A recent case has highlighted the restricted scope of SARs which will impact on the scope of investigation and the information the receiving party is required to release, making it harder for claimants to obtain information at an early stage.
Subject Access Requests
Subject Access Requests made under the Data Protection Act 1998 have become prevalent amongst many people who wish to access personal data from an organisation, such as banks and advisors. SARs cost the applicant £10, but the concern from those on the receiving end of requests is that they are frequently being used as a fishing exercise for prospective litigation and complaints.
What does a SAR entail and what is the process?
The provisions of the Data Protection Act 1998 were introduced to enable individuals to check what information is being held about them by a particular organisation, and whether it was being processed unlawfully or in a way that affected their right to privacy.
Upon receipt of a SAR, the organisation’s data controller must search through all of their electronic and paper archives (there is no limit on the period of time the search could relate to) to identify any data relating to the applicant. This includes relevant individual employee hard drives and email archives. Once identified, an assessment of the information must be made as to whether it falls within the scope of the relevant sections of the Data Protection Act 1998, whether it touches on any third parties who must consent to its disclosure or whether it should be redacted. Once complete, the information must then be produced in a format where it can be shared with the individual.
There is then of course the internal assessment of the level of risk and damage limitation for future litigation that the information to be disclosed might require. All of this needs to be completed within 40 days.
Guidance for individuals/ Current law & case law
Many individuals perceive SARs as an alternative and cheaper method to obtain disclosure of potentially useful information for impending litigation. However, individuals should be aware that the purpose of a SAR should not be to assist with litigation or to make complaints against a third party. This is reflected in the leading Court of Appeal decisions in Durant v Financial Services Authority  EWCA Civ 1746 and Edem v The Information Commissioner & Anor  EWCA Civ 92.
The recent high court decision in the case of Dawson-Damer v Taylor Wessing LLP  EWHC 2366 considered the extent at which a data controller is obliged to carry out searches upon receipt of a SAR. In this case, Taylor Wessing (a law firm) successfully resisted a SAR from the beneficiaries of a trust it had previously advised who were searching for documents to assist with litigation in the Bahamas. Taylor Wessing do not appear to have carried out an extensive search upon receipt of the SAR on the basis that any documents it revealed would be subject to legal professional privilege. Taylor Wessing argued that it was not reasonable or proportionate for it to have to determine which of any documents located were subject to privilege. Such an exercise would be a costly and time consuming exercise as it would require review by highly skilled lawyers. The Judge agreed and the request was denied.
The court also considered and showed sympathy to the argument used in the Durant case that manual filing systems that cannot be easily searched in the manner of a computerised filing system are not required to be searched as part of a SAR data search.
How does this affect future SAR applicants?
Individuals who wish to make a SAR now face the uncertainty of data controllers potentially withholding information, or in some cases rejecting SARs, based on what the data controller does not consider ‘proportionate’ and ‘reasonable’. This is particularly a cause for concern for many clients who wish to access personal data from organisations such as banks, which would hold a lot of information on a person.
It is not clear whether the recent decision will be appealed, but the Judge left the possibility open and made it clear that he considered that he had decided on an issue that would generate debate. As it stands, the decision is a very helpful one for those organisations on the receiving end of SARs as this may restrict the extent at which data controllers will need to carry out searches subject to the ‘proportionality’ guidelines.
Combined with the recent hike in court fees, this ruling further limits the opportunity for potential claimants to embark on litigation to settle disputes.
Faser Iqbal is a Paralegal in the Group Litigation department at Slater and Gordon Lawyers in London.
If you need legal advice regarding Subject Access Requests, the Data Protection Act, or specialist litigation, please contact our expert solicitors at Slater and Gordon. You can call us on freephone 0800 175 8000 or contact us online and we will call you.