There are two questions which are frequently posed by data controllers in receipt of wide-ranging subject access requests. First, if the request is made in circumstances where the requester is pursuing litigation against the data controller, the data controller will often query whether the request can be refused on the ground that it is being pursued for improper collateral purposes. Second, if responding to the request comprehensively would be disproportionately resource intensive, the data controller will typically ask whether it is entitled to limit its search to one which is reasonable and proportionate in the circumstances. As the recent case of Elliot v Lloyds TSB Bank PLC & Anor (Case No: 0LS51908) illustrates, answering such questions is rarely straightforward.
The background to Elliott was that Mr Elliott was pursuing a grievance against Lloyds in connection with certain commercial matters. With a view to furthering his grievance, Mr Elliott submitted a request to Lloyds for pre-action disclosure. That request was refused on the ground that it did not comply with CPR 31.16. Thereafter, Mr Elliott submitted wide-ranging subject access requests to Lloyds. A considerable amount of information was disclosed by Lloyds in response to the requests. However, Mr Elliott was not satisfied with the material disclosed to him. He considered that further searches ought to be undertaken. Accordingly, he brought a claim against Lloyds in the County Court under s. 7(9) DPA (s. 7(9) affords the court a wide discretion to order a data controller to comply with a subject access request if it is satisfied that the data controller has not dealt with the request in accordance with the legislation). Lloyds sought to resist the claim on two grounds: first, the claim was an abuse of process as it was being pursued for the collateral purposes of furthering Mr Elliott’s interests in prospective commercial litigation against Lloyds; second, the claim should fail on the basis that the further searches for data which Mr Elliott was insisting should be conducted would be disproportionate in all the circumstances. Thus, both Mr Elliott’s motive and the issue of the proportionality of Lloyd’s searches were at stake in the litigation.
The Motive Issue
Mr Elliott’s case on the motive issue was that he was pursuing the claim for a legitimate purpose, namely that he wanted to find out whether Lloyds had been misusing his personal data (e.g. by improperly disclosing it to a third party). Lloyd’s position on the motive issue was as follows: either Mr Elliot was pursuing the claim purely in order to further his interests in the prospective commercial litigation or this was the dominant motivation for the claim; either way the s. 7(9) claim was being pursued for an improper collateral purpose and, as such, amounted to an abuse of process.
Following Durant v Financial Services Authority [2003] 1746, the judge (HHJ Behrens) readily accepted that, if the claim was being pursued purely for the collateral purpose of furthering Mr Elliott’s position in other prospective litigation, that would amount to an abuse of process which would justify the claim being struck out. However, he went on to query what the position would be if Mr Elliott in fact had mixed motives (i.e. he wanted the data in order to further the prospective commercial litigation but also wanted to discover whether his data had in fact been misused by Lloyds). Having considered the judgment of the High Court in Iesini v Westrip Holdings [2011] 1 BCLC 498, the judge took the view that, in a case involving mixed motives, the test which should be applied was a ‘but for’ test. Thus, if the claim would not have been brought but for the claimant’s collateral purpose in furthering his interests in the other litigation, the claim would have been brought for an improper purpose and would be liable to be struck out as an abuse of process. On the other hand, if the s. 7(9) claim would have been brought irrespective of the other prospective litigation, then it was not an abuse of process. Notably, the judge rejected an alternative test proposed by Lloyds, namely that the s. 7(9) claim would be an abuse of process if the ‘dominant purpose’ of the claim was an improper collateral purpose. The judge concluded that the dominant purpose test could not be reconciled with the approach approved by the court in Iesini.
With respect to Mr Elliott, the judge concluded that: he had mixed motives in bringing the s. 7(9) claim; however, he would still have brought the claim in the absence of the prospective commercial litigation and, as such, his claim under the DPA was not an abuse of process.
Proportionate Search
On the proportionate search issue, Mr Elliott argued that a data controller was not entitled to limit the scope of its search for personal data by reference to concepts such as reasonableness and proportionality. Insofar as the concept of proportionality was relevant at all under the DPA, it was relevant not to the search process per se but rather to the process of supplying the data to the applicant once it had been located (see further s. 8(2)(a) DPA which disapplies the general duty to provide the applicant with ‘a copy of the information in permanent form’ in circumstances where the supply of such a copy ‘is not possible or would involve disproportionate effort’). In support of these arguments, Mr Elliott relied on guidance published by the Information Commissioner.
Lloyds argued that this was not the correct approach and that, following Ezsias v Welsh Ministers [2007] All ER (D) 65, it was not obliged under the DPA to conduct a search requiring unreasonable or disproportionate effort. Lloyds further contended that, to the extent that the Commissioner’s guidance took a different view of the principles approved in Ezsias, the guidance was wrong and ought not to be followed. Lloyds argued that it would be disproportionate to conduct the further searches demanded by Mr Elliott. The judge accepted Lloyds’ case on the disproportionate effort issue. He agreed that the further searches sought by Mr Elliott were disproportionate and, hence, were not required under the DPA.
The court’s judgment on the proportionality issue is likely to offer considerable relief to data controllers, many of whom struggle under the burdens imposed by wide-ranging subject access requests. It remains to be seen whether the Commissioner will, in response to this judgment, seek to review his guidance. As for the judgment on the motive issue, it is worth noting that the court heard evidence directly from Mr Elliott on this issue and, further, that it found him to be ‘an honest witness’.
Finally, it is worth noting that, despite having won on the disproportionate search issue, Lloyds was still required to pay a substantial part of Mr Elliott’s costs. This was in no small part because Lloyds had disclosed a substantial amount of new data following the lodging of Mr Eliott’s claim. 11KBW’s James Cornwell acted for Lloyds.
Anya Proops