The Court of Appeal has allowed an appeal in the case of Dawson-Damer v Taylor Wessing LLP [2020] EWCA Civ 352.
The case covered two issues, one of legal professional privilege which is not dealt with by this report, and a data protection issue.
The data protection issue was whether the 35 paper files held by Taylor Wessing under the description “Yuills Trusts” were “a relevant filing system” under section 1(1) of the Data Protection Act 1998. The first instance judge held that they were. They were held under the description “Yuills Trusts”, the client being the trustee of those trusts, and that the paper files were held in chronological order.
Taylor Wessing were given permission to appeal.
The court considered the legislation including the definitions of personal data and filing system and the case law, including the decision in Durant v Financial Services Authority [2003] EWCA Civ 1746; [2004] FSR 28. The court also referred to ICO guidance including the so-called “temp test”. It also considered the CJEU decision in Case C-25/17 Tietosuojavatuutettu on the meaning of a relevant filing system. In that case the CJEU did not consider the underlying Directive to be prescriptive as to the form of a relevant filing system. Instead, the test was the functional one of whether specific criteria enable the data to be easily retrieved.
The Court of Appeal said that in their judgment, the CJEU’s judgment in Tietosuojavatuutettu was not consistent with the interpretation of “relevant filing system” in Durant.
In the light of the decision in Tietosuojavatuutettu, the following questions must be asked:
- First, are the files a “structured set of personal data”?
- Secondly, is the information accessible according to specific criteria?
- Thirdly, are those criteria “related to individuals”?
- Fourthly, do the specific criteria enable the data to be easily (or “readily” as the DPA 1998 puts it) retrieved?
The Court of Appeal did not consider that the first instance judge had erred in approaching the matter on the basis of the CJEU’s judgment in Tietosuojavatuutettu.
Taylor Wessing also appealed on a point relating to the Charter on Human Rights. The Court of Appeal said that they did not think that anything was added by reliance on the Charter but it did not undermine the judge’s decision.
Taylor Wessing also appealed on the basis that the judge ought to have found that the 35 files were not structured by reference to criteria “related to individuals”. The files were held by reference to the corporate client. The Court of Appeal said that viewed in isolation, there would not appear to be much force in this point. A criterion may be closely related to an individual (for example it might be his or her name or National Insurance number), or it may be remotely related to an individual (for example the street in which he lives). The degree of specificity of the criterion does not preclude a finding that the criterion relates to an individual. One needs to bear in mind, nevertheless, that a very general criterion may be less likely to enable easy or ready access to the data. The Directive and the Act are clear in requiring a causative link between the criterion and ease of access of the data.
The final ground of appeal focussed on whether the criterion by which the 35 files were structured enabled the relevant data to be easily or readily retrieved. On this point the Court of Appeal said that the judge did err. Having concluded that the criterion “Yuills Trusts” related to individuals in a very broad sense, he then formed an assessment of how easy he thought the process of recovery of the personal data would be, relying on evidence that a trainee lawyer and an associate solicitor had in fact been able to extract personal data from the files, as well as the ability of a senior lawyer to identify documents subject to legal professional privilege.
That was an incorrect approach. The “ready access” required under the Directive and the DPA 1998 must be enabled by the criteria, ie, the structure of the files. If access to the relevant data requires the use of trainees and skilled lawyers, turning the pages of the files and reviewing the material identified, that is a clear indication that the structure itself does not enable ready access to the data. In fact, the 35 files were completely unstructured beyond their chronological compilation under the description “Yuills Trusts”. The first instance judge lost sight of the need for the causative link between that criterion and the ease of retrieval of the data.
The temp is “reasonably competent but without any particular knowledge of the type of work or the documents you hold”. Whilst this is no more than a rule of thumb, its application in this case did nothing to support a finding of ready access to personal data.
It followed, in the court’s judgment, that it was not established that the 35 files were a relevant filing system within the meaning of the 1998 Act. It therefore allowed the appeal.
