What is this about?
Two differently constituted (UK) Courts of Appeal recently gave important rulings about a number of data protection issues concerning Subject Access Requests (SARs) in the cases of Dawson-Damer & Ors -v- Taylor Wessing LLP, which can be found here, and, Ittihadeih -v- 5-11 Cheyne Gardens & Deer -v- Oxford University, which can be found here. We have previously written about SARs and litigation court cases here and here.
What is a Subject Access Request?
Under the UK Data Protection Act 1998 (DPA 1998) individuals have the right to see a copy of all the information an organisation (including a business) holds about them by submitting an SAR. Certain exemptions apply under the DPA 1998 including legal professional privilege. Dealing with a request is often challenging in terms of time and resources needed to respond. SARs are also increasingly being used to obtain information in the context of litigation.
The Dawson-Damer & Taylor Wessing case
Mrs. Dawson-Damer and her two children submitted an SAR to the law firm Taylor Wessing in the context of a dispute about a trust in the Bahamas of which Mrs. Dawson-Damer and her two children were the beneficiaries – Taylor Wessing was acting for the Bahamian trust. Taylor Wessing did not comply with the SAR arguing that legal professional privilege applied to the personal data – it should also be noted that under the Bahamian Trustee Act 1988 a court cannot order a trustee to disclose certain trust documents. An application was made to the (UK) High Court for an order for Taylor Wessing to comply with the SAR, but the court dismissed it. The case then went to the Court of Appeal which overturned this decision where it addressed the key issues in the case as follows:
- The extent of the legal professional privilege exception – the High Court had ruled that the legal professional privilege exception should be interpreted widely to include all documents which the trustee could resist compulsory disclosure of in the Bahamas trust dispute. The Court of Appeal disagreed holding instead that the exception should be interpreted narrowly and apply only to documents which carried the privilege under English law;
- The extent to which compliance with the SAR involved a disproportionate effort – the High Court had ruled that it was neither reasonable nor proportionate for a search to be undertaken for the information in question. The Court of Appeal disagreed holding instead that Taylor Wessing had completely failed to produce evidence to show what it had done to identify the material and to work out a plan to deliver the information with the personal data; and,
- The intended use of the information by Mrs. Dawson-Damer and her two children in the Bahamas trust litigation – the High Court had refused to enforce the SAR because of this motive. The Court of Appeal disagreed holding instead that there was no rule that no order should be made if the data subject proposed to use the information for verifying or correcting data but also to aid in other proceedings.
The Court of Appeal therefore said that an order for disclosure should be made.
The (combined) Ittihadeih -v- 5-11 Cheyne Gardens & Deer -v- Oxford University cases
Mr. Alireza Ittihadieh lived in the 5-11 Cheyne Gardens building and had been in a property-related dispute with other residents there. Because he was concerned that these residents had been keeping a file of material containing his personal data in connection with these disputes he submitted an SAR to the company that manages the building. In response to the SAR the company disclosed some four hundred documents. Mr. Ittihadieh was not however happy with this believing that he was entitled to greater disclosure and so he made a request to the High Court accordingly. The High Court refused on the grounds that it had not been established that the documents already disclosed by the company had failed to provide all the information to which he was entitled, and, in any event to make such an order would be disproportionate in the circumstances.
Dr Cécile Deer was involved in an employment dispute against Oxford University concerning allegations of sex discrimination and victimisation. In connection with this dispute she submitted two SARs to the university. Although the university eventually disclosed some information in response to the SARs Dr. Deer did not agree that enough material had been disclosed and so she took the matter to the High Court. The court ordered further disclosure, in response to which the university reviewed 500,000 documents at a cost of £116,116, following which additional documents were disclosed. The court did not order the University to take any further steps. Dr. Deer then took her case to the Court of Appeal.
The Court of Appeal dismissed both appeals where it addressed the key issues in the case as follows:
- The issue of what constitutes a reasonable and proportionate search – the Court of Appeal pointed out that the obligation to comply with an SAR is only an obligation to conduct a reasonable and proportionate search stating that “it is not an obligation to leave no stone unturned”; and,
- The purpose of an SAR – the Court of Appeal pointed out that “the mere fact that a person has collateral purposes will not invalidate a SAR” – making an SAR with a view to bringing legal proceedings does not automatically provide a basis to refuse disclosure of the information asked for.
The Court of Appeal went into detail as to why neither Mr. Ittihadieh nor Dr. Deer succeeded on the facts and to some extent the Ittihadeih -v- 5-11 Cheyne Gardens & Deer -v- Oxford University cases could be seen as a tempering of the Dawson-Damer & Taylor Wessing case – these cases turn very much on their facts. But it can at least be concluded that generally-speaking for now as regards SARs:
- The disproportionate effort qualification applies to all stages of SAR compliance, and, making out a disproportionate effort argument requires far greater justification than just asserting that searching through documents would be difficult; and,
- SARs are an acceptable exercise of rights under the DPA 1998, even if the intention is to use the information obtained in subsequent litigation.
Takeaways
The following brief takeaways come out of these cases:
- Use of SARs in pre-litigation and during litigation is on the rise;
- Whilst each case turns on its own facts it cannot be automatically assumed that the disproportionate or legal professional privilege exemptions will apply – therefore presume these exceptions narrowly;
- Whilst conducting a search that is reasonable and proportionate is still the rule-of-thumb this will have to be thought through carefully in response to each SAR;
- Have an SARs response plan in place;
- When responding to an SAR record all steps taken, including the time, costs and resources used – if it has been decided to not comply then fully justify this; and,
- Seek specialist legal advice in challenging and complex matters.
Please note that this briefing is not exhaustive about the data protection issues raised in these cases – the courts in these cases made a number of other interesting points but in the interests of keeping things short only the most significant issues have been highlighted. By way of an aside it is also interesting to note how much deeper the UK courts are going into data protection issues.
SARs have been maintained but also amended under the EU General Data Protection Regulation (GDPR) – please note especially that the response time will be 1 month (i.e not the current 40 days). We have written FAQS and a Glossary about the GDPR (including about SARs) which can be found here and here. We have also designed a product to assist with compliance with the GDPR called Navigator – for more about this please see here. We frequently write about data protection issues – for more articles see here.
For more information please contact Jonathan Armstrong or André Bywater who are lawyers with Cordery in London where their focus is on compliance issues.
| Jonathan Armstrong, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH | André Bywater, Cordery, Lexis House, 30 Farringdon Street, London, EC4A 4HH | |
| Office: +44 (0)207 075 1784 | Office: +44 (0)207 075 1785 | |
| Jonathan.armstrong@corderycompliance.com | Andre.bywater@corderycompliance.com | |
 |
 |