Court refuses to order compliance with Data Protection Act
The ability of an individual to require their employer to provide details of the personal data held about them is regarded by the Information Commissioner as a “fundamental right”. But these requests are often used as a tool in disputes between employers and employees and employers will usually agree to comply with requests because of the risk that refusal to comply will breach the Data Protection Act.
So employers will welcome the ruling in the next case in which the court refused to order compliance with a request for data where the search required to comply with the request was neither reasonable nor proportionate.
In that case, beneficiaries of a trust fund were in litigation with the Bahamian trust company that administered the trust. The beneficiaries served subject access requests on the London solicitors to the trust company.
When the solicitors refused to comply with the requests, the beneficiaries applied to the High Court to compel the solicitors to comply with the requests. The application was refused.
The judgment contains useful comments on several aspects of subject access requests under the Data Protection Act.
Purpose of subject access rights and motive behind requests
The court stated that the purpose of DPA subject access provisions is to enable an individual to check whether his data is being processed unlawfully and to take steps to protect his data. It is not to enable the individual to obtain documents that may assist him in litigation.
In this case, the claimants did not make any argument about their data was being processed in infringement of their privacy and the lack of evidence as to motive in making the subject access requests led the court to infer that requests were to obtain documents for use in the Bahamian litigation.
Reasonable and proportionate search and the disproportionate effort exemption
The court ruled that under the disproportionate effort exemption in the DPA, a data controller is only required to supply such personal data in response to a subject access request as is found after a reasonable and proportionate search.
On the facts, the judge agreed with the solicitors that it was not reasonable or proportionate to expect them to carry out the necessary search to determine if any particular document was covered by privilege. Deciding whether a document was protected by privilege was time consuming, required consideration by skilled lawyers and so would be costly.
This case provides useful guidance particularly in relation to the DPA's disproportionate effort exemption, which was applied here to justify non-compliance with the subject access requests.
Subject access requests are often used by ex-employees in dispute with their former employers. In many cases, it will be time consuming and costly to respond to the request but employers often agree to comply, despite the effort required, because of the risk of being in breach of the Act.
Accordingly, this case provides some comfort to employers who argue that the effort to locate the data requested would be disproportionate and unreasonable.
But can employers be confident about what the courts will do in similar cases? Probably not. The claimants in this case were granted permission to appeal. As matters stand the decision leaves employers uncertain about their obligations under the DPA.
If you would like advice about how the issues in this note apply to your situation, please contact Tony Brown on 01225 740097 or by e mail to email@example.com
Warning - this bulletin is provided for information only and is not a substitute for legal advice. You should obtain specific, personal advice about your circumstances and not rely on the information or comments in this bulletin.