Turn The Page : PageGroup’s DSAR Blackout Hits An ICO Timer

By /

This sits inside Employment Tribunal claim 6019060/2024 against Cepac Ltd and Page Outsourcing UK Limited, over alleged disability discrimination in recruitment. Michael Page’s DSAR arrives like a crime scene with the names taped over. After months of delay, the ICO has finally allocated a case officer, told Page there is “more work” to do, and given them 14 days to decide next steps. Page have already responded. It was short, meaningless, and engineered to protect Page and the client. I pushed back.

The Regulator Finally Turned Up

The ICO has now allocated a case officer to the complaint.

Not a generic mailbox, not a shrug, not “we’ve logged it”. A named officer, and a clear position: there is more work for the organisation to do.

The ICO has told Page to work with me to resolve what is outstanding, and if they insist they have complied, they are expected to clearly explain that.

A 14 day window was set for Page to consider next steps.

That is the regulator finally catching up with the file, late, but present.

Page Responded. Briefly. And It Was The Usual Cover Story

Page did respond, quickly, but it was the classic compliance postcard:

  • “all personal data we hold about you has been provided”
  • your CV and a summary were shared with the hiring manager
  • other candidates were redacted
  • the client selected the shortlist or interview list
  • therefore there is “no further feedback” related to you
  • and “no written comments or assessments” exist beyond what was already supplied

Translation: nothing to see, nobody to name, nowhere to dig.

That response is not designed to help a candidate understand what happened. It is designed to close down the line of enquiry while sounding polite.

It also conveniently protects two parties at once.

Page. And the client.

How appropriate.

I Pushed Back Because It Does Not Answer The Actual Point

My reply to the ICO was not “I’m unhappy”. It was specific.

I confirmed the complaint remains unresolved and said Page’s response is not an “appropriate response” because it does not address what the ICO asked them to work with me to resolve.

In plain terms, Page still refuse to do the basic things that make a DSAR meaningful:

  • explain the basis for the extensive redactions in a usable way, including what lawful basis is being relied on
  • identify what is being withheld that relates to me, such as decision route, decision timing, internal handling
  • provide any audit detail of searches undertaken, including systems, date ranges, custodians, keywords, and whether call logs, system notes, and internal emails exist and were reviewed
  • address the core problem: the redactions remove the only information that would allow me to understand who handled my candidacy, when decisions were taken, and what was recorded about me

And I challenged their favourite deflection.

“The client selected candidates for shortlist or interview” does not explain why Page’s internal records and email chains are heavily redacted, and it does not confirm whether internal notes exist recording what the client said or what Page did with it.

This is not nitpicking. This is the decision trail.

The Client Shield And The Candidate Blindfold

Page’s line is basically: if the client decided, Page cannot possibly have anything meaningful to show.

That is nonsense.

Even if the client chose the shortlist, Page still has internal handling: comms, workflow, chase messages, scheduling, systems, call logs, CRM notes, internal emails, and the plain fact of what was done and when.

So why does the DSAR read like the black marker has done the work.

Because it protects the client.

And it protects Page.

And it leaves the allegedly discriminated against candidate blindfolded.

Is that FTSE 250 behaviour, or just FTSE 250 branding?

Inclusive footer. Opaque file.

Somebody Who Was Not On The Call Is Now Explaining The Call To Me

This is the part that turns it from “administrative” into insulting.

A compliance contact who was not on the call is effectively telling me what I heard on the call and expecting me to accept her version as the official truth.

No readable call logs. No unredacted system notes. No clean internal chain that allows the record to be tested.

Just: trust us, we’ve checked.

That is not a disclosure culture. That is a reputation culture.

The Interview Offer Problem They Cannot Wish Away

And no, I do not accept “the client selected the shortlist”.

I was offered an interview. Same day. I have a contemporaneous message trail confirming it. It’s filed with a witness statement from the recipient.

So the corporate rewrite creates a simple question.

If there was no interview, why is there a same-day record of one being offered.

And if Page truly hold nothing else, why does the DSAR need to be so heavily redacted that the mechanics disappear.

That is why the ICO timer matters.

Because it forces Page to either provide a meaningful explanation, or dig their heels in and own the optics.

Closing Cut

This is not a nerd fight about data protection.

It is the evidence pipe in a live Employment Tribunal claim.

When that pipe is clamped, you get guesswork. You get “conduct” narratives. You get a claimant forced to fight blind.

The ICO has now said there is more work to do.

Page have responded with a postcard.

I have pushed back.

Now we see whether this is a serious compliance function, or just a client-protection service with a privacy stamp on the envelope.

Lee Thompson – Founder, The Cummins Accountability Project

Sources

Scroll to Top