The High Court has refused to order compliance with a data subject access request on the basis that it was made for an improper purpose, and where the search required to locate documents would not be reasonable or proportionate.
Individuals often submit data subject access requests to their current or former employers under s.7 Data Protection Act 1998 (DPA 1998) in order to obtain documents in connection with some broader dispute, such as grievances, disciplinaries or even ongoing litigation. Complaints about subject access requests can be made to the Information Commissioner's Office (ICO) or to the County/High Court. The Courts have generally declined to order compliance with subject access requests made for improper purposes (such as to obtain documents in connection with litigation). In contrast, the ICO has underlined its views that the right to make a request is "purpose blind", although in practice enforcement action on the part of the ICO is rare.
In this case, the claimants were in dispute with a trustee company based in the Bahamas. The claimants submitted individual subject access requests to the trustee's solicitors based in the UK, seeking copies of all personal data held by the solicitors relating to them. When the solicitors declined to comply with the request, the claimants applied to the High Court for an order requiring compliance.
The High Court declined to exercise its discretion to order the solicitors to comply with the subject access requests. In reaching this decision, the Court considered that the requests had been made with the improper motive of seeking documents in connection with the litigation against the trustee in the Bahamas, as opposed to any proper purpose connected with the protection of their privacy. The Court also accepted the solicitors' contention that most if not all of the documents which they processed containing the claimants' personal data were exempt from disclosure on the basis of the legal privilege exemption set out in the DPA 1998. The Court was prepared to interpret this exemption broadly. Significantly, the Court went on to follow an earlier decision in which it held that a 'reasonable and proportionate' search for personal data was sufficient to comply with a subject access request, despite the fact that this qualification does not appear in the DPA 1998 and that the ICO has openly disagreed with this perspective. Applying this principle to the present case, it was not reasonable and proportionate for the solicitors to conduct a review of all of their files to ascertain if any personal data was being processed outside of the boundaries of privilege. It is understood that this decision is subject to an appeal.
What does this mean for employers
Employers are often vexed at the prospect of undertaking the time-consuming and costly exercise of searching for documents containing an individual's personal data in response to a subject access request, particularly where the request is being made in the context of some broader dispute between the parties. This decision provides further scope for employers to take a pragmatic approach when responding to requests made in this context, taking account of the individual's motive for making the request and also whether a reasonable and proportionate search for the personal data is possible.