Employers are often vexed at the prospect of undertaking the time-consuming and costly exercise of searching for documents containing an individual's personal data in response to a subject access request, particularly where the request is being made in the context of some broader dispute between the parties. Guidance from the ICO is clear that the right of subject access is a distinct and separate right, and just because a data subject is in the process of legal proceedings with the data controller, this does not give a data controller the right to refuse to respond to a subject access request. The exemptions should be applied on a case by case, document by document basis.
However, this month, in the decision of Dawson-Damer and Ors v Taylor Wessing and Ors, employers have been given some scope to take a more pragmatic approach.
In Dawson, the High Court declined to exercise its discretion to order the solicitors to comply with a subject access request. In reaching this decision, the Court considered that the requests had been made with the improper motive of seeking documents in connection with the litigation as opposed to any proper purpose connected with the protection of their privacy. The Court also accepted the solicitors' contention that most if not all of the documents which they processed containing the claimants' personal data were exempt from disclosure on the basis of the legal privilege exemption set out in the DPA 1998. The Court was prepared to interpret this exemption broadly.
Significantly, the Court went on to follow an earlier decision in which it held that a 'reasonable and proportionate' search for personal data was sufficient to comply with a subject access request, despite the fact that this qualification does not appear in the DPA 1998 and that the ICO has openly disagreed with this perspective. Applying this principle to the present case, it was not reasonable and proportionate for the solicitors to conduct a review of all of their files to ascertain if any personal data was being processed outside of the boundaries of privilege. It is understood that this decision is subject to an appeal.
This decision provides further scope for employers to take a pragmatic approach when responding to requests made in this context, taking account of the individual's motive for making the request and also whether a reasonable and proportionate search for the personal data is possible.