Yet another subject access judgment…

So, as the saying goes, you wait months for a subject access judgment, and then three come along at once. First it was Holyoake v CPC & Christian Candy (see Julian Milford’s post here); then it was Dawson-Damer v Taylor Wessing (see Chris Knight’s post here) and now, drum-roll, we have the joined appeals of Ittihadieh v 5-11 Cheyne Gardens & Ors and Deer v Oxford University [2017] EWCA Civ 121.

As ever with these cases, the facts are somewhat less than scintillating. Briefly:

  • Mr Ittihadieh had a relationship with a particular property management company which was…well…somewhat vexed. He submitted a SAR to the company, asserting that he was concerned about what the company and its directors had been doing with his data, relevantly the directors were all individuals who lived in the same building as Mr Ittihadieh (i.e. they were his neighbours and had a relationship with him in a personal capacity). Mr Ittihadieh made clear in his request that he intended in due course to bring claims against the company, its directors and the company secretary for discrimination, harassment and personal injury. The company disclosed some 400 documents in response to the request. Mr Ittihadieh was not satisfied with this response and so he brought a Part 8 claim before the High Court under s. 7(9) DPA. That claim was dismissed by HHJ Seymour QC. Mr Ittihadieh appealed to the Court of Appeal.
  • Dr Deer similarly had a rather vexed relationship with the relevant data controller, Oxford University. She submitted two SARs to the University against the background of ongoing employment tribunal litigation between herself and the University. Ultimately some data was disclosed in response to the requests. Ms Deer was not satisfied with the University’s response and so brought a Part 8 claim under s. 7(9). Upon hearing the claim, the judge, Recorder Hancock QC, ordered that the University should carry out further searches for data falling within the scope of the requests. In response to that order, the University ended up reviewing 500,000 documents at a cost of £116,000. That review resulted in 33 new documents containing Dr Deer’s personal data being disclosed. Other documents were withheld on the basis that they did not constitute Dr Deer’s personal data or were subject to the legal privilege exemption. Ms Deer was still not satisfied that she had received all the data to which she was entitled, and so the claim came back to court. The court, now in the shape of HHJ Harris QC, was satisfied that none of the withheld material constituted Ms Deer’s personal data. It also concluded that in any event it would not exercise its powers under s. 7(9) to order the University to take any further steps in compliance. Dr Deer appealed to the Court of Appeal. The University cross-appealed in response to the judge’s order that it pay 75% of Dr Deer’s costs up until the order of Recorder Hancock QC (HHJ Harris QC had reduced the costs by 25% on the basis of his conclusion that Dr Deer’s motive for pursuing the litigation was “essentially antagonistic”).

Here are the highlights of the Court of Appeal’s judgment:

  • The definition of “personal data” – The Court accepted that, in line with the approach to the definition of “personal data” approved in Durant v FSA, the mere fact that someone’s name is mentioned in a document does not without more mean that the document contains the individual’s “personal data”. The Court concluded that the Court of Appeal’s judgment in Edem v FSA did not cut across this conclusion, as that case was not about the mere disclosure of a name mentioned in a document but rather the names of the FSA officials who had dealt with a complaint made by the applicant (para. 66). The Court took the view that this approach to the definition of “personal data” was consistent with the CJEU’s judgment in the case of YS v Ministeer Voor Immigratie (para. 68). Thus, we seem to have come full circle back to the Durant orthodoxy on the application of the definition. However, it should be noted that the Court of Appeal also observed that data revealing a person’s whereabouts at a particular point in time may also amount to personal data, as they might be highly relevant, for example, to calculating sick pay or holiday pay or the investigation of a crime (para 67). Thus, in effect triangulation data may well qualify as personal data.
  • Scope of the domestic purposes exemption (s. 36 DPA) – This exemption had been invoked by the directors of the company in Mr Ittihadieh’s case, particularly in respect of information they claimed to hold, not as directors of the company but in a private capacity, as Mr Ittihadieh’s neighbours. The Court rejected arguments to the effect that the domestic purposes exemption was a narrow exemption which applied only to matters within the data controller’s own household. Whilst it did not seek to identify where precisely the line would be drawn in terms of the application of the exemption, it did conclude that data held by an individual in a personal capacity in connection with the management of a private block of flats in which he resided, including data about his neighbour, fell within the scope of the exemption. It also commented that an individual emailing a friend to get a recommendation for a plumber for his or her home would similarly fall within the scope of the exemption (paragraphs 75-76). The Court was clearly of the view that the narrow approach to s. 36 advocated on behalf of Mr Ittihadieh would produce wholly disproportionate results, including not least the risk of criminalising millions of people for failing to register as data controllers.
  • Exercise of the discretion under s. 7(9) – There has long been a question as to the extent to which the court may properly refuse to grant relief under s. 7(9) in a case where the court has found that there has been a breach of the Act by the data controller. In Dawson-Damer, the Court of Appeal declined to adopt a restrictive approach to the powers exercisable by the court under s. 7(9), and seemed to accept the principle approved by Auld LJ on an obiter basis in Durant to the effect that the discretion under s. 7(9) was “general and untrammelled” (para. 105). By way of contrast, the Court of Appeal in Ittihadieh/Deer seems to have preferred a rather more inhibited approach to the discretion. Thus, it makes clear that the ‘precedent fact’ that there has been a breach of the Act should ‘have a significant bearing on the way in which the court exercises its discretion’ and it expressly disagrees with Auld LJ’s (obiter) description of the scope of the discretion (paragraph 105). It does however go on to highlight the need for proportionality of approach (paragraph 107). Importantly, it also concludes that, as a matter of principle, if an applicant lacks a ‘legitimate reason’ for making a request, that can be a factor weighing against granting relief, although having a collateral purpose is not necessarily an absolute bar (paragraph 110). No doubt, we can now all look forward to some entertaining arguments in due course as to: (a0 how Dawson-Damer and Ittihadieh/Deer ultimately hang together and (b) how precisely an applicant’s motive weighs in the balance under s. 7(9).

In terms of the outcome, the Court dismissed the appeals brought by Mr Ittihadieh and Dr Deer. With respect to the University’s cross-appeal on costs (appeal against the order to pay 75% of Dr Deer’s costs up to the point where the Court ordered further searches), this was also dismissed. The nub of the University’s cross-appeal on costs was that, on a proper construction of the relevant judgments, there had been no finding to the effect that it had acted unlawfully in failing to carry out searches prior to the Recorder’s order. The Court of Appeal rejected this construction as being too narrow (paragraph 174). However, happily for the University, the Court of Appeal also upheld the judge’s decision that there should be a 25% reduction in view of Dr Deer’s “essentially antagonistic” motives in pursuing the SAR claim. Importantly, the fact of the reduction in costs itself indicates that “motive” arguments may come back to haunt an applicant, not only in terms of whether they ultimately obtain relief, but also whether they will face an easy ride on costs even if their claim succeeds.

And what does this all mean? Well of course it means that we are by no means at the end of the road when it comes to heavily contested litigation over the application of the SAR regime.

As ever, 11KBW was heavily involved in the appeal: Robin Hopkins appeared for the defendant in Ittihadieh (instructed by Stitt & Co); Timothy Pitt-Payne QC appeared for the University; Julian Milford and Christopher Knight appeared for the ICO, who intervened in the appeal.

Anya Proops QC