The High Court has refused an application to make an order for compliance with subject access requests sought under section 7(9) of the Data Protection Act 1998 (DPA).
The application was made by family members involved in ongoing litigation in the Bahamas brought by them against a Bahamian trustee company, which was a client of a law firm. Subject access requests were made by a mother and her two children for all data held about them by the firm, as the litigation involved the firm's client's actions in relation to the trust.
The firm claimed they were entitled to a blanket exemption for legal professional privilege under section 10, Schedule 7 of the DPA, so did not comply with the subject access requests. The firm also claimed that some of the information held was contained in unstructured manual files which were not a "relevant filing system" for the purposes of the DPA, therefore not relevant to the requests.
On the facts and under the disproportionate effort exemption in section 8(2) of the DPA it was held that it was not reasonable or proportionate for the firm to search files dating back at least 30 years. The High Court held that the firm should not have to carry out lengthy and costly searches to determine whether the information requested was protected by legal professional privilege, in order to comply.
The court held that the legal professional privilege exemption in paragraph 10, Schedule 7 of the DPA should not be interpreted to provide the claimants with information or documents which may assist them in litigation.
The court made further comments in relation to considerations in exercising discretion to order compliance with a subject access request under section 7(9) of the DPA, abuse of process in bringing subject access requests and DPA relevant filing systems.
To read the full decision, please click here.