A recruitment giant that screams DEI from the rooftops should be able to send one disabled candidate a clean copy of his own data without stalling, censoring and breaching somebody else’s privacy in the process. PageGroup couldn’t even clear that bar. They turned a basic subject access request into a slow-motion car crash, then wrapped it in “we celebrate difference” boilerplate like glitter over an oil spill.
Data Rights, Done On Their Terms
5 March 2025, I send Michael Page a straight UK GDPR subject access request. No games.
- all records on my Cepac application
- what they sent to Cepac about me
- what they said internally once I raised discrimination
On 6 March they log it as UK-DSAR_250306_001 and rock me to sleep with the usual lullaby:
One calendar month. Maybe three if “complex”. Working hard. Thank you for your patience.
I even flag that Cepac is already trying to pin the mess on them in its ET3, and that getting a full pack out quickly would actually help PageGroup show it wasn’t the villain there. That warning never makes it past the corporate forcefield.
They heard “urgent for a disabled litigant in person” and translated it as “take your time, we’ll see”.
Deadline Day And Suddenly They Remember
The one-month clock runs out. No data. No extension notice. No “this is complex”. Nothing.
On 7 April I spell it out: you’re over time, you’ve neither complied nor told me why, and if you don’t sort it today I go to the ICO.
Like magic, the bundle appears that morning. Password-protected, wrapped in compliance jargon, redaction warnings and a pat on their own back for how seriously they take privacy.
It looks less like a routine GDPR process and more like a company rushing to shove something across the line because someone finally shouted “regulator”.
The Wrong Man’s CV
Then the fun part.
I open the pack and the first thing that hits me is not the black boxes. It’s that I have apparently lived someone else’s life.
The “CV” they send me is not mine. Different history. Different profile. Different bloke.
I reply within minutes:
“That isn’t even my CV and you’ve had more than a month.”
This isn’t some tiny typo in a spreadsheet. This is a big-name recruitment outfit dumping another candidate’s personal data into a disabled complainant’s discrimination case after blowing the deadline.
If a small employer did that, PageGroup’s own training decks would call it a textbook breach. When Page does it, they just carry on spamming the DEI footer.
Redactions, Comfort Phrases And Zero Accountability
The bundle itself is a documentary murder scene.
- The email chain literally headed “Discrimination”.
- The “Don’t freak out” line.
- “Looks like this candidate may be one that does this regularly.”
- “I have googled him and his previous company and it looks like he went through an employment tribunal.”
Except huge chunks of context are gone, replaced by thick black rectangles and a shrug at Article 23(1). Third parties. Privilege. Internal process. Same old.
What you do not see anywhere is:
- an explicit acknowledgement that they sent me the wrong person’s CV;
- an explanation of how that happened in a supposedly “controlled” data environment;
- evidence they actually treated the other candidate as the data subject in a live breach, not as collateral.
They’ll redact a line to protect a colleague’s name, but apparently sending a stranger’s CV into an employment dispute doesn’t trigger the same level of anxiety.
Inclusion In The Footer, Indifference In Practice
Scroll to the bottom of every email and you hit the branding spiel.
“We don’t just accept difference – we celebrate it. We are committed to building inclusive, diverse workplaces where everyone can thrive. If you require any support or adjustments to interact with us, please let us know.”
My adjustment was not exotic.
- Stop dragging your feet on a DSAR tied directly to a live discrimination case.
- Stop feeding my anxiety by playing games with what I can and cannot see about myself.
- Stop pretending delay and blackout bars are neutral when you know I’ve got a diagnosed mental health condition that flares under exactly this sort of concealment.
What I got instead was slow-roll, redactions and another bloke’s CV. If that’s them “celebrating difference”, I’d hate to see them on a day they’re just tolerating people.
The Breach They Expected Me To Keep Quiet
When I told them they’d sent the wrong CV, I asked the only honest question:
“Are you going to inform the gentleman whose data you’ve breached about the breach or should I?”
The silence answered for them.
So I tracked him down and told him myself. A total stranger, now dragged into the PageGroup / Cepac / TCAP mess because someone in a DEI-plastered compliance office can’t handle attachments.
He did not sound like a man who’d already had the full “we take your privacy seriously” speech.
A recruitment company that lives off other people’s data has one sacred job – treat that data like it belongs to actual humans, not as wallpaper for litigation strategy. If a disabled candidate has to play unofficial data-breach notification officer because you didn’t, you’ve failed that job.
Data Deviants In DEI Clothing
None of this is about a single missed deadline or one sloppy click. It is about instinct.
- My instinct, as a disabled candidate, is to pull the record and see what was done to me.
- PageGroup’s instinct, faced with that request, is to stall, redact, mis-send and hope the regulator backlog saves them.
- When they do finally respond, the bundle shows their first reaction to a discrimination complaint was not curiosity, but Googling and labelling me “serial”.
They profiled me the second I complained. I looked at how they handled my data and drew my own conclusion.
If PageGroup wants to argue about who is more “deviant” here, they know where to find me. They can sue the disabled, unemployed bloke for calling them what their own paper trail makes them look like.
But that would mean putting that trail under a proper light. And that, apparently, is a step too far for people who “celebrate difference” until it asks to see what’s on file.
Lee Thompson – Founder, The Cummins Accountability Project