KATHERINE APPS ON NEW DATA PROTECTION CASE FROM COURT OF APPEAL
Following the case of Durant v Financial Services Authority  FSR 573 it became common for an employer to resist providing disclosure to an employee who makes a subject access request under the Data Protection Act 1998 wholly or mainly in order to obtain material which would assist in pursuing litigation.
That reading of Durant had in recent years increasingly been doubted by the High Court: Kololo v Metropolitan Police Commissioner  1 WLR 3702 (Dingermans J); Lin v Commissioner of Police for the Metropolis  EWHC 2484 QB (Green J) and Southern Pacific Personal Loans Limited  EWHC 2485 (Ch) (Richards J).
It has finally been fully debunked by Arden LJ in Dawson v Taylor Wessing LLP  EWCA Civ 74 at . Arden LJ held that comments of Auld LJ in Durant had been interpreted out of context. Auld LJ:
- had held that “a person could not claim that something was personal data because it would assist him in obtaining discovery or in litigation or complaints against third parties,”
- but had not held that a data controller could resist a subject access request, or that a court would refuse relief, because the request was made for the purposes of litigation.
In Dawson beneficiaries of a trust had made a subject access request for personal data held by a law firm which had acted for the trustee. The Dawson beneficiaries were seeking to challenge the trustee’s decision to appoint several hundred million pounds from the trust to discretionary trustees (who were children of the lead appellant’s late husband’s brother).
The Court of Appeal held that:
- the law firm were entitled to rely on litigation privilege from the time after which the beneficiaries had written threatening to challenge the new settlement, but could not rely on any privilege before that date. The privilege exception in the Data Protection Act 1998 applied only to material protected under privilege in UK proceedings, not any privilege recognised only as a matter of foreign law (at ).
- the Judge at first instance had been wrong to have found that the subject access request need not be responded to because the disclosure was sought for a collateral purpose (at ). A court “should not withhold relief under section 7(9) unless there are overriding reasons to do so….There are none here” ( approved at -).
Dawson is now clear binding authority that an employer cannot refuse to respond to a subject access request purely on the basis that the information sought is sought wholly, mainly or even partly, for the purposes of litigation.
In employment tribunal litigation it can be difficult to assess prospects prior to disclosure. The issue fee, however has to be paid before that disclosure takes place. An early subject access request can therefore be hugely helpful for employee claimants.
- This will particularly be the case where an employee is seeking disclosure of email trails which refer to them, but which they were not copied to.
- Where a subject access request is less helpful is to seek information about comparators or statistics (as used to be covered by the questionnaire procedure). A comparator’s personal data (eg bonus sums or redundancy scores) will be that comparator’s personal data, but will not be personal data of the Claimant.
The utility of a subject access request should also not be discounted in other litigation:
- It is increasingly common in judicial review litigation where a claim relates to a decision about an individual for there to be a subject access request made at the same time as a pre action protocol letter.
- In commercial litigation brought by or against an individual where there is a suspicion that they have been personally targeted, a subject access request can provide a cost effective way of achieving early disclosure with minimal adverse cost risk.
Katherine Apps’ CV can be viewed here and is described in Legal 500 (2015) as “outstanding, confident, direct and eminently approachable.”
If you have any questions or comments on this piece, please do not hesitate to email the clerks at firstname.lastname@example.org.
Posted: 16.02.2017 at 16:03