A recent High Court case gives some guidance on how the Courts may approach applications arising out of non-compliance with a subject access request (“SAR”). The case looked particularly at the ‘crime’ and the ‘legal professional privilege’ exemptions.
In the case, Gurieva and another v Community Safety Development (UK) Ltd (“CSD”), the issue was whether CSD, a private investigator company, had to comply with a SAR made by a Russian couple. The High Court ruled on 6 April 2016 that the private investigator did indeed have to comply with the request. The court held that some of the personal data held by CSD relating to the claimants may include some that is protected by the crime exemption and some that is protected by litigation privilege but it had not been proved that all of it was so protected. The case emphasises the importance of evidence in applications.
The case was heard by Warby J, who was a leading silk in media, entertainment, sports and regulatory law until he became a Justice of the High Court in June 2014.
The brief factual background is as follows. Mr Guriev and Mrs Gurieva (“Mr & Mrs G”), a Russian married couple, were the main beneficial owners of a Russian fertiliser producer, OJSC PhosAGro, floated on the London Stock Exchange.
Sometime later they received correspondence from a private investigator company, CSD, led by Tarique Ghaffur, former Assistant Commissioner in the Metropolitan Police, which appeared to suggest impropriety and that criminal proceedings had been initiated against them in Cyprus. In fact, a private prosecution had been initiated in Cyprus and there was no prosecution by the “prosecuting authorities in Cyprus”. Warby J stated that the correspondence from CSD was, objectively considered, intimidating.
Mr and Mrs G made a subject access request (“SAR”) to CSD requesting disclosure of all their personal data processed by CSD under Section 7 of the Data Protection Act 1998 (“DPA”) on the basis that they believed that CSD was holding inaccurate personal data about them.
CSD refused to comply and Mr & Mrs G sought an order requiring it to comply under section 7 (9) of the Data Protection Act (“DPA”). This section sets out the right to seek an order requiring a data controller to comply with its statutory duty and the court’s discretion in that regard.
CSD argued: (1) that the subject access request was not valid; (2) the personal data requested was exempt under the crime exemption and (3) the personal data was exempt under the privilege exemption. The Court was also asked to consider whether it should exercise its discretion to require compliance with the subject access request.
On point 1, the High Court ruled that the subject access request was valid; it had been submitted by a firm of solicitors who confirmed they had the necessary authority and this should be sufficient.
On point 2, it is generally hard to rely successfully upon the crime exemption under section 29. In this case the Court accepted that it was likely that some personal data held by CSD was processed for the purposes of detecting or prosecuting crime but no evidence was provided by CSD that all of it was. In fact there was evidence that CSD was processing it for other purposes as well and, accordingly, it would be wrong to give it a blanket exemption. Warby J was critical of CSD that it had not carried out, and provided the court with, a proper evidence based evaluation of the personal data held by it about Mr & Mrs G.
On point 3, the Court also refused to uphold the claim of a legal privilege exemption because CSD had provided little evidence in support of this argument. Instead it had argued that it was not reasonable or proportionate for it to undertake such a task (more on this below). In any event the court held that from what had been put before them the data was unlikely to attract privilege.
Lastly, Warby J confirmed that the Court’s discretion to enforce subject access requests will ordinarily be exercised in favour of a claimant who has made a valid subject access request in the absence of a good reason not to. CSD had provided no such reasons.
CSD had sought to rely on the case of Dawson-Damer and others v Taylor Wessing LLP and others in which the High Court refused an application to make an order for compliance with a subject access request because on the facts, and under the ‘disproportionate efforts exemption’ in section 8(2) of the DPA, it was held not to be reasonable or proportionate for the solicitors’ firm, to whom the requests were made, to carry out lengthy and costly searches of files dating back at least 30 years to determine whether or not information requested was protected by legal professional privilege.
CSD had undertaken a search and found 1,500 documents containing personal data about Mr & Mrs G and it was held that the task of separating this number of documents into those that were privileged and those that were not was a task that solicitors were used to dealing with.
CSD had also sought to rely on Dawson-Damer in another of its arguments: that the purpose of the subject access request was dishonest. In Dawson-Damer the Court held that the legal professional privilege exemption in paragraph 10, schedule 7 of the DPA should not be interpreted to provide the claimants with information or documents which may assist them in litigation. The judge in that case held that the real purpose of the subject access request was to obtain information to be used in legal proceedings in the Bahamas (where the rules of disclosure are different). There had been no suggestion that the claimant wanted to use the subject access request to check the accuracy of information held by the defendant and as a result it was held not to be a proper use of the DPA.
CSD tried to argue that the subject access request in their case had been made in order to find out information for the Cyprus proceedings. But in this case the court was not convinced that the subject access request had been made solely for this purpose. Instead the Court found that Mr & Mrs G had a legitimate concern that CSD was processing inaccurate data about them. Warby J conceded that there may have been mixed motives but this did not deter him from ordering compliance. He also said: “I have difficulty with the notion that the use of a SAR for the purpose of obtaining early access to information that might otherwise be obtained via disclosure in pending or contemplated litigation is inherently improper.”
The result in this case seems to be all about context. The case law on the Court’s discretion under section 7(9) of the DPA takes different approaches. Some judges take the view that the discretion is “general and untrammelled”; others take the view that disclosure should be allowed unless one shows good reason why it should not be. In this case, Warby said that the discretion to enforce being ordinarily exercised in favour of a claimant who has made a SAR in the absence of a good reason not to seemed “right” to him,– and consistent with “a recognition that what is at stake is a fundamental right”.
The Claimants’ appeal in Dawson-Damer starts on 19 or 20 July 2016. It will be interesting to see how much further clarity this brings on these issues.