Some long-running litigation is the gift that keeps on giving. Some is Dawson-Damer v Taylor Wessing LLP [2020] EWCA Civ 352, back to the Court of Appeal for the second time and very much a case of diminishing returns. Unless you are a trusts lawyer, particularly in the Bahamas, or fascinated by filing systems. And who isn’t one of those things?
Having lost in the Court of Appeal the first time around on the scope of the legal professional privilege and the scope of the obligation to search in response to a subject access request, regardless of motive – [2017] EWCA Civ 74 (on which see here) – Taylor Wessing’s compliance led to a further round of litigation. Of relevance to the two issues on the appeal, the judge at first instance – Andrew Hochhauser QC sitting as a Deputy: [2019] EWHC 1258 (Ch) – held that a batch of 35 paper files under the descriptions ‘Yuills Trusts’ was not a “relevant filing system” for the purposes of s1(1) DPA 1998, but that under the law of the Bahamas there was no joint privilege permitting the beneficiary of a trust to see legal advice to the trustee, and that Taylor Wessing were entitled to rely on the legal professional privilege exemption found in para 10 of Schedule 7 to the DPA 1998.
So far, so simple.
Both sides appealed. The Court of Appeal first considered the LPP issue. Although this covered [20]-[54] of the judgment, and involved extensive citation of trusts law authorities, it is unnecessary to address the details of the reasoning here, or anywhere other than a specialist trusts law tome. In effect, the Court of Appeal held that in domestic English law a trustee cannot rely on LPP as against the beneficiary, is a matter of domestic procedure and so is not to be determined by Bahamian law, and therefore fell outside the protection of LPP. This is unlikely to give rise to extensive application in other DPA cases outside of a subject access request being made in a directly analogous trust dispute context. But it is nice to know data protection law can reach its tentacles into such abstruse areas. Truly it is the law for all lawyers.
What will get the data protection readers’ juices flowing is the second issue: whether some paper files in chronological order, every page of which would need to be reviewed to extract personal data, fell with the scope of the term “relevant filing system” for the purposes of s1(1) DPA. This arose in particular because they were no longer protected by LPP, given the first issue. The Court of Appeal considered the terms of the Directive and the DPA, the reasoning in Durant v Financial Services Authority [2003] EWCA Civ 1746, the CJEU’s approach in Case C-25/17 Tietosuojavatuutettu (EU:C:2018:551) (see here), and the ICO’s guidance which suggested a rule of thumb be whether a temp could extract specific information about an individual without particular knowledge of the type of work or the documents.
The Court of Appeal described the CJEU’s approach as a “functional one of whether specific criteria enable the data to be easily retrieved”: at [83]. It held that the approach in Durant at [50] (that files be structured in such a way as to clearly indicate at the outset of the search whether specific information is held in the system and if so in which file) was inconsistently restrictive compared to that of the CJEU, which simply requires that ready access to the information is in fact enabled. Nor could the approach of Durant that manual records are only caught by the DPA if they provide the same or similar ready accessibility as a computerised filing system survive: at [88]. Nothing in Article 8 of the Charter altered the analysis: at [94].
The questions, at [90], are accordingly: “First, are the files a “structured set of personal data”? Secondly, are the data accessible according to specific criteria? Thirdly, are those criteria “related to individuals”? Fourthly, do the specific criteria enable the data to be easily (or “readily” as the 1998 Act puts it) retrieved?”
It was in relation to this fourth question that the Court found the judge to have erred. The files related to individuals only in a very broad sense – which is relevant to ease of access: at [96] – and the need to use a trainee and an associate to review the files page by page, with a senior lawyer to review for LPP, indicated that the data was not easy to access at all from the (un)structured nature of the files. The Court considered the ‘temp test’ of the ICO to be a useful rule of thumb, and that it was clearly failed on the facts: at [99]-[100]. The 35 files were not a relevant filing system.
Timothy Pitt-Payne QC appeared for Taylor Wessing LLP.
Christopher Knight