21 August 2015 #Employment
Under the Data Protection Act 1998 (DPA) an individual can make a request to an organisation to find out what personal data it holds on them (often referred to as a subject access request).
Organisations are required to provide a copy of the individual’s personal data in an intelligible form unless supplying a copy would involve ‘disproportionate effort’. There are circumstances when the organisation can refuse to supply information, for example, where that information is legally privileged. Individuals typically enforce their rights by submitting a complaint to the Information Commissioner’s Office (ICO), an independent body set up to uphold information rights.
However, individuals can pursue claims through the courts and a court can make an order requiring compliance with the DPA where it is satisfied there has been a breach.
In the recent case of Dawson-Damer and others v Taylor Wessing LLP and others a mother and her two children made subject access requests to Taylor Wessing (TW), a solicitors’ firm. TW represented a client based in the Bahamas who was the sole trustee of a multimillion dollar trust fund relating to the family. The family were bringing a claim against the client in the Bahamas and approached TW with a view to obtaining disclosure to assist them in their proceedings. TW refused to comply on the basis that legal privilege applied, on a blanket basis, to all information it held.
The High Court refused to make an order of non-compliance on the basis that it was not reasonable or proportionate for TW to carry out a search of its documents to assess whether or not particular documents attracted privilege. It felt this fell within the ‘disproportionate effort’ exception set out above. It was also critical of the family’s motive stating that the purpose of the subject access provisions in the DPA are to allow individuals to ensure their data is lawfully processed and not to gather information to assist them in litigation.
It is undoubtedly a tactic of disgruntled employees and ex-employees to make subject access requests in the lead up to litigation and the decision of the High Court will be welcomed by organisations faced with onerous requests triggered by such a motive. However, the views of the Court appear contrary to those of the ICO. The guidance from the ICO makes clear that the ‘disproportionate effort’ exemption only relates to the requirement to supply a copy of the data and that organisations cannot simply refuse to deal with a request because it thinks that locating the information in the first place would involve disproportionate effort. The ICO has also given its opinion that an organisation cannot refuse to comply because it believes the individuals motives are to gather information to support litigation.
Interestingly the High Court recognised that it was ‘quite possible’ that the Court of Appeal might take a different view to it and granted leave to appeal.