Court of Appeal considers a subject access request

The appellants sought the disclosure of personal data from the respondent via a subject access request ("SAR") under the Data Protection Act 1998 ("DPA"). The respondent refused to provide the data and the court rejected the appellants' application. An appeal was then brought to the Court of Appeal.

The Court of Appeal has now dismissed that appeal. In so doing, it confirmed that the legal professional privilege exemption at paragraph 10 of Schedule 7 of the DPA is expressly limited to legal professional privilege as traditionally defined by English law, and the law of any country outside of the UK is not applicable.

The DPA limits a data controller's obligations where the "supply" of the information requested by an SAR would involve disproportionate effort on the part of the data controller. However, the Court of Appeal indicated that it would not necessarily be disproportionate for lawyers to sift through large quantities of documentation to identify which documents are subject to legal professional privilege. (In considering this issue, the Court of Appeal indicated that the reference to the "supply" of information in the disproportionality exemption covers not only copying and physically supplying information, but also searching for documents). It was also indicated that searches will rarely be disproportionate.

Finally, in a significant move, the Court of Appeal held that an SAR would not be invalid if made for the collateral purpose of assisting with litigation. In so doing, the Court of Appeal confirmed the conclusion in Gurieva v Community Safety Development , in which it was held that dictum by Auld LJ in Durant v FSA [2003] was not authority for the proposition that a data controller can rely on purpose as a ground for refusing to respond.