The Court of Appeal’s decision in Dawson-Damer v Taylor Wessing LLP  this year clarified how subject access requests (SAR), which compel a data controller to provide access to an individual’s personal information held by the data controller, are balanced against established legal protections preventing the disclosure of data.
The appellants sought to bring a claim under Bahamian law for a dispute arising under a trust of which they were the beneficiaries. Provisions of the Bahamian Trustee Act 1988 prevented the appellants from obtaining certain information and so subsequently sought to gain material from the English law firm Taylor Wessing, the trustees’ legal advisor.
The appellants made a SAR, a right granted to individuals under section 7 of the Data Protection Act 1998 (DPA). Section 7(9) of the DPA provides that where a data controller fails to comply with the request, the courts may make an order compelling the data controller to disclose that data.
Proceedings began against the defendants after they refused to grant access to the personal data. Taylor Wessing argued that all information sought under the SAR was protected by legal professional privilege, an exemption against the right to access information under paragraph 10 of schedule 7 of the DPA. The High Court in the first instance agreed with the defendant and in August 2015 the application to compel disclosure was refused.
The proceedings were then heard in the Court of Appeal, with Arden LJ clarifying three important points concerning the use of SARs:
1. Legal Professional Privilege and Trustees Right of Disclosure
The exception that there is no obligation to disclose documents under the DPA where the data controller can rely on legal professional privilege was considered. Whilst the defendant sought to define the exception broadly, meaning all documents which may benefit from privilege under Bahamian law would be protected, the court interpreted it more narrowly, noting that only documents protected under English law would be exempt.
There was also the issue of documents which were ring-fenced by the trustees’ right of non-disclosure. However, the court stated that the DPA does not recognise an exception for a trustee seeking to prevent disclosure to a beneficiary. The defendant was therefore obliged to disclose all documents to which the legal professional privilege did not apply.
2. Disproportionate Effort
Next the court had to consider section 8(2) of the DPA, which reduces the data controller’s obligation to hand over the individual’s personal data where the supply of a copy is “not possible or would involve a disproportional effort”. Arden LJ clarified that the proportionality test need not apply solely to the process of supplying the data, but also to searching for it. In establishing disproportionate effort, the benefit the individual would gain must also be considered. If it were particularly burdensome for the data controller to search for data that conferred little benefit to the individual, the process would be deemed disproportionate.
3. SARs are Purpose Blind
The defendant argued that the reason for seeking the SAR was for the appellants to be able to pursue a claim in the Bahamas and not merely to find out what the data controller held which related to the individual.
Arden LJ noted that the motive for seeking the SAR was irrelevant and that nowhere in the DPA did it specify circumstances where the request should be limited, except where there was an abuse of process.
Arden LJ has provided much needed clarity on the legal professional privilege exemption under the DPA which will be welcomed by all those wishing to rely on it.
However, this case is particularly concerning for data controllers whose clients are trustees, as laws protecting such trustees against disclosure obligations might face an order compelling them to hand over material to beneficiaries, who were not necessarily entitled to such information before.