Dealing with a data subject access request (SAR) served by an individual, whether or not that person is an employee, pursuant to s. 7 of the Data Protection Act 1998 can be very time-consuming. It entails the process of identifying the electronic material which refers to the individual in question and then analysing that material to assess whether it falls properly to be disclosed as personal data for the purposes of the DPA.
Data controllers (often employers) may on occasion be concerned that a SAR is being made as a ‘fishing expedition’ for the purposes of actual or intended litigation and the question then arises of whether they can refuse to comply on the basis that the SAR was not designed to force them to search for and reveal documentation outside the normal process of disclosure in actual litigation.
In Durant v Financial Services Authority in 2003 it was suggested that data controllers might be entitled to refuse to comply with a SAR where the individual making the relevant request had commenced or was considering the commencement of legal proceedings. The Information Commissioner’s view published in 2005 was that this was not the case, although the Commissioner did acknowledge two related points. First, the court may be reluctant to exercise its discretion to order compliance where it is clear that the purpose of the request is to fuel separate legal proceedings and, importantly, where the discovery rules under the Civil Procedure Rules would provide a more appropriate route to obtaining the information sought. Second, the Commissioner is also likely to take such matters into account when considering whether to exercise his enforcement powers.
This issue as well as the extent of the obligation to search for personal data was considered in the recent decision in Elliott v Lloyds TSB Bank Plc & Anor [2012] EW Misc 7 (CC). His Honour Judge Behrens, sitting at Leeds County Court, considered two key issues — first, whether Lloyds could resist compliance with Mr Elliott’s SARs on grounds of his ‘mixed motives’ in serving a SAR; secondly, whether the search to be conducted was required only to be proportionate. Lloyds TSB argued that Mr Elliott’s real or dominant purpose in pursuing the application was as a fishing expedition to further certain claims against Lloyds – his application for an order for compliance was an abuse of process and any relief should be refused. Mr Elliott argued that he had become suspicious that some of his personal data had been used improperly and had been given to people who had no right to it. In those circumstances he had commenced proceedings to ensure that his personal data had not been misused. Lloyds TSB had carried out extensive searches and disclosed substantial personal data to Mr Elliott and contended that it would be disproportionate for the court to order it to conduct searches in respect of the six individuals named by Mr Elliott.
In Elliott the judge accepted that, if the real purpose of the SAR is to obtain documents or information which might assist Mr Elliott in a claim against a third party, this would be an improper purpose, with the consequence that there would be no obligation to comply with the SAR and the court would refuse to make an order under s 7(9) of the DPA. By reference to a variety of case law, the judge held that, if it were found that Mr Elliott had mixed motives in bringing the application, it would not be an abuse of process unless it could be shown that, but for the collateral purpose, the application would not have been brought at all. A ‘but for’ test was applied.
The judge also held that the obligation of a recipient of a SAR is to supply only such personal data as is found after a reasonable and proportionate search. Mr Elliott wanted Lloyds to conduct a search in respect of six senior individuals for personal data about him but the judge accepted the argument that a proportionate search had already been conducted and that to search in respect of those individuals would go further than was proportionate as any information that those individuals might hold would be likely to relate to the relevant companies, rather than Mr Elliott, and that any information held would be likely to duplicate that found from searching less senior staff.
The Elliott decision does suggest that for now controllers in the UK can have some confidence that they can avoid endless and disproportionate searches for personal data and can resist searches which would not have been made but for the prospect of litigation. Nonetheless, a responsible controller will wish to consider any SAR received carefully to ensure that it is dealt with properly by reference to the individual making the request, any refocusing of the request which can be agreed to make it more proportionate and the principles set out in the case law and the Information Commissioner’s guidance.
However, looking forward, it is possible that the position may change once a directly applicable European Regulation (published in draft in January 2012 and perhaps 3–4 years from final adoption) is implemented. The UK courts in cases such as Durant and Elliott have been applying the more ‘controller-friendly’ language which is used in the DPA (ie the court ‘may’ order the disclosure) rather than that which appears in the Directive (Article 12 of which ‘guarantees’ the individual a right of access). One of the aims of the proposed new regime is to put all EU countries on a consistent footing (generally with regard to many data protection issues and not simply SARs). The UK has long been criticised for failing to implement properly the EU rules on subject access and there have been suggestions of ‘infraction’ proceedings on this point (and others) being brought by the Commission against the UK. Given the proposed reforms, these proceedings are now unlikely to be commenced. Nonetheless, it is notable that Article 15 of the draft Regulation has firmer language on subject access (no ‘may’ appears) and states that the European Commission (rather than the UK government or the UK regulator) is to specify the detail as to how that will work in practice. Clearly, the draft Regulation is still just that: a draft. It may change in the course of the legislative process. In the meantime, therefore, controllers will take comfort that they can rely on the judicial pragmatism demonstrated in the Elliott case and its predecessors for a while longer. But the position is likely to change.
Charles Wynn-Evans (Partner and Head of Employment Law) and Renzo Marchini (Counsel) are both at Dechert LLP, London.
