While the original purpose of a DSAR is for data subjects to check the accuracy of their personal data held by a data controller, in practice DSARs are increasingly being used by litigants as a quick, inexpensive means of seeking interparty or third-party disclosure alongside or in advance of contentious proceedings.
The recent judgment in Ashley Judith Dawson-Damer and others v Taylor Wessing LLP and others provides some insight into the judicial treatment of DSARs in the context of ongoing litigation.
In that case the beneficiary of a trust sought to challenge the appointment of settlement funds and submitted DSAR requests to Taylor Wessing for copies of all her personal data held by the firm, including any personal data of her children. Taylor Wessing, the lawyers of the trust company, asserted legal professional privilege, declining to respond on the basis that it was not reasonable nor proportionate for them to carry out a search of their client’s files (dating back over 30 years), to determine whether or not particular documents were privileged.
In agreeing that Taylor Wessing could rely on the privilege exemption, the High Court judge referred to the purpose of the DPA which, pursuant to the EU Directive 25/46/EC, is to enable data subjects to obtain copies of their personal data so as to check whether the data controller’s processing unlawfully infringes their privacy and, if so, to protect their data by correcting any inaccuracies. The judge also noted that under the DPA the data controller is not required to provide copies of data which ‘would involve disproportionate effort;’ noting that the claimants had only paid £10 each to request the information.
The Taylor Wessing decision evidences the reluctance of English courts to enforce DSARs made for the purpose of obtaining information or documents to assist in litigation or complaints against third parties, especially where this will involve disproportionate and unreasonable effort and cost. This is in contrast to the ICO’s Code of Practice which states that ‘the purpose for which the SAR is made does not affect its validity, or your duty to respond to it…there is nothing in the Act that limits the purposes for which a SAR may be made, or which requires the requester to tell you what they want the information for.’
In practice, this case may be confined to its facts. As a law firm, Taylor Wessing sought to protect its clients’ privilege by undertaking a blanket application of the privilege exemption over all of its clients’ files, but it will be difficult – if not impossible – for a corporate entity to take the same approach. It is also worth remembering that, depending on the issues in dispute, much of the material provided in a DSAR response may be disclosable in any event as part of the litigation process.
It remains to be seen whether the scope to use DSARs as a litigation tool will be limited to the facts of this first instance judgment or widened by the Court of Appeal in a hearing scheduled for July 2016.