This is the last in the series of articles discussing the recent changes to the Information Commissioner’s Office’s Subject Access Request Code of Practice, and discusses the national scope of legal professional privilege in relation to Subject Access Requests (SARs).
Legal professional privilege protects communications between a professional legal advisor and their client, preventing disclosure of information without the client’s permission which, in practice, can conflict with an individual’s right to make SARs.
In Dawson-Damer v Taylor Wessing LLP, Taylor Wessing were acting on behalf of a trustee of a number of Bahamian trusts, one of which Mrs Dawson-Damer and her two children were beneficiaries of. Mrs Dawson-Damer commenced legal proceedings after a significant amount of the trust fund was appointed to new trustees for the benefit of other discretionary beneficiaries, and the SAR was subsequently made.
The High Court held that Taylor Wessing were not obliged to comply with the SAR on the basis that it would require disproportionate effort to separate out data relevant to the SAR from data protected by legal professional privilege.
Conversely, the Court of Appeal held that Taylor Wessing had not done enough to constitute proportionate effort, suggesting that ‘proportionate effort’ includes not just the provision of copies of data, but also the search for the data itself. If Taylor Wessing wanted to rely on legal professional privilege then they should have undertaken the additional work required to identify and separate out the protected data, rather than applying a blanket exception. Under the new ICO Code, organisations will be required to weigh up the benefit on the data subject of providing the information against the effort required to comply, even if that effort includes finding and splitting out information protected by legal professional privilege.
The Dawson-Damer case also dealt with rules surrounding confidentiality and legal professional privilege outside of the UK since the trustee was based in the Bahamas. The Court of Appeal held that the exemption from disclosing legally privileged information, in response to a Subject Access Request, only applies to the legal professional privilege that exists in the UK.
Consequently, the ICO has updated chapter 9 of its Code of Practice to specify that the exemption applies to the UK only, stating furthermore that “Where legal professional privilege cannot be claimed, you may not refuse to supply information in response to a SAR simply because the information is requested in connection with actual or potential legal proceedings. The DPA contains no exemption for such information; indeed, it says the right of subject access overrides any other legal rule that limits disclosure.”