The Court of Appeal recently refused to exercise its discretion under the Data Protection Act 1998 (the DPA) to order data controllers to take further steps in data subject access compliance. The case sets out helpful guidance on (1) what is personal data; (2) the DPA domestic purposes exemption; (3) the purpose or motivation for a DSAR; (4) proportionality of searches; and (5) the exercise of court discretion.
The court made clear that:
- a data controller's implied obligation to search for documents is limited to what is reasonable and proportionate; and
- data controllers cannot object to a DSAR made in connection with actual or contemplated litigation.
Purpose and Motivations for the DSAR
The court also explained that in exercising its discretion, it will look at a number of factors, including the requester's motivations in order to strike the right balance between data subject access rights and data controller interests.
The "absence of a legitimate reason" for the DSAR may have a bearing on the exercise of the discretion, "even though a collateral purpose of assisting in litigation is not an absolute bar".
Beware! Motives and the overall conduct of the requester may have adverse cost consequences in litigation.