Hot off the presses comes the first of the Court of Appeal’s two forays into data protection law this term: Dawson-Damer v Tayor Wessing LLP [2017] EWCA Civ 74.

It is an important decision and one well worth reading, particularly while waiting for round 2 (which has some overlaps) in Ittihadieh v 5-11 Cheyne Gardens / Deer v University of Oxford (likely to be handed down in the next month or so).

WHY IS IT WORTH READING?

Well, there are three issues discussed by Arden LJ in Dawson-Damer, all of which are of very significant practical importance to those working in the field (farmers being data subjects too).

(1) The extent of the LEGAL PROFESSIONAL PRIVILEGE [LPP] exemption in para 10 of Schedule 7 to the DPA.

(2) The existence and extent of a disproportionate effort limit on searches.

(3) The approach to be taken to the judicial discretion in section 7(9).

On all three issues, the Court of Appeal takes quite a different approach to that of HHJ Behrens QC at first instance: [2015] EWHC 2366 (Ch).

THE CONTEXT OF DAWSON-DAMER IS RELATIVELY SIMPLY STATED.

The data subjects are beneficiaries of certain Bahamian trusts for which Taylor Wessing, as data controller, is the legal representative of a trustee (or former trustee).

The data subjects made subject access requests under Section 7 DPA to Taylor Wessing against the context of some trust disputes in the Bahamas.

Taylor Wessing declined to respond to those requests, relying on LPP as a general answer.

LPP

The exemption for LPP in para 10 of Schedule 7 applies only to a claim to LPP which would be recognised in legal proceedings in the UK.

It does not extend to privilege under any other system of law. Had Parliament intended it to apply more widely, it would have said so and introduced relevant controls: at [42] and [44].

The LPP exemption does not extend to documents which are not the subject of LPP but which are the subject of rules of non-disclosure (such as a trustee’s right of non-disclosure), whether those rules are under English law or Bahamian law.

No such exemption has been provided in the DPA, and it is not inconsistent with the purposes of the Directive and the DPA so to hold: at [46], [51], [53]-[54].

Taylor Wessing is a data controller, regardless of whether it is an agent of the trustee.

It must claim privilege in support of its client but is otherwise in no special position: at [55]-[56]. (Briefly, there has been some confusion by solicitors and, apparently, their regulators as to whether or not they are controllers or processors. The judgment is clear on this point.)

PROPORTIONALITY

The issue of whether a disproportionate effort involves more than an assertion that the search would be difficult is an issue of the construction of section 8(2) DPA (which refers to the disproportionate effort in the supply of copies of personal data): at [74]-[75].

Contrary to the ICO’s Subject Access Code of Practice, disproportionate effort under section 8(2) is not restricted to supply of copies but includes difficulties which occur in the process of complying with the request which might result in supply. The general principle of proportionality in EU law applies at all stages: at [76]-[77].

The Directive emphasises the substantial public policy reasons for giving data subjects control over the data processed about them through a system of rights and remedies in the Directive, meaning that so far as possible, an SAR should be enforced: at [79].

It is plain almost beyond argument that on the facts of the case, including in the light of the conclusions on LPP, that

1. further compliance would not involve disproportionate effort, and
2. Taylor Wessing must provide evidence to show what it has done to identify personal data and the relevant plan of action, which it has not yet done, and
3. as a result of which no particular step can be identified as disproportionate: at [82]-[84].

COLLATERAL PURPOSE/MOTIVE AND THE SECTION 7(9) DISCRETION

Nothing in the Directive limits the purpose for which a data subject may request his data or providers data controllers with the option of not providing data based solely on the requestor’s purpose: at [107].

Nothing in the DPA has required the data subject to show that he has no other purpose, and it would have undesirable secondary consequences: at [108].

The position might be different if the application under section 7(9) was an abuse of the court’s process (although finding a mere collateral purpose would not normally be): at [109].

The (in)famous perceived contrary suggestions in Durant at [27] per Auld LJ have been misunderstood and taken out of context.

They emphasise only the limited nature of personal data and do not establish that a request was invalid if made for a collateral purpose: at [111]-[112].

The section 7(9) discretion should not be exercised because disclosure could not be obtained in the Bahamas under the governing law of the trusts. The purpose of the DPA is to confer rights on data subjects and not to administer a trust: at [113].

Because the discretion is general, it is better not to seek to limit it in any particular way: at [105].

FOOD FOR THOUGHT

There is much food for thought from the judgment of Arden LJ, but it is undoubtedly the case that it is a data subject-friendly judgment.

Whether it opens the floodgates may need to be awaited, and the second Court of Appeal judgment may yet add further clarity or some confusion.

We are halfway through the story, but the first half has left a significant highlights reel.

Source: http://bit.ly/2kDbqrX