One thing we often get asked is if a meeting can be recorded and if so do we need to tell the employee. Assuming what you describe amounts to personal data processing, the employee who raised the grievance created the data, but the employer will become a processor of that data when it receives it from the employee and controller of the data when it uses it during the grievance process (in so far as it has to determine "how" and "why" it will process the employee's recording). In doing so, the employer will need to comply with its data protection obligations in relation to the data.
There are competing employment law and data protection rights in the situation you describe (between the employee bringing the grievance and the employees who were recorded). The employer will need to consider those rights on the facts when deciding how to proceed, in particular its obligations to the recorder as well as the employees who were recorded. If it's sensitive personal data belonging to any of the employees, there will be additional obligations. For a similar situation of competing rights, albeit in relation to a data subject access request.
The employer will also need to take into account whether the employee who recorded the conversations is happy for the recordings to be disclosed to the supervisors or not. If the recorder wants to rely on the information, meaning the employer has to process it during the grievance, then the employer would have some obligation to disclose it to the other managers. Setting aside GDPR, from an employment law perspective it would be hard to conduct a proper grievance investigation if they didn't disclose the recordings.
Furthermore, if the grievance results in disciplinary action being taken against the supervisors, the question arises as to what extent the supervisors should be entitled to see the documentation relating to the grievance. However, if the employee says that they do not want the recordings disclosed (bearing in mind they are their personal data too), then the employer may be in the position of needing to disclose the recording to the supervisors even though it cannot rely on consent under Article 6 to disclose them. It would therefore need another ground for processing the data (that is, disclosing it to the supervisors) under the GDPR and may wish to consider if there is an exemption that would apply.
It may be that exemptions to having to fully comply with the GDPR are available to the employer. As personal data in the recording needs to be processed in connection with the grievance proceedings and potentially, a tribunal claim, it could consider whether paragraph 5(2) or (3) of Part 1 of Schedule 2 to the Data Protection Act 2018 applies to exempt them complying with the GDPR provisions listed in paragraph 1 of Part 1 of Schedule 2 (the "listed provisions"). These include Articles 13 and 14 of the GDPR and the requirement to provide the supervisors with information about the processing of any personal data concerning them, in the employee's recording.
The controllers will still be obliged to comply with the lawful processing requirement under Article 5(1)(a) of the GDPR and they will require a legal basis under Article 6(1) of the GDPR, to legitimise the processing of the personal data. Legal bases to consider are:
There is also the issue of whether having made the recordings is a breach by the employee of their data protection obligations and whether by disclosing them the employer could be exposing them to problems, although we flag this purely for completeness and doubt that will be a good reason for the employer not to comply with its own GDPR obligations.
Call us now on
Partners Employment Lawyers is not a firm of solicitors. Members or Partners Employment Lawyers are consultants at Excello Law Limited and legal services are provided by Excello Law Limited which is authorised and regulated by the Solicitors Regulation Authority under SRA number 512898 https://excellolaw.co.uk/