair dismissal, make little difference to the tribunal decision if it came at tribunal because it's the decision of the employer at the time. But if somebody points out, "You can rectify this quite easily. Just give me another chance here", then it would be maybe a silly employer who wouldn't at least look at that.

Seamus: Absolutely. And, you know, there are times where we can always become a bit thran with our decisions, particularly whenever we believe that we're correct and we've done the right thing. But that doesn't necessarily always mean that it's lawful. So it's important to obtain advice in circumstances like this.

And certainly, you know, if I was advising a client and there was a standout problem in the process, I would be telling the employer either, "Look, take it back a stage, reconvene. Alternatively, look at setting up a new panel, or work around it in order to try and save the hassle and the costs of legal proceedings".

And it may be, you know, you can be very right there that the relationship has gone at this point because the trust and confidence maybe from the employee's point of view has left because of the fact that there's been such a breach if they have acted outside of their remit. But ultimately, it would be best in those circumstances, where there is a breach of the process, that steps are taken by the imparts the sensible route and prudent route to try and rectify that before it would move into the legal arena.

Scott: Okay. Thank you very much, Seamus. We should point out that question wasn't sent in by the former Secretary of State of Defence. No idea. These are all anonymous, but I just want to clarify point for listeners.

Can you advise what is deemed to be a reasonable amount of time for a first formal written warning on an employee record? Is 12 months deemed excessive?

Hannah: Well, basically, there's no set timeframe that you should put down for your warnings. What we do generally look through is that LRA Code of Practice on disciplinary and grievances. And what they have laid out in there is, for verbal warnings, they put an example of six months down. And for written warnings, they put an example of 12 months down. And if anything occurs within that time, then you take a further action on that. So, no, I don't think 12 months is excessive for a formal written warning on that.

Seamus: I think just in addition to that, it's always important to look back at the contract of employment. Sometimes you'll have a handbook or a disciplinary policy and procedure, and it will set it usually within the timeframes that are applicable for the disciplinary and sanctions that are provided.

My experience, certainly, I don't think for a formal written warning, whether it's the first occasion or not, it's irrelevant to that. Twelve months is the norm as I would see it.

There are circumstances sometimes where employers, certainly at the other end of the scale, where they're taking a step back from dismissal and they may say at that point, "Well, look, rather than giving you a 12-month period here, we're going to extend it to 24 months". And then you look at the contract of employment and they won't have the power or the ability to do that. But ultimately, in those circumstances, an employee who has been given an extra life in terms of employment isn't really going to make a complaint about that.

So there are times where the employer does step outside of those realms, but really it should be in the contract of employment. And you should be looking at what the guidance is in the contract of employment for the penalty that's going to be applied and how long that's going to apply for.

Scott: I remember years ago when I worked for the Labour Relations Agency dealing with an employer where the union had negotiated a three-month warning. And so, you had all these guys who would work the system and they'd get up to a final warning, keep their nose clean for three months, and then it'd all start again, the process. It was way too tight.

Yeah, 12 months seems reasonable for written warnings. Maybe for oral warning, six months, as it says in the Code, would be more reasonable, as you say.

Redundancy

If a redundancy situation arises and the post-holder is on maternity leave, can they be made redundant?

Hannah: So, yes, you can make someone redundant that's on maternity leave. But if you're making that person redundant because they're pregnant or they're on maternity leave, then that will be discrimination. It'll be unlawful.

So how do you go about making a person on maternity leave redundant, I suppose, is the question then? What you need is that you're going to have a genuine redundancy situation that you haven't artificially, you know, engineered this redundancy. And that comes about with your usual . . . your financial problems, you need to cut staff, or reorganisation of the company.

Even though that employee is maybe out of the office on maternity leave, you need to consult fully with that employee. You might find that that employees happy to come into the office for meetings. They could use it as their keeping-in-touch days to come in. However, if they aren't, you could go to their house and discuss it with them or maybe a telephone call, but they need to be fully consulted as to what the situation is that's going on here.

And I think the next point that is quite important is how you're choosing the people for redundancy. You need to ensure that your selection process or your matrix that you're using isn't disadvantaging someone that's on maternity leave.

Scott: Yes. So you're not going to take into account absences. It's maternity leave.

Hannah: Yes, exactly. For example, they haven't met their targets and they've been off on maternity leave. How could they? They weren't there. So maybe what you have to do there is go back to their previous year and see if they were meeting their targets before that.

And then, as with all redundancies, you have to look at alternatives. And, you know, it's a suitable alternative position that would be available, and the person that's pregnant or on maternity leave will get first choice as to, first offer, as to the alternatives that are there.

Scott: So it's very difficult, really. Like you say, it can happen. In reality, it's difficult for two reasons. One, because they've got the right to go back to the same job ordinarily if they're in the first period, and they've got the right to go to something which is not substantially different. So they would come quite high in the pecking order there.

You've also got the situation that on the face of it, if there's really only one redundancy or one or two redundancies and it's the maternity one that goes, it looks like sex discrimination. So the employer has to be doubly careful.

Hannah: Need to have everything sorted before you're going to make that move.

Scott: So the real answer, don't do it.

Hannah: If you want to do it, make sure you've got everything recorded. You've got your reasons why you're doing it, and you've gone through it meticulously.

Seamus: Certainly, in past experience, you would be very concerned about a sudden redundancy that would arise for somebody that is on maternity leave. And often, you get circumstances where somebody goes out of their place of work for a period of time, and all of a sudden, the employer thinks, "Well, you know, I didn't bring anybody in to do that job. And I could really do without this role because while this person has been absent another employee has been able to pick up the work".

Those circumstances can arise and you just need to be very careful specifically if you're picking out the one role and it just so happens that that person is on maternity leave.

I think it's easier to do whenever there is a group of redundancies and people are being pooled together as a result of their possessions. You can satisfy the test much easier there in those circumstances where you're saying, "This is a genuine redundancy".

My view would be I think that you would always approach any sort of a redundancy while someone is maternity leave with caution. And ultimately, you may want to look at trying to compromise the circumstances, whether that's with the assistance of the Labour Relations Agency or whether it's fair compromise agreement itself. But I always tend to take the cautious route with everything.

Hannah: I think the other point on it is also, you know, actually making redundancies. When a company is trying to figure out, "What can we do to help just to avoid this situation?" essentially, if anyone that's on a fixed-term contract that's on maternity leave or pregnant and you decide, "Oh, well, we'll just get rid of that. That will be cutting a cost. We'll get rid of that person at the of the fixed-term contract", if the reason that you're getting rid of that person is because they're pregnant or on maternity leave, then you're going to be in the same situation and there's discrimination there.

Scott: There's any number of cases come up and tribunals north and south of the border. You see them all the time where women on maternity leave get dismissed. Quite a lot, it's because the replacement turns out to be better than the one that was there.

Seamus: Yes, it could happen.

Scott: This had nothing to do about the pure performance, if you like, of the woman who went off before she went on maternity leave. And so, you get somebody else that comes in and highlights maybe an issue there. And it just looks like sex discrimination, and it's found to be sex discrimination 9 times out of 10. So it's a very dangerous thing to do.

Seamus: I mean, the antenna of any tribunal panel is going to be up immediately. And they're going to be looking to . . . I think there's almost an extra layer that's put on to the employer to really justify that the situation whenever you end up in a tribunal case with it.

Scott: Thank you. You're listening to Seamus McGranaghan and Hannah McGrath from O'Reilly Stewart. I'm Scott Alexander. I assume we've had a question in there about GDPR. We have a couple of redundancy questions first, and then we'll get down to GDPR because we have a few GDPR questions coming in. But if you do have any questions, please send them in.

The next question, I think, is going to Seamus.

Does commission need to be factored in when calculating redundancy payments?

Seamus: Well, this is another interesting one because there can always be a view taken whenever you're looking at redundancy that you're calculating the standard statutory position. So you go online and you work out what the statutory redundancy is, and then you'll factor in, including the holiday entitlement, and you'll look at the notice period, and then you'll think about after that, "Well, we need to think about the holidays", and then finally you'll come along the line to thinking about maybe bonus entitlement.

And certainly, the bonus is different to what commission is. And again, that's about going back to the contract of employment. If you are receiving a regular commission payment, your redundancy should be reflective of your actual pay that you receive.

Scott: You're looking at normal pay.

Seamus: Normal regular pay is what you're looking for. So if the commission payments are made on a monthly basis, and on the pay slip, it's fairly regular that the commission payments are included within that regular pay, then yes, it should follow in as an ordinary redundancy. It's part of the redundancy payment itself.

And that's similar to what we're looking at in terms of the movement of the law and the progress that the courts have made. Whenever we're coming to look at things like, you know, regular payments in terms of holidays, it's reflective of what the normal position is.

I think it's different if you're getting commission on a bimonthly basis or every six months and it looks more like a bonus payment at that point. You really need to go back and look at what the terms and conditions of the contract will say and whether the contract says that your bonus is included at the time of . . . if there's still entitlement remains for that. But certainly, for commission payments, I would see them as if they are regular payments that are made whenever salary is paid, then they should absolutely factor in with your redundancy payments at that point.

Scott: You could probably argue regular overtime payments will be the same whether it's contractual or not.

Seamus: Absolutely.

Scott: Giving the way that the holiday situations . . .

Seamus: Yeah, given the way that everything is developing . . .

Scott: Although I suppose they only apply to the EU holidays. But, you know, at the same time, I mean, normal pay should normal pay. If you normally get 300 quid a week then you should be getting redundancy at 300 quid, subject to any limits, of course, statutory limits on payments at the moment.

Seamus: Yes, that's it, and that can be a difficult one for the employer to swallow. And certainly, when you're giving advice . . . we mentioned this earlier on. You're not always giving advice that the client wants to hear. But when you're giving advice to a client that's dealing with redundancies and if they're dealing with redundancies as a result of, you know, trade reasons or that there's been a downturn in business, they're not looking to enhance payments in any way. They're looking for savings.

But ultimately, you know, they need to look at what the regular payments are, and you can very easily do that by just looking over the past number of payments that you've made.

Scott: Following up with just that question:

If commission is noted separately on a payslip, I would assume that this wouldn't be included in redundancy. I'm not sure that's the case. It's just a separate payment.

Seamus: No. I mean, it depends on the commission that you're talking about. If it's commission that is a regular payment, if it's a commission that is . . . you know, if I work in a shoe shop, and if I'm selling shoes and I get commission on every pair of shoes that I'm selling, and that forms part of my monthly salary at the end of the month, whether it's noted separately on the pay slip as commission or not, for me, that's still a regular payment.

Scott: You'd have to do an average of the wage. And under the Employment Rights Order, you would look at the last 12 weeks to see what the average wage is. Whether it's separated out or not is neither here nor there.

Seamus: Yeah. And that's very easy for the employee to do also.

Scott: Okay. We've had another question in there:

Where there is a fixed term contract covering a career break, which exceeds one year. At the termination of this contract, is the person entitled to redundancy?

Well, having been there two years. Even though the post is not redundant, but the person is redundant. Presumably, it is a dismissal.

So I think what they're saying there is, A, there wouldn't be a redundancy payment because they haven't been there two years. But if the person comes back and is being replaced, technically, there's no redundancy because you still need the same number of employees.

Seamus: Yeah, it's not a redundancy situation. And the other thing, as well, is in those circumstances, always remember that you need to follow the statutory dismissal procedure . . .

Scott: In Northern Ireland, yeah.

Seamus: . . . even if they are a temporary worker and you're saying, "Well, look, they're just coming to the natural end of their agreement and it was extended out by a month", or whatever it is. You still need to follow the 1-2-3 procedure there on that.

Scott: We've discussed this before, but there's a number of employers in Northern Ireland get quiet because it advised by GB-based firms who don't realise, A, you need one-year service, and, two, fixed-term contracts are covered by the statutory procedures in Northern Ireland.

Seamus: Yes.

Scott: So moving on to the last redundancy question we have here and then we'll move on to . . . there's one or two other things coming in, but we'll move on to GDPR after that.

If, during consultation for redundancy, 10 employees agree to a pay cut to avoid job losses, but one employee does not agree, so there are 11 employees in total, can I select that person who stands out for redundancy?

Seamus: The short answer is no, absolutely not. And I think if you think around the issues on this, you have 11 employees here in total. There's possibly been an approach by the employer in advance of commencing a redundancy, a formal redundancy procedure, where they said, "Look, as a way here to avoid redundancies, can we look at a pay cut?" And you've 10 of the employees saying, "Yes. Okay. We'll agree to that", and you have one that say, "No, I can't agree to that".

I suppose that is absolutely the right of that employee to say that they are not prepared to agree to it. And we can't prejudge what their reasoning may be for not accepting the pay cut. It may be just simply that their circumstances don't permit them to do it, and they're happy to take the roll of the dice in terms of a redundancy process.

But there could be a number of issues arising there and you and you really wouldn't want to prejudge it, and you wouldn't certainly want something arising that would result in a claim for any type of discrimination coming out of that.

So I think, you know, ultimately there, if you have the 11 employees, 10 agree, and then you say, "Well, look, you didn't agree, so I'm going to make you redundant", I suspect that the position is that isn't a genuine redundancy situation because you're probably going to replace that . . . even if you're cutting the pay, there's still work there for 11 employees and you're going to have to replace that person. So it's not, in my eyes, a genuine redundancy situation.

There are options there. And I did have similar circumstances in this a number of months ago where a client of mine had circumstances where preferably they wanted a cut in salary by 10% for a period of time, and it was a defined period of time, because there was a downturn in business, but business would pick up again later in the year. And we had one employee who said, "No, I'm not prepared to do it".

And this resulted in a bit of a messy situation where the employee later came and made allegations that he was being bullied and harassed by his fellow employees, including his manager, because he refused to accept this cut.

So ultimately, you know, the protection is there for an employee legally, that the employer cannot unilaterally amend terms and conditions of employment. So it's not possible for the employer to come in and make a decision to say, "I'm simply cutting your salary". That will result in a fundamental breach of the contract of employment and potentially has the right for the employee to resign and to claim constructive dismissal.

Scott: Or just stand there and sue for their wages. Then they get dismissed because of enforced statutory right and it's automatically unfair dismissal. So you've got all kinds of issues.

Seamus: You can see the stone rolling down the hill for this.

Scott: So the safer situation here is, I suppose, two forms, what you're saying, Seamus. One, if you can get everybody to agree, that's great. If you can't, you put out to them . . . you give them new contracts. You know 10 are going to agree to it. You know one isn't and is dismissed for some other substantial reason, if you like, because you need to make cuts and they will not vary their terms of condition.

Ultimately, in this one as well, you could have saved the same amount of money, or the employer might have done, by seeking volunteers, but they would have ended up with fewer employees. And I think the situation here might just be that they can't afford the wages anymore.

Seamus: Yeah, that seems to be the issue. And certainly, if you think back to the time of the banking crash and the economy in 2006, 2007, a lot of employers took steps like this. And what they were saying was ultimately, "We need a workforce. The work still needs to be done. We're not as profitable as what we were. We can give you some job security in terms of the fact that we can retain you, but you're going to have to take the pain a bit and seek a cut in salary".

That works both ways. Sometimes it scares employees off and they say, "This is a sinking ship. I'm getting off. I'm going to look for other work". And then it's difficult to recruit other employees back in and you're retraining and everything else. Or sometimes it does work, where employees say, "Well, look, fair enough. Let's put our heads down here. Let's take the cut. Let's work hard. And let's get ourselves back up to where we were again". But certainly, I look at it as an unsettling period for any employee. You could see that.

And the prospect of the smart option that you read about all the time, but as a lawyer, sometimes you're very concerned that to take a step is to simply to dismiss and immediately issue the new contract with the terms and conditions or not.

And at least from that point of view, if the employee resigns, and the employee then brings a tribunal claim, you can say to the tribunal in terms of litigation, "Look, they were offered a post here, and the loss is substantially reduced because they refused to accept that". And they are then going to have to give the evidence to the tribunal to explain their position as to why they weren't prepared to do it.

So it's swings and roundabouts very much in this one, but ultimately best if you can get the consent. And the best way to do that, it's about the presentation. It's about being open and transparent. And there are circumstances where companies will provide copies of their accounts. They'll show their P&L and they'll demonstrate that to the employees to give them a clear understanding.

It doesn't always work. Sometimes employees can be very sceptical. And they'll say, "Well, look, there's the MD driving in his brand new Rolls Royce", or whatever it is. "Why are we taking a pay cut?" But, ultimately, you can't sacrifice one for the betterment of everybody else in these circumstances.

Scott: Well, the Rolls Royce isn't cheap. They're not cheap to run.

Seamus: Maybe a bad example of that one.

Scott: Yeah. Legal-Island, we circulate all the P&Ls every week to everybody. Everybody knows if we're doing well or not well and where we're going to be. So it shouldn't come as a surprise if we say, "Look, we're going to have to tighten here, or make savings, or do something and work together", or, "Hey, we're doing really well. Let's have a bonus". I think that kind of openness with employees does mean that you bring people together a lot more. So it's more of an HR issue.

And maybe in this one here, there's a lack of trust. Or it could be, like you were saying, there are personal circumstances there and they cannot afford the cut. If they can't afford the cut, they might find themselves at work anyway. Such is life.

You're listening to Seamus McGranaghan and Hannah McGrath from O'Reilly Stewart. Our next webinar . . . we've still got 15, 20 minutes to go, but our next webinar will be on the 7th of June. Again, always at 11:00. So tell all your friends. You can all listen in if you have any questions.

GDPR

Do you need to get signed consent from prospective employees when checking references? And if so, when is the best time to do this?

Seamus: Well, this has come around basically because now we've got the new regulations in place and everybody is very concerned and uptight and thinking that we need consent for everything that we need. We need written consent and that's it. And certainly, yes, that's a prudent way to work, but at times it can be very unnecessary to have to think that you need written consent all the time.

Scott: That can be withdrawn anyway. Let's not use it if you don't have to.

Seamus: That's it. And I think this question . . . I mean, I can understand why somebody is asking. I can't understand why they would be concerned. But I don't think that there's a necessity to obtain express written consent in terms of this. This is a prospective employee, so they've come across the job advertisement. They've put an application form in respect of the job, and I think you'd be very much reliant on the position that this is a legitimate aim in terms of, you know, the recruitment process. If that person provides details of a reference, I think it's perfectly fine for the employer to say . . . or the potential employer, I should say, to rely on that and say, "Well, they've given me the details and I can now approach that person for a reference".

Potentially, the onus on GDPR is more on the referee who's providing the reference because they are going to be given information out to a third party. Often, now, you know that the references are factually . . . they're factual reference. They're start/end dates and job title at the time of the request or the time that they left. But that still is personal information for that person.

But I think you could satisfy yourself fairly easily to say that this is a legitimate circumstance. We've had an application process and they've provided us with referee details. We've made the approach. And I think for the prospective employer, I don't see an issue in terms of them having to have the prospective employee sign a form or sign part of the application form to say, "I consent my . . ." I think if you were going to be very prudent about it, you could absolutely put that into the application form and say, "Sign here for the consent". But, personally, I don't think this is necessary.

Scott: No. There are issues we were chatting about earlier about where you get references early if you look at the time scale. You do it early in anticipation that you're going to have a shortlisting panel. And you want to get together so you do it. In the meantime, you end up offering one job and there are four or five people who don't get the job and you've got references for them. There's no need to keep those references unless you're going to hold the job open for a period.

Seamus: Yeah, that's right. I was looking at a recruitment pack that a client had put together. I was just reviewing it for them yesterday. In that, they were requesting the references at shortlisting stage. And my thought process was then around to, "Well, you're going to have a lot of unnecessary information, documentation, and personal information about the unsuccessful applicants".

But then whenever I was able to satisfy myself . . . because when I read on it, they said that they were keeping the job open for a period of time after the process had completed, or in case it didn't work out in probationary and that they would move on to the next person in line for the role.

And importantly, then, what they had in their policy was they had the details of that they would retain the documentation for 12 months on this occasion. And then they would, you know, safely dispose of the documentation in accordance with the regulations themselves.

And I think that's the key part, is that once the window was closed in terms of the recruitment process and the person has been appointed, and there's a period of embedding in, that you then dispose of all of the recruitment documentation and those references that you don't require. You put yourself, as we've said before, at risk of retaining documentation that you don't need. There's more chance of a breach happening if you're holding and retaining the documentation.

Scott: Okay. Well, just on that, Seamus, we had a question coming on the chat box there.

Must all HR processes be documented for GDPR purposes?

I suppose all HR processes that involve personal information or information that might identify an individual should be documented and certainly risk assessed.

Seamus: Yes. Absolutely. It's part of your audit that you're carrying out, and you shouldn't just do an audit last year whenever the regulations came in. You should be constantly setting a timeframe. I'm not saying you do it constantly, but you should set a timeframe to look at your audit and go back through the documentation that you're retaining, how you're retaining it, the purposes that you're retaining it for.

And as part of that process, then absolutely, you should be carrying out your audit and making sure that you're not retaining anything that you don't need to retain, or that you are making sure that you're making the correct accordance that you need to do.

Scott: We'll maybe skip on the question there, Hannah, because we have a question in about DPIA, Data Protection Impact Assessments, and it kind of ties into that question from the listener just now about assessing processes and risk and so on. So the question here is,

Should you still conduct DPIA if there is merely the potential for the processing of personal data and processing is ancillary to the main activity?

Hannah: So your data protection impact assessment is a new obligation under GDPR. And it's basically a requirement, you carry out a process to analyse the processing and try and minimise the risk. It's about personal data where there's likely to result in high risk to the interests of the individual.

Scott: The individual, the data subject.

Hannah: Yes, exactly. And that high risk is then assessed on . . . you have to consider the likelihood and the severity of the impact should it be leaked or there are issues there, and that impact of potential harm to the individual. So I think where you've got situations where you're big company and you're regularly dealing with personal data, then you should be doing your DPIA.

Scott: It doesn't matter that it's ancillary though, because it's the number of people. So you could be . . .

Hannah: It could ancillary and high risk.

Scott: we’re a business in St. George's market and selling lots of fruit and veg, and all kinds of stuff, fish. So that's not data. That's not personal data. That's not covered. But if somebody were to change the process about working out who has stalls and it's got the details of them, it's got their account numbers, it's got various things, even though it's ancillary to the main purpose of St. George's market, if you're changing your process, you would have to impact access what you're going to be doing there.

Hannah: Yes, exactly. And that impact assessment, even if it's an ancillary, the impact should something happen could be very high. So there's a substantial risk there. And under that DPIA, the requirement under the GDPR is if that risk is so high and you can't do anything to minimise it, then you have to go to the ICO and get their advice on it and report it to them.

So I think even if it's ancillary, it doesn't necessarily mean that the impact of it is going to be nothing. And so, you should be carrying out your risk assessment on it. And I think, you know, even if you're a big business or small business, you can scale down the size of the impact assessment that you're doing to fit the circumstances.

Scott: Yeah. We had a discussion earlier as well about health records. So if you go back to all HR processes, HR health records are very personal, very sensitive information, a lot more personal than my job title, for instance. And I suppose the HR department should really think about, "Should they be kept under a different system?" So you're looking at the impact of losing those health records might have on the individuals compared to losing some other bit of personal information about my job and what I do, or a job description, which is fairly freely available. And you really do have to look at those.

There are additional requirements, that you keep manual files. Well, who gets access to the locked cabinet? Do you keep it in a separate room? Are they encrypted? So, you know, you get those types of things that people should really be doing.

There was an additional GDPR question that came in there, just while we're on that type of thing, on encryption.

Is there any recommendation for HR professionals in relation to sending information via email?

And I suppose, again, it depends on the confidentiality, the sensitivity of the information.

Seamus: Absolutely. And, you know, the potential for human resource managers are that you're going to have medical records and you're going to have sick claims, occupational health reports, you know, very sensitive data. You may even have GP notes and records as well or part of them, so very sensitive things.

I mean, I think when you when you assess risk, there's a much greater risk of putting something in the post than there is to send it online, because at least if you send it online you can password protect the document. You can encrypt the document. We have a system in our office that we that we use to encrypt. And certainly, it's the practice now certainly between law firms that everything is encrypted.

You can put it on a disc and send the disc, and in a separate covering letter, provide a password for the disc to get access to the documentation. I think, certainly, from an ICO perspective, they're looking for you to adopt best practice in these circumstances.

There are times where it is just unavoidable that you have to put something in the post. Again, if it's put in the post, maybe you want to look at recorded delivery. Simple things like making sure that there's no information available from the window on the envelope. You know, complaints arise where the letter slips up into the end of the window and, you know, there's an identification of something within maybe the title of the letter.

I've certainly had clients that have contacted me and said, "I've got the documents that you sent me", and sent me a photograph of how they received them with the letter torn. And ultimately, I've said, "That's not my fault. We sent that out in the post and it's there". But we also have to reflect and look, you know, are the envelopes that we are sending the documents in robust enough? And should we be changing over to using those sort of plastic-lined bags and things like that?

Scott: That's the ones that I get from my college.

Seamus: Yeah. So you are looking at that. And ultimately, if there's if a data breach, and ICO are investigating that with you, the best way to protect yourself is to say, "I used best practice here. I thought around all of the issues". But I have no doubt now that the most secure way to send anything, if you're capable of doing it and it's feasible to do it, is to do it online, password protect, and encrypt.

Hannah: Password sent in different emails.

Seamus: Yes. That's another one that you get quite annoyed about. You're like, "What's the point in doing this?" But, yeah, that happens. And even silly things like putting a timer on your computer that your screen closes and freezes after 30 seconds or a minute of not being used, that might be a wee bit excessive. But it's all about being conscious of breaches and how they happen.

Scott: Yeah. The other thing that people get caught with emails is to send a chain where you've got this long chain and the confidential information is at the bottom and you haven't noticed it because you've been discussing it, and then you use an old email to discuss something else. And suddenly you're sending salary details to somebody. So it's probably best if you break the chain for each one where you can.

Seamus: A really interesting one that we come across, both Hannah and I will do a lot of sort of due diligence work for organisations in terms of maybe acquisitions and mergers or company and a lot of TUPE information will come across. And we will receive that documentation and it will be anonymised due to GDPR aspects. And sometimes it's so anonymised that you can't work from it.

You can't identify anything from it whatsoever. And you're going back and you're trying to give assurances to the other side to say, "Listen, there's a legitimacy to what we're doing here. I don't think that we need to go back to the employees to get consent because they're not aware even at this point that there's a potential that their employment is going to transfer".

So sometimes, you know, it's sort of the two sides of it. One, you can be very cautious and over cautious with the likes of consent. And then other times, you're not cautious and often every year thinking about these breaches that happen.

A classic one is always that the email is sent to the wrong person. And what we try to do in terms of that . . . we use a case management system. The email goes in at the start of the case management system. And you just click on the name. You don't type in an email or anything to try and stop that happening. But inevitably, it does happen.

And, again, whenever these mistakes happen, it's about risk assessment. It's about assessing how it's happened, making your reports to the ICO if necessary. And you're going back to that aspect of, you know, if it's a big company here, you're looking at your impact assessments. You know, €20 million, 4%-a-year turnover, it could be significant amount of money to be dealing with.

Hannah: And there is reputational damage and loss of trust as well.

Seamus: Certainly.

Sickness and Absence

A staff member has been off on sick leave for nearly four years. They keep handing in sick claims and have been invited to occupational health appointments to assess their health, but each time, they say they can't make it. Are we well within our rights as a company to pay this employee off now, as they have been given ample opportunity to attend appointments? Although they are not receiving sick pay, they are accruing and being paid holidays every year as they would be under the working time regulations.

Seamus: We get this question all the time from employers, and it does amaze me sometimes that appropriate steps haven't been taken by the employer to try and address the sick leave period.

Ultimately, look, it's always best, if you're talking about making a decision for frustration of contract or for an employee's inability to fulfil their duties and obligations under the contract, that you have medical evidence to support that. If the employee has been obstructive as refusing to attend occupational health, there are other ways around that. You could ask them for their consent to obtain a GP's report, which might give you a bit more information.

Ultimately, what you're asking for is, you know, can the doctor provide a date for their return, or confirmation that they're going to be able to return in the foreseeable future tends to be the language that you're looking for.

Scott: Assuming they've done all this, it's been four years. They've written off the people. They can't go there. They're saying, "Look, we have no evidence that you're able to return at all. You won't provide anything to us". Can they dismiss them?

Seamus: My advice would be that what they should do is arrange a welfare meeting with the employee. So they should write to the employee, first of all, and record the fact that they've asked them to go the occupational health.

Scott: I think they've done that. I think it's inferred in this question that they've done that.

Seamus: But you need to also make clear to the employee that their failure to attend occupational health will result in the company having to make a decision in terms of their future employment on the basis of the evidence that they have.

Before making that decision, I would arrange a welfare meeting with the employee at their home if they're not able to attend anywhere else, and that you're talking through those issues, and you're doing your best. You're not a medical practitioner, so you can't make those actual medical decisions, but you're making your decision on the availability of the evidence that you have. And ultimately, if what you're going on and you've done your very best and ultimately that's where you're at, that's the decision that you're making at the end of the day.

Scott: Okay. Thank you very much, Seamus. Whether it ends up as a dismissal or indeed a frustration of contract, we may find out next month if you tune in. Friday 7th June is the next webinar at 11:00 as ever. You'll be able to join on the website if you go to the events pages, or if you get the link through any of the email systems.

Thank you very much to Seamus McGranaghan and Hannah McGrath from O'Reilly Stewart. I will see you next time hopefully. Bye-bye.