In the latest development the matter was remitted to the High Court following a landmark decision in the Court of Appeal whereby Taylor Wessing was ordered to review their files and release personal data held on the claimant-beneficiaries. Taylor Wessing reviewed their electronic files but refused to review their paper files on the grounds that these did not constitute a “relevant filing system” under the Data Protection Act (DPA). The High Court rejected that argument and found that:
- Taylor Wessing’s 35 paper files should be searched and personal data disclosed to the claimants;
- Under English law, beneficiaries enjoy joint privilege with trustees in respect of advice taken by the trustees for the benefit of the trust; and
- The searches carried out by Taylor Wessing were insufficient to discharge their duties under the DPA
In this age of transparency, this case continues to clarify important aspects of the DPA and the rights of individuals to access their personal data. The most recent decision confirms that paper files are not exempt from the scope of the Act and must be searched for personal data. It also confirms that, as a matter of English law, a beneficiary is part of the circle of privilege in relation to legal advice taken by the trustee for the benefit of the trust and in the absence of litigation privilege, trustees and beneficiaries have joint privilege in legal advice.
Although the DPA 2018 has introduced a provision to protect lawyers from the need to make disclosure of information which is confidential to their clients, this decision will affect other professionals: trustees, company directors and other fiduciaries who must take note and take appropriate steps to disclose personal data upon request. It is also an important one for private individuals who wish to know what data is held on them, by whom and for what purpose. In appropriate cases, individuals have the right to correct erroneous records as well as the right to be forgotten – but those rights can only be exercised if they know what data is being held by the data controller in the first place. This decision goes some way to protect those rights and safeguard the interests of individuals as intended by the DPA.
For previous reports and background on this case, please click here.