Under the Data Protection Act (DPA) 1998, individuals can ask a data controller for details of information held about them. In Dawson-Damer and ors v Taylor Wessing LLP and ors, the Court of Appeal held that courts should order a data controller to comply with a request from a data subject, whatever their motive for making the request.
Basic facts
A dispute arose relating to the distribution of funds from a trust held in the Bahamas. The beneficiaries of the trust made three subject access requests in 2014 to Taylor Wessing LLP, the London solicitors, whose client was the Bahamian company who had administered the trust (the trustee). They enclosed a cheque for £30 to cover the cost of each request.
Taylor Wessing refused to comply on the ground that they were covered by legal professional privilege (LPP) and therefore exempt under schedule 7 of the DPA. Mrs Dawson-Damer and her two children therefore asked the court to order Taylor Wessing, the data controller, to comply with their request under section 7(9) of the DPA. They also commenced proceedings in the Supreme Court of The Bahamas against the trustee.
High Court decision
The High Court dismissed the claim on the following basis:
- Legal profession privilege did apply and covered any documents which the trustee could refuse to disclose to the beneficiaries under Bahamian trust law.
- It was not reasonable or proportionate for Taylor Wessing to carry out any search or to expect them to decide which documents were privileged given the wide definition of legal professional privilege. This may have to be resolved in the Bahamian proceedings.
- The judge was entitled to refuse to exercise his discretion under section 7(9) DPA because the motive behind the request made by the beneficiaries was to use the documents in legal proceedings against the trustee.
Court of Appeal decision
The Court of Appeal took a very different approach. Firstly it held that the legal professional privilege exemption only relieved a data controller from complying with a subject access request if there was a relevant privilege according to the law of the UK; and did not therefore necessarily cover any documents which the trustee could refuse to disclose to the beneficiaries under Bahamian trust law.
As to whether the request would involve a “disproportionate effort” on the part of Taylor Wessing to identify personal data, the Court held that it was for the firm to provide evidence to substantiate this claim. As it had “singularly failed” to do so (it had simply carried out a review of its files to date), the Court could not say whether any particular steps would be disproportionate or not. This had to be evaluated in each particular case as to whether it would involve disproportionate effort to find and supply the information as against the benefits it might bring to the data subject. On this basis Taylor Wessing would be required to produce evidence to show what it had done to identify the material and to work out a plan of action.
Finally, it held that data subjects should not have their subject access requests denied just because they had a “collateral purpose”, such as providing assistance in other proceedings. There was nothing in the DPA or the relevant European directive which required them to meet a “no other purpose rule”. The court concluded that it should not withhold relief under section 7(9) unless there were overriding reasons to do so. As there were none here, it allowed the appeal.