The High Court recently considered issues of motive and proportionality in the submission of subject access requests. Andrew Gallie examines the outcome.
Individuals have a right to the information which an organisation holds about them under the Data Protection Act (DPA). This is known as a 'subject access request' or SAR.
This can be bad news for employers, particularly where they hold a considerable amount of information about someone. Individuals will often make SARs in order to try and force disclosure of information which might assist in a dispute.
The Information Commissioner's Office (ICO) takes a very wide view of the obligation to provide information and considers that organisations must go to great lengths to ensure that any request is dealt with thoroughly (even if it might involve a lot of time and effort).
However, there is a growing body of case law which points to a narrower approach.
This is demonstrated by the recent case of Dawson-Damer and others v Taylor Wessing LLP and others. The claimants sought orders requiring the defendant, a firm of solicitors, to comply with their SAR. The defendants had previously refused on the basis that they were entitled to use the blanket exemption for legal professional privilege. The Court refused the claimant's application on the basis that it was not reasonable or proportionate for the firm to conduct lengthy and costly searches to see if any information was potentially disclosable.
The obligation under the DPA is to carry out a 'reasonable and proportionate' search. In Dawson-Damer, it was held that the search would have been disproportionately costly given the need to separate out all of the data protected by legal professional privilege.
In contrast, the ICO stress that the obligation to carry out a 'reasonable and proportionate' search is an obligation to make extensive efforts to find and retrieve information.
Although the Court was satisfied that carrying out the searches would not be reasonable and proportionate, the Court also found that the SAR would have been refused in any event because it was made to obtain documents to assist with litigation. The judge stated that the purpose of the SAR provisions is to enable individuals to check whether their personal data is being processed in a way which unlawfully infringes their privacy. It is not intended to allow an individual to obtain documents that might assist with litigation, as was found in this case.
However, the ICO has stated that the DPA does not allow organisations to refuse to comply with a SAR simply where the requestor has begun or contemplates litigation.
Dawson-Damer demonstrates once again the apparent differing approaches taken by the Courts and the ICO.
Employers should therefore consider what would be the best approach on a case by case basis but the recent Court decisions may give confidence to those employers who wish to adopt a narrow view of their obligations.