Durham County Council v Dunn [2012] EWCA Civ 1654

06 November 2012

The Court of Appeal has considered how courts should apply disclosure obligations under the Civil Procedure Rules (CPR) so as to comply with privacy rights, including those under the Data Protection Act 1998 (DPA).

The parties had focussed on s.35 DPA, which provides an exemption from those provisions of the DPA that would otherwise prohibit disclosure where disclosure is required in the context of litigation.

The Court of Appeal noted that this mistaken: the Civil Procedure Rules govern whether or not information should be disclosed and it is CPR 31.3(b) which allows documents to be withheld from inspection, not the DPA. The Court of Appeal noted that this provision was "wide enough to include claims for legal professional privilege, public interest privilege/immunity and a statutory duty to protect data or to avoid a breach of a third party's Article 8 human rights". The Court of Appeal noted that courts must undertake a balancing exercise between, on the one hand, a party's right to a fair and, on the other, the privacy or confidentiality rights of the party to whom the data relates .

Interestingly, in passing, the court noted that the data controller's obligations under section 7 of the DPA are expressed, not in terms of disclosure of documents, but by reference to communication of "information". The Court suggested (obiter) that it may be possible to comply with this obligation by preparing a digest of information – ie without disclosure of the actual documents which contain the information. This is a useful pointer for those dealing with subject access requests where documents contain a mix of personal and non-personal, or exempt, data: it may be easier to extract personal data to be provided to the data subject, than to redact information that is not to be released.

The full judgment can be read here.