Subject access requests and reliance on the legal professional privilege exemption

The Data Protection Act 1998 ("DPA") provides that material protected by legal professional privilege is exempt from the subject information provisions (the "LPP Exemption"). The defendant claimed the benefit of the LPP Exemption when served with a subject access request ("SAR") by the claimant.

A preliminary issue was whether it mattered why the defendant had made the SAR. There is currently uncertainty on this point: Some prior caselaw supports the view that the subject access regime is "purpose blind", whereas other cases support the view that a SAR cannot be made in order to obtain early disclosure for the purpose of present or contemplated legal proceedings. This matter is currently before the Court of Appeal and so the judge in this case did not rule on it. On the facts, though, he thought that there was a risk of a substantial overlap with disclosure in legal proceedings.

Warby J also accepted the general proposition that personal email accounts which are not processed by a company as the data controller do not need to be searched, but said that that proposition may not apply in an individual case: "A company director who has used a personal email account for corporate business may owe the company a duty to allow access to that account, if that is needed to enable the company to comply with a SAR. But I do not believe the company is bound to ask the question unless there is some sufficient reason to do so".

It was accepted that litigation privilege applied to the data in question. However, the claimant argued that the LPP Exemption could not be claimed where privilege was "designed to act as a cloak for crime or fraud".

The judge held that a strong prima facie case of iniquity had to be proven. The criminal conduct alleged here was unlawful obtaining of personal data (falling under section 55 of the DPA) by surveillance. However, the judge found, on the facts, that there had been no surveillance and held that "It cannot be said that the instruction of private investigators necessarily involves a breach of s 55, or even that it is inherently suspicious. That is clearly not the case".