This looks at compliance with requests by individuals for information an organisation holds about them (subject access requests).
The case involved a subject access request (SAR) by the beneficiaries of a Bahamian Trust to Taylor Wessing LLP (TW), who acted on behalf of the trust. There are various exemptions to a SAR request within the Data Protection Act (1998), including where the data is subject to legal professional privilege (LPP). TW declined to comply with the SAR primarily on this basis. The High Court agreed that the exemption was engaged, and controversially reached the following conclusions on subsidiary issues:
- In deciding whether TW was under an obligation to search the information held to establish if it was subject to LLP- the court found that TW’s obligation was to conduct a reasonable and proportionate search
- In deciding whether the purpose of the SAR being for use in litigation was relevant- the court found it was not a proper purpose.
The above decisions had a significant impact. They opened up new situations in which a data controller could decline to comply with a SAR.
The Court of Appeal has recently overturned the High Court decision and ordered that the SAR be complied with, with the exception of the data that attracts LLP.
Further the Court of Appeal clarified:
- TW had not shown compliance, and more than just an assertion that it is too difficult to search volumes of papers is required
- The High Court had been wrong to decline to enforce the SAR on the basis that its use in litigation was an improper use.
This is summed up at paragraph 114 of the judgement which states: “the most material considerations are that the validity of the Request is not in doubt and the efforts so far to comply with the request have been inadequate”.
The full judgment can be found here: http://www.bailii.org/ew/cases/EWCA/Civ/2017/74.html