Court of Appeal Decision: Data Protection and Rights to Access Data

Following a recent Court of Appeal case underlining that the motive for pursuing a Data Subject Access Request (SAR) was irrelevant (i.e. a back door route to get information to support litigation) comes a decision in two linked appeals.

Two recent Court of Appeal cases heard together have just resulted in a Judgment of crucial significance for those advising on and dealing with SARs.

SUMMARY

• The Judgment reinforced that the SAR is a right to information not documents.
• The exceptions to SARs are more limited than was previously thought. Motivation for the request is of limited relevant.
• Important guidelines on both SAR searches and the Courts discretion have been handed down.

IN MORE DETAIL

Some of the many points arising in the Judgment can be summarised as follows:-

• The importance of going back to basic definitions and, for example, analysing whether data is ‘personal data’ within the meaning of section 1(1) of the Data Protection Act (DPA).

• The need to read exactly what the SAR is. Section 7 of the DPA is detailed.  A SAR may not seek all information rights under Section 7.

• SARs do not extend to documents although many data subjects believe that they do. Whilst it is often proportionate and appropriate to supply documents it must never be forgotten that is not the data subject’s right.  If the purpose of the SAR is to obtain documents rather than the information, this may become relevant in the exercise of a court discretion and/or in the exercise of a costs order.

• The decision contains reminders of the key differences between Data Controllers and Data Processors.

• The Judgment touched upon some of those exemptions which are available to refuse legitimate SAR. Of particular interest is the discussion on the exemption for personal and household processing.  Whilst there are limitations to that exemption (so for example a surveillance camera installed on a private property to assist in security was essentially a purely personal or household activity such a surveillance, if it captures images of people in the public road, goes beyond the boundaries of the exception).  The comments made regarding this particular exception are of practical significance for most citizens.  Emails passing between friends asking for recommendations (for example for a good plumber) if not falling within the exemption might lead to many citizens being subject to the processing of personal data without registration with the Information Commissioner and therefore guilty of criminal offences.  In the words of Lord Justice Lewison ‘we must be cautious about criminalising what, for many people, are their ordinary activities’.

• Other exemptions from the right to access were examined in detailed including documents covered by legal professional privilege i.e. documents relating to the giving and receiving of legal advice.

• Guidance was given as to what constitutes a SAR under Section 7 DPA. There may be some ‘traps’ for Data Protection Officers and their businesses where individuals do not identify that a formal SAR within the meaning of the legislation has been made.

• As referred to in the other recent Court of Appeal decision of Dawson-Damer v. Taylor Wessing the motivation behind an SAR does not prevent it from being a statutory SAR which on the face of it should be complied with. The fact that the Data Protection Act is being used to obtain information for the purpose of litigation, or a dispute, is irrelevant to the need to comply with it.

• As Data Protection Officers will know, naturally much of a SAR will be data that the data subject already knows or indeed has supplied. That is not a reason to refuse the request.  A data subject is perfectly entitled to check that the data controller has recorded the correct data and to check the accuracy of any processing.  Again, the motivation behind an SAR is largely irrelevant.

• Guidelines on proportionality have been handed down. Where the data subject applies to the courts the courts are entitled to look at the purposes of the legislation; the underlying European Directive; the context and in that sense the motives of the request to decide whether or not to make an order.  However, in one of the two cases (Deer v. The University), of Oxford, the University of Oxford was criticised for not undertaking any search at all on the first occasion for various categories of documents.  Before the case came to the Court of Appeal the University of Oxford had already been subject to a court order which, in effect, criticised their initial response to an SAR and ordered them to carry out significant further searches and provide information.  It is apparent from the detail of the Judgment that the compliance with the previous order was extremely time consuming and costly but that in itself was not a defence to the SAR.  The current SAR fee of £10 can of course bear no reference to the actual costs of a reasonable and proportionate search (this will become even more evident under GDPR when the data subject can require an SAR within 1 month and no fee will be payable).

• In terms of the Courts discretion to make orders there is useful guidance. One relevant factor is whether there is a more appropriate route to obtain the requested information.  A second is the nature and gravity of the breach of Section 7.  A third is the reason for having made the SAR.  Whilst motive is not relevant in terms of compliance, if the application is made for the purposes of assisting in litigation or partly made for that purpose, that may have a bearing upon the exercise of the Court’s discretion.  Certainly a Court would consider an abuse of rights, e.g. a data subject who simply wanted the data controller to spend time and money.  It also might be relevant whether the personal data is of any real value to the data subject, or if they have already received data in or through another route.

• The Judgment contains useful guidance on practical steps to comply with an SAR.

• As for costs, motive may be relevant. In the Deer case there was a background of long-running employment litigation.  In the High Court the Claimant’s motives caused her costs order to be reduced by 25% and this was upheld by the Court of Appeal.

• Incidentally, whilst in the case of Dr Dere v. The University of Oxford, whilst Dr Dere had been successful in the High Court in obtaining an order that the University of Oxford had not fully complied with its obligations and whilst she had obtained a costs order in her favour, the Recorder’s decision that her motivations were relevant to the issue of costs causing a reduction in the costs ordered in her favour, was concluded as being within his discretion by the Court of Appeal. In other words, motive is irrelevant so far as an SAR is concerned but motive may not be irrelevant in relation to costs orders where the Court has a wide discretion.

For further information please contact Holly Dobson at [email protected] or on 0114 266 6660