Dealing with subject access requests under the Data Protection Act 1998 (the “DPA”) is becoming increasingly onerous for many organisations, particularly those with a large retail customer base. The recent case of Dawson-Damer & Ors v Taylor Wessing LLP & Ors [2015] EWHC 2366 (Ch) provides guidance on the circumstances in which it may be possible to decline to comply with a subject access request with potentially far reaching implications for organisations burdened by such requests.
Case summary
The High Court refused an application under section 7(9) of the DPA to make an order for compliance with certain subject access requests. The ruling was principally made on the grounds that, pursuant to the disproportionate effort exemption in section 8(2) of the DPA, it was not reasonable or proportionate for the law firm, to whom the request was made, to search files dating back at least 30 years, in order to comply with the requests. In addition, the Court commented on the definition of “relevant filing system” under section 1(1) of the DPA and its discretion under section 7(9) of the DPA to order compliance with a subject access request made for the purposes of discovering documents that may assist in litigation.
The facts
The case arose out of ongoing proceedings in the Supreme Court of the Bahamas between Ashley Judith Dawson-Damer (“Ashley”) and Grampian Trust Company Limited (“Grampian”), a trust company incorporated in the Bahamas, which was the sole trustee of a discretionary settlement of which Ashley was a beneficiary.
Ashley and her two children (the “Dawson-Damers”) made subject access requests to Taylor Wessing LLP (“TW”), the English solicitors to Grampian. TW declined to comply with the requests on the grounds that the personal data they held relating to the Dawson-Damers was exempt from the DPA by virtue of Schedule 7 paragraph 10 as it consisted of data in respect of which a claim to legal professional privilege applied. TW also argued that as the information was held in manual files with the majority loose leaf in boxes the information was not held in a “relevant filing system” for the purposes of section 1(1) of the DPA.
The Dawson-Damers sought an order from the High Court under section 7(9) of the DPA requiring TW to comply with their subject access requests.
The High Court’s decision
Legal professional privilege and reasonable and proportionate searches
The High Court held that the legal professional privilege exemption under Schedule 7 paragraph 10 of the DPA applied in the circumstances. Furthermore, the Court held that, pursuant to section 8(2) of the DPA, it would not be reasonable or proportionate for TW to carry out a search to determine exactly which data contained in files spanning the duration of its 30 year relationship with Grampian was protected by legal professional privilege and which was not, in order to comply with the subject access requests. Such an exercise would be both time consuming and costly as it would require the involvement of skilled lawyers. As such, TW were not required to comply with the subject access requests and the question of whether the Court should exercise its discretion under section 7(9) of the DPA to order TW to do so did not arise.
Relevant filing systems
Whilst the crux of the decision focused around the application of the legal professional privilege exemption under Schedule 7 paragraph 10 of the DPA and the proportionality requirement under section 8(2), the Court also commented on TW’s argument that its filing system was not a “relevant filing system” for the purposes of the DPA as much of the information was held in manual files with the majority loose leaf in boxes that contained multiple categories of information not categorised in any particular way. The Court commented that TW had not provided sufficiently detailed evidence relating to the state of their filing system but nevertheless made reference to the ruling in Durant v FSA [2003] EWCA Civ 1746 that “manual records must be of sufficient sophistication to provide the same or similar ready accessibility as a computerised filing system” and found that TW’s manual filing system was not a “relevant filing system” under section 1(1) of the DPA.
Purpose of subject access requests
Significantly, the Court also commented on the motives behind the Dawson-Damers’ application and stated that “if the application is an abuse this will be an important factor in the exercise of any discretion under section 7(9) [of the DPA]”. The Court also reiterated the judgement in Durant and stated that “abuse” includes using the subject access provisions of the DPA to obtain discovery of documents that may assist him in litigation or complaints against third parties.
On the facts of this case the Court stated that it would not have exercised its discretion under section 7(9) of the DPA to order TW to comply with the subject access requests as there was no suggestion that the Dawson-Damers wished to verify the accuracy of the information held by TW in accordance with the overarching purpose of the subject access provisions of the DPA; rather the Court believed that “the real purpose of the subject access requests was to obtain information to be used in connection with the Bahamian proceedings”, which pursuant to Durant was not a proper purpose.
Comment
The quantity of data held by organisations has grown beyond anything which could have been envisaged in 1995 when the text of the Data Protection Directive was finalised, meaning that subject access requests are now far more onerous than when they were first conceived. The cost of compliance with subject access requests is often high and the £10 fee which organisations are entitled to charge is rarely, if ever, adequate compensation for the effort involved.
The case demonstrates a more liberal approach to the interpretation of what constitutes “disproportionate effort” under section 8(2) of the DPA, which will be welcome news to organisations which find themselves burdened by subject access requests. In addition, the Court’s comments on the interpretation of the concept of a “relevant filing system” will be useful to organisations when considering the extent of a search required of manual records.
Perhaps of most interest is the focus by the Court on an individual’s motive behind making a subject access request. At a time when organisations are receiving increasing numbers of subject access requests from aggrieved customers seeking to discover documents that may assist them in bringing a claim against the receiver of that request or a third party, it will come as a relief to hear that the Court will not take kindly to requests founded on a desire to fuel future litigation. However, comments in the case do seem to be at odds with current ICO guidance which states that the ICO does not accept the view that organisations may refuse to comply with a subject access request where the requester is contemplating or has already begun legal proceedings. It is also worth noting that the Dawson-Damers have been granted permission to appeal and the Court of Appeal may take a different stance. In the absence of a definitive ruling from the Court of Appeal or revised guidance from the ICO, organisations which are minded to push back on subject access requests following comments made in the case should do so with caution.
Social Media cookies collect information about you sharing information from our website via social media tools, or analytics to understand your browsing between social media tools or our Social Media campaigns and our own websites. We do this to optimise the mix of channels to provide you with our content. Details concerning the tools in use are in our privacy policy.