# Standards and Regulatory References — Employee DSAR Response

## Primary Legislation

### GDPR
- Art. 12(1)-(4): Transparent information, communication, and modalities.
- Art. 12(3): Response within one month; extension of two months for complex requests.
- Art. 12(5): Manifestly unfounded or excessive requests may be refused or charged.
- Art. 15(1): Right of access — confirmation, copy, purposes, categories, recipients, retention, rights, source, automated decisions.
- Art. 15(3): Copy in commonly used electronic form.
- Art. 15(4): Right shall not adversely affect rights and freedoms of others.
- Art. 23: Restrictions on rights — Member State derogations for investigations, legal claims.

### UK DPA 2018
- Schedule 2, Part 4, Para 19: Legal professional privilege exemption.
- Schedule 2, Part 4, Para 24: Management planning exemption.
- Schedule 2, Part 4, Para 25: Negotiations exemption.

## Case Law
- Durant v Financial Services Authority [2003] EWCA Civ 1746: Definition of personal data in context of structured filing systems.
- Ittihadieh v 5-11 Cheyne Gardens [2017] EWCA Civ 121: Proportionate search obligation; not every email must be searched.
- Dawson-Damer v Taylor Wessing LLP [2017] EWCA Civ 74: Legal privilege applies to DSAR disclosures.

## Enforcement Precedents

| Authority | Reference | Fine | Issue |
|-----------|-----------|------|-------|
| ICO (UK) | Mermaids, 2023 | Enforcement notice | Failed to respond to employee DSARs in time |
| CNIL (France) | SAN-2022-009 | EUR 800,000 | Failed to provide access to performance data within one month |
| AEPD (Spain) | PS/00231/2021 | EUR 70,000 | Refused DSAR claiming disproportionate effort |
| AP (Netherlands) | 2022 Decision | EUR 525,000 | Incomplete DSAR response omitting email data |
| Garante (Italy) | 2021-0234 | Corrective order | Over-redacted management communications |
| Datainspektionen (Sweden) | DI-2022-1456 | SEK 200,000 | Failed to search backup systems |