The Information Commissioner’s Code of Practice on Data Protection steadfastly maintains that data controllers cannot refuse to respond to a subject access request unless one of the specific exceptions in the Data Protection Act 1998 (“DPA”) applies. However, there is a growing body of case law on the circumstances in which the courts will refuse to enforce compliance with subject access requests under s 7(9) of the Act, even where one of the specific exceptions under the Act does not apply. See previous Panopticon posts on this subject here and here.
In a judgment handed down on 6 August 2015, HHJ Behrens (sitting as Judge of the High Court) considered a refusal by Taylor Wessing LLP (“TW”) and two individual defendants to respond to a subject access request made by a family involved in legal proceedings in the Bahamas concerning a discretionary settlement known as the Glenfinnan Settlement. TW’s client (Grampian) is the sole trustee of that Settlement.
TW resisted the family’s application for an order under s 7(9) requiring compliance with the subject access request on the following bases:
- The data in question was covered by legal professional privilege as it is only processed by TW in connection with their capacity as legal advisors;
- Some of the information was held in manual files and not in a relevant filing system for the purposes of the DPA;
- It was not reasonable or proportionate to expect TW even to carry out a search for the information and to assess what was covered by privilege and what was not;
- As a matter of discretion the Court should refuse to make an order under s 7(9) because the application had been made for improper purposes.
The Court’s ruling on each of these issues is worthy of note. The full judgment is available here.
Legal professional privilege
Paragraph 10 of Schedule 7 to the DPA provides a specific exception for “information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality as between client and professional legal adviser, could be maintained in legal proceedings”. The family argued that this exception was restricted to English law professional privilege and did not extend to documents that were covered by Bahamian rules on disclosure or which were subject to equitable rules in English trust law about non-disclosure of information to Trust beneficiaries. HHJ Behrens did not accept these submissions. He considered, following Durant v FSA [2003] EWCA 1746 that a purposive approach is to be taken to interpretation of the DPA and that the exception in para 10 of Sch 7 was not to be strictly construed. Adopting a purposive approach, he held that the exception was to be construed as if it applied to any documents in respect of which there is a right to resist compulsory disclosure in legal proceedings. Accordingly, it covered all the documents in respect of which the parties would be entitled to resist compulsory disclosure in the Bahamian proceedings, even though these were not covered by the English doctrine of legal professional privilege. This is a novel interpretation that may receive further attention from the courts in due course.
Relevant filing system
HHJ Behrens referred to the observations of Auld LJ in Durant in relation to the meaning of ‘relevant filing system’ for the purposes of the DPA. Auld LJ held (at [48] of Durant) that “Parliament intended to apply the Act to manual records only if they are of sufficient sophistication to provide the same or similar ready accessibility as a computerised filing system. That requires a filing system so referenced or indexed that it enables the data controller’s employee responsible to identify at the outset of his search with reasonable certainty and speed the file or files in which the specific data relating to the person requesting the information is located and to locate the relevant information about him within the file or files, without having to make a manual search of them. To leave it to the searcher to leaf through files, possibly at great length and costs, and fruitlessly, to see whether it or they contain information relating to the person requesting information and whether that information is data within the Act bears … no resemblance to a computerised search”. Although HHJ Behrens did not ultimately determine whether TW’s filing system satisfied the definition of ‘relevant filing system’ he indicated that as it appeared that documents within the manual files were not chronologically arranged or filed in any way by reference to individuals, they may well fall outside the scope of the Act.
Disproportionate effort
Section 8(2) of the DPA provides that a data controller need not supply copies of information “in permanent form” if that would require “disproportionate effort”. The Information Commissioner in his Code of Practice is keen to minimise reliance on this exception stating, “You cannot refuse to comply with a SAR on the basis that it would involve disproportionate effort, simply because it would be costly and time consuming to find the requested personal data held in archived emails.” And: “We stress that you should rely on the disproportionate effort exception only in the most exceptional of cases. The right of subject access is central to data protection law and we rarely hear of instances where an organisation could legitimately use disproportionate effort as a reason for denying an individual access to any of their personal data. Even if you can show that supplying a copy of information in permanent form would involve disproportionate effort, you must still comply with the request in some other way.” However, in this case HHJ Behrens referred to his own earlier judgment in Elliott v Lloyds TSB Bank and Hickinbottom J’s decision in Ezsias v Welsh Ministers before summarising the position in relation to s 8(2) as follows: “A data controller is only required under s 8(2) to supply the individual with such personal data as is found after a reasonable and proportionate search”. This is arguably a significantly more relaxed approach than that taken by the Information Commissioner. It remains to be seen whether the Information Commissioner will amend his guidance in the light of this string of decisions.
In this case, HHJ Behrens went on to hold that it would not have been reasonable and proportionate for TW to carry out the search in this case. In reaching this conclusion, HHJ Behrens interestingly appears to have been influenced by the disproportionality of requiring ‘skilled lawyers’ to review documents for LPP when the applicant need only pay £10 for a subject access request.
Improper purposes
Section 7(9) of the DPA undoubtedly gives the court a discretion as to whether to order a data controller to comply with a subject access request. In a number of cases now the courts have ruled that this discretion enables the court to refuse to make such an order even if none of the exceptions under the DPA apply and therefore the data controller is breaching the Act by refusing to respond: see the previous Panopticon posts mentioned in the first paragraph of this blog. This case is another such. Although not necessary to his decision, as TW had already ‘won’ on the LPP and disproportionate effort points above, HHJ Behrens gave three reasons why he would not in any event have exercised his discretion under s 7(9) in this case:
- The real purpose of the subject access requests was to obtain information for used in connection with the Bahamian proceedings. HHJ Behrens was satisfied that the claimants would not have brought the applications at all were it not for the Bahamian proceedings. This was, following Durant, not a proper purpose for a request under the DPA;
- It would be unreasonable and disproportionate to order TW to comply with the request: the same points as were relevant to the s 8(2) exception were relevant to the s 7(9) discretion; and
- It was not a proper use of the DPA to enable the claimants to obtain documents that they could not have obtained in the Bahamian proceedings.
HHJ Behrens recognised that a number of points in his judgment were novel and indicated that he was therefore minded to grant permission to appeal, if permission were sought. Permission was sought and duly granted so expect to hear further from the Court of Appeal on these issues in due course.
Jonathan Swift QC appeared for the claimants.