Professional services firms are increasingly seeing Subject Access Requests ("SARs") employed as a litigation tool, to obtain documents for use in litigation which might not otherwise be disclosable or for other strategic purposes relating to a dispute. The Court of Appeal's judgment in Dawson-Damer v Taylor Wessing LLP, handed down on 16 February, will have unwelcome consequences for firms on the receiving end of such SARs (which are made under s. 7 of the Data Protection Act 1998 ("the DPA")). In the judgment, Lady Justice Arden provides guidance on how the DPA's legal professional privilege exemption applies to SARs, and discusses what amounts to a proportionate search where a data controller holds privileged documents. Further, in what may be the most significant aspect of the decision, the Court confirms that an SAR is not invalid where it is made for the collateral purpose of assisting in litigation. Below we discuss the Dawson-Damer decision in some more detail, and explore steps that can be taken by professional service firms, both to prepare for SARs, and to respond effectively when they are received.

Background

Mrs Dawson-Damer and her two children ("the Appellants") are the beneficiaries of various Bahamian trusts. Taylor Wessing ("the Respondent") is the trustee's legal representative.

In August 2014 the Appellants sought the disclosure of personal data from the Respondent via an SAR. The Respondent refused to provide the data, maintaining that it was exempt from disclosure under the DPA's legal professional privilege exemption at paragraph 10 of Schedule 7 ("the Legal Professional Privilege Exemption"). The Appellants disagreed, and applied to the Court to compel the Respondent to comply with the SAR.

The High Court dismissed the Appellants' application, ruling that: 1) the documents were exempt from disclosure under the Legal Professional Privilege Exemption; 2) it would require a disproportionate effort for the Respondent to search for documents which were not privileged; and 3) the Court could not require the Respondents to comply with the SAR because the Appellants had a collateral motive in making it.

The Appellants appealed against this conclusion and the Information Commissioner intervened.

The Court of Appeal's Decision

The Court of Appeal has overturned all three aspects of the High Court's decision.

i) The extent of the Legal Professional Privilege Exemption

The High Court had found that the Legal Professional Privilege Exemption applies so as to include all the documents of which disclosure can be resisted. The Respondent could therefore rely on the exemption because under Bahamian law a trustee cannot be compelled to disclose trust documents.

The Court of Appeal disagreed. It found that the Legal Professional Privilege Exemption is expressly limited to legal professional privilege, as traditionally defined by English law. The two main kinds of privilege recognised by English law are legal advice privilege and litigation privilege. In Dawson-Damer, the Court of Appeal interpreted the words "legal professional privilege" for the purposes of the Legal Professional Privilege Exemption as including both legal advice privilege and litigation privilege.

The Court of Appeal further held that although under trust law principles certain documents are not disclosable to the beneficiary of a trust, such documents are not subject to traditional legal professional privilege. Accordingly, recipients of SARs cannot withhold disclosure of these types of documents by relying upon the Legal Professional Privilege Exemption. Nevertheless, it follows from what the Court of Appeal has said that they can withhold documents that are privileged under English law, both on the basis of legal advice privilege and litigation privilege. In Dawson-Damer itself, it was common ground between the parties that the Respondent was entitled to withhold documents created after it became clear that there was a real threat of hostile litigation between the Appellants and the Respondent's clients. The Respondent could rely on litigation privilege to withhold such documents.

It was submitted by the Appellants in Dawson-Damer that joint privilege applied, as between trustee and beneficiary, to documents containing legal advice taken for the benefit of the trust. This would disentitle the trustee to rely on the Legal Professional Privilege Exemption in relation to such documents. In Dawson-Damer, the Court of Appeal did not need to address this argument directly. However, it remains to be seen whether, in a later case, the Courts are asked to decide whether a data controller's purported reliance on the Legal Professional Privilege Exemption can be resisted by the data subject claiming joint privilege in the documents to which the SAR relates.

ii) The proportionality of searches

The DPA limits a data controller's obligations where the "supply" of the information requested by an SAR would involve disproportionate effort on the part of the data controller ("the Disproportionality Exemption"). However, the Court of Appeal indicated that it would not necessarily be disproportionate for lawyers to sift through large quantities of documentation to identify which documents are subject to legal professional privilege.

In considering this issue, the Court of Appeal indicated that the reference to the "supply" of information in the Disproportionality Exemption covers not only copying and physically supplying information, but also searching for documents. Therefore, where a search would be disproportionate, the exemption can be relied upon.

However, the Court also indicated that searches will rarely be disproportionate, emphasising the public policy reasons underpinning SARs, and noting that attention needs to be paid to the potential benefit the requested information might bring to the data subject. Further, the Court of Appeal took the view that most data controllers can be expected to know of their obligations to comply with SARs, and to have designed their systems to enable them to make most searches for SAR purposes. It falls to the data controller to show that the supply of the information would involve disproportionate effort. Recipients of SARs cannot simply assert that carrying out a search would be too difficult. Evidence must be produced to show what has been done to identify the relevant material.

iii) The data subject's motive

This may be the most significant of the three issues considered by the Court of Appeal, especially for professional firms facing SARs from litigants (or potential litigants).

The Appellants are also involved in proceedings in The Bahamas against the trustee of the trusts. The documents sought under the SAR would clearly be of assistance to the Appellant in these proceedings, and are not disclosable under Bahamian law.

The High Court had found that it would not be a proper use of the DPA to assist the Appellants in the Bahamian proceedings. In reaching this conclusion, the judge considered that a "no other purpose" rule is implied by the DPA, so that a Court cannot require compliance with an SAR which is motivated not only by a wish to verify data, but also by a desire to obtain material for use in litigation.

This Court of Appeal ruled that this was an incorrect interpretation of the law. The Court noted that neither the DPA nor the EU Directive from which it originates limit the circumstances in which SARs can be made. In any event, the verification of data is unlikely to ever be the only motive behind SARs.

Ultimately, the Court found that an SAR would not be invalid if made for the collateral purpose of assisting with litigation.

(Note that Dawson-Damer has already been applied in the unreported case of Holyoake v Candy, in which a claimant was able to point to Dawson-Damer in recovering part of his costs of an unsuccessful claim for enforcing his DPA rights).

The future of SARs

It remains to be seen whether this decision, which will not be welcomed by data controllers, will "open the floodgates", leading to an increasing number of claimants and potential claimants trying using the DPA to their advantage.

However, there is no doubt that professional firms should ready themselves for this possibility. Lessons can be learnt from Dawson-Damer to assist firms in preparing for, and responding to, SARs:

  • Firms should consider whether the data systems they already have in place are appropriate. Having easily navigable document management systems will make responding to SARs easier and more cost efficient.
  • It is prudent for professional firms to have proper response systems in place in anticipation of receipt of an SAR.
  • If seeking to rely on the Legal Professional Privilege Exemption, firms should satisfy themselves that the relevant documents really are legally privileged in the traditional sense. If not, such documents need to be disclosed.
  • Even if the Legal Professional Privilege Exemption applies, a search cannot be completely avoided. It might be impractical to require staff to categorise documents as privileged and non-privileged at the point of creation. However, filing systems which allow for classification of documents (for example, flagging correspondence between lawyer and client) could help quickly identify whole categories of documents which may be exempt from disclosure.
  • Dawson-Damer appears to suggest that proportionality will rarely be a sufficient reason to justify the recipient of an SAR not even trying to carry out a search. However, if a firm believes that a search really would be disproportionate, a clear record should be kept of the basis upon which this conclusion was reached, including estimates of the time the search would take and the costs it would incur.
  • Firms should seek to limit the scope of SARs as far as possible: a firm can encourage a data subject to narrow their request, by requesting further information about when the data was processed, and what it was processed for.
  • Be aware of the deadlines: a data controller must respond to an SAR within 40 days.
  • Specialist legal advice may be necessary in order to determine how to respond to an SAR.