In a recent decision, the Irish High Court held that a court may order a person to make discovery of personal information that he or she has a right to obtain from a third party on foot of a data access request made pursuant to data protection laws. This judgment is particularly significant for individual litigants, especially where those parties are commencing discovery1 .
The case concerned a claim by a plaintiff company as against the defendant, a former employee, for injunctive relief and damages for breach of contract. The plaintiff company claimed that the defendant, who had taken up employment with another firm operating in the same field, assisted with the recruitment of other employees of the plaintiff and supplied the competing firm with confidential information concerning the plaintiff's business, including know-how and trading strategies.
The plaintiff had sought discovery of documents relating to the defendant's interactions with the competing firm and a recruitment company through which he was recruited, including documents that he could obtain on foot of a data access request.
The plaintiff argued that, as the defendant had a right as a matter of European law to obtain such documents, in particular, documents relating to any interview process conducted by a prospective employer, those documents ought to be discovered by him.
The Court considered that it was long established that documents ought to be discovered if they are relevant and necessary, provided that the request is proportionate and not unduly oppressive. It also acknowledged that a document is capable of being the subject matter of an order for discovery if the document, while not in the possession of a person, is one that he or she has a legal entitlement to procure or obtain.
In this respect, it was noted that, although the documents sought were likely to be held in offices in England, it was agreed between the parties that a person has a right to seek and inspect such personal data under the Data Protection Directive (EU Directive 95/46EC) (the "Directive") and the English implementing legislation (Data Protection Act 1988).
While the defendant argued that it was wrong to compel a person to use data protection processes to achieve a purpose which would be more properly achieved by way of non-party discovery, the Court was not persuaded by that argument. Ultimately, the Court recognised that the defendant had a legally enforceable right to seek certain documents. While the Court acknowledged that discovery must not be permitted to be oppressive and must be proportionate and that, in certain circumstances, non-party discovery may be more appropriate, there was no evidence of such oppression or disproportionality here.
The Court also dismissed the defendant's related argument that the request for discovery was an attempt to use data protection law and the Directive for a collateral purpose, noting that the primary purpose of the Directive did not matter if the effect of the legislation was to grant a person a right to certain information.
The defendant also sought to rely on a previous High Court decision in Glaxo Group Ltd & Anor v Rowex Ltd2 in which Mr Justice Barrett commented that a court ought not to compel inappropriate disclosures of personal data. However, the judge in the present case was not satisfied that, in this instance, documents relating to the course of engagement between the defendant, the competing firm, and the recruitment company leading up to his employment, were confidential or highly personally sensitive.
Although the Court agreed that documents obtainable by way of a data access request can be the subject of a discovery order, it directed that the defendant make discovery of documents that are "reasonably available to him" by way of a data access request and that this would require him to take "reasonable steps" to procure the documents by such means. In this regard, the Court recognised that the defendant may be unable to obtain such documents without challenging a refusal of access by the competing firm and/or the recruitment company, be it through a court or the relevant data protection body. The Court did not, however, provide any determination as to how far the defendant was required to pursue an individual request.
The interplay between data access requests made under the Irish Data Protection Acts 1998 – 2003 and litigation is coming more and more into focus. Data access requests are frequently used by individual litigants as a means of obtaining information prior to instituting legal proceedings or, prior to discovery. While there is nothing novel in holding that a party may be obliged to discover documents in respect of which he or she has a legally enforceable right to obtain, the recognition that such an obligation can extend to documents that he or she can obtain by way of a data access request is a noteworthy development.
The decision, which is currently the subject of an appeal, has potentially far-reaching consequences for individuals who are parties to litigation in that their obligation to discover documents has now arguably been broadened. While the Court sought to limit a person's obligations in this respect to taking "reasonable steps" to obtain such documents, no further guidance was provided in this respect. While this question will likely be assessed on a case–by-case basis, the lack of certainty may cause difficulty for some individual litigants.
The decision is also significant from the perspective of a party that is considering seeking non-party discovery, the costs of which are required to be borne by that party. Consideration should be given, in the first instance, as to whether documents are available to an individual who is a party to litigation by means of a data access request. Given that the Judge expressed a preference for making an order for discovery against a party to the proceedings, as opposed to engaging in the costly and cumbersome process of non-party discovery, there would appear to be some judicial support for this approach.
We understand that the Data Protection Commissioner has recently commented that compelling a person to exercise his or her right to obtain personal information in this manner would appear, on the face of it, to be at odds with a fundamental right to protection of personal data.