Who: Dawson-Damer & Others; Taylor Wessing LLP & Others (“TW”)
Where: High Court, London – Chancery Division
When: 6 August 2015
Law stated as at: 7 September 2015
What happened:
The High Court has refused an application to issue an order for compliance with a series of subject access requests (“SARs”), sought under section 7(9) of the Data Protection Act 1998 (“DPA”). The SARs were made by the claimants – a mother and her two children – to TW, a firm of solicitors, for all personal data held about them. One of the claimants was involved in concurrent litigation against a client of TW’s; a trustee company based in the Bahamas with responsibility for the administration of a multimillion dollar trust fund on behalf of the family.
The family approached TW with a view to obtaining information that would assist in their claim against the Bahamian trust company. TW refused to comply with the SARs, claiming to be entitled to a blanket exemption under paragraph 10 of Schedule 7 of the DPA on the basis that legal professional privilege applied to the information it held.
Legal professional privilege
The principal issue for the High Court to determine was whether the legal professional privilege exemption was in fact engaged, and this gave rise to challenging questions regarding the application of English law rules relating to disclosure and the equivalent rules under Bahamian law.
Applying a purposive approach, the court held that the exemption was engaged in this case. The purpose of DPA subject access provisions is to enable data subjects to check the accuracy of information held by data controllers, or to determine whether a data controller is processing their personal data unlawfully.
There was no suggestion in this case that the claimants had legitimate concerns about the processing of their personal data by TW, and counsel for TW inferred that the SARs had only been made to obtain discovery of documents that might assist in the Bahamian litigation. The court agreed with this analysis and concluded that it would not be a proper use of the DPA to enable the claimants to obtain documents that they could not otherwise obtain in the Bahamian proceedings.
The ‘disproportionate effort’ exemption
Potentially of broader significance, however, is the court’s approach to a subsidiary issue in this case. In challenging the blanket application of the legal professional privilege exemption, counsel for the claimants argued that TW were likely to be in possession of some personal data not covered by privilege. Behrens HHJ considered the High Court’s previous judgment in Elliott v Lloyds TSB Bank, when it was held that the disproportionate effort exemption under section 8(2) of the DPA only requires a data controller to supply such personal data in response to an SAR as is found after a ‘reasonable and proportionate’ search.
On the facts, the court agreed with TW that it was not reasonable or proportionate to expect TW to carry out the necessary searches of files dating back at least 30 years to determine whether or not particular documents in its possession were covered by privilege. In the judge’s own words: “The question of whether a document was protected by privilege was a matter that required consideration by skilled lawyers. It would accordingly be a very time consuming (and costly) exercise for such lawyers to carry out that task. The claimants had only paid a modest fee (£10 each) for the [SARs]. To expect TW to carry out the work required was neither reasonable nor proportionate“.
Why this matters:
This case provides judicial comment on many aspects of the DPA’s subject access provisions, particularly in relation to the disproportionate effort exemption under section 8(2). The decision is likely to be welcomed by businesses that are regularly faced with the labour and resource-intensive burden of dealing with SARs, but in many ways this case has added to the uncertainty around the obligations of data controllers under the DPA.
It does not require a particularly liberal interpretation of the judgment to suggest that it could open up a broad new basis on which organisations might seek to avoid complying with SARs. In the vast majority of cases, the response process will involve time and costs in excess of the £10 fee that a company may charge, and it is not unusual for lawyers to be involved. This decision would appear to suggest that such efforts are automatically unreasonable and disproportionate in light of the modest fee. It seems unlikely that the court will have intended to open the floodgates so widely, but for now the position is far from clear.
Interestingly (and somewhat bizarrely), Behrens HHJ granted permission to appeal and recognised that it is “quite possible that the Court of Appeal might take a different view” on some aspects of his decision. Unless and until such appeal is heard, it will be difficult to assess the impact that this decision will have.
It is worth noting, however, that the views of the High Court judge are markedly opposed to those of the ICO. Guidance from the ICO suggests that the disproportionate effort exemption only relates to the requirement to supply copies of information to the data subject. In other words, organisations cannot simply refuse to deal with an SAR because it thinks that locating the information in the first place would involve disproportionate effort. Separately, the ICO has also opined that organisations cannot refuse to comply with an SAR because it believes the individuals’ motives are to gather information to support litigation.
We will continue to monitor and report on the future developments in this case.
