Show me all you’ve got for a tenner - Data Subject Access Request

Speedread

The High Court refused to order a firm of solicitors to comply with a subject access request.  It was not reasonable or proportionate for the solicitors to carry out lengthy and costly searches of files dating back 30 years to determine whether the information was protected from having to be disclosed due to legal professional privilege.  The High Court has shown once again that it is willing to imply a “proportionality” test with regard to the search as well as the provision of copies of data, even though the ICO has consistently taken a different stance.   

Background

It’s becoming increasingly common to see employees make data subject access requests of their employers, and to ask to see copies of all personal data held on them by their employer. 

The most that the employer can charge is £10, and yet it can cost many times that to conduct extensive searches and copy the information for the employee. Guidance from the data protection watchdog, the Information Commissioner’s Office (ICO), offers little assistance to hard-pressed employers, as it is the ICO’s view that searches should be extensive and that employers should look wherever they believe that the employee’s personal data may be found.

Help may be at hand from the High Court which has handed down its judgment in the case of Dawson-Damer and others v Taylor Wessing LLP and others . 

Judgment

Applying the disproportionate effort exemption in section 8(2) of the Data Protection Act 1998 ("DPA"), the High Court refused to order the solicitors' firm, Taylor Wessing, to comply with a subject access request. On the facts, the High Court held that it was not reasonable or proportionate for Taylor Wessing to carry out lengthy and costly searches of files dating back at least 30 years to determine whether or not information requested was protected by legal professional privilege, in order to comply. 

The application was made by individuals (family members) against the backdrop of ongoing litigation in the Bahamas brought by one of them against a Bahamian trustee company, which was a client of Taylor Wessing.   The court held that the legal professional privilege exemption in paragraph 10, Schedule 7 of the DPA should not be interpreted so as to provide the claimants with information or documents which may assist them in litigation.

The judge discussed his previous judgment in Elliott v Lloyds TSB Bank, where he held that under the disproportionate effort exemption, a data controller is only required to supply such personal data in response to a subject access request as is found after a reasonable and proportionate search. 

Implications

Interestingly, the High Court has shown once again that it is willing to imply into section 8(2) a “proportionality” test with regard to the search as well as the provision of copies of data, even though the ICO has consistently taken a different stance. 

What this shows is that employers will still need to do a reasonable search but should be able to push back on searching in any areas (such as email accounts of people outside the employee’s department) where they honestly believe the employee’s personal data will not be found. It remains to be seen if the ICO will adopt the same view, and it should be noted that the case may yet be appealed to the Court of Appeal, but it does provide a glimmer of hope for employers faced with such burdensome requests.