MOrsel - Data Subject Access Requests revisited

Two recent UK decisions have provided useful guidance regarding data subject access requests (DSARs). These cases are not binding in Guernsey or Jersey but as our data protection laws are similar they may be considered by our courts.In the case of Dawson-Damer and others v Taylor Wessing LLP [2017], the Court of Appeal clarified several important points which are considered in depth in this article written by Mathew Cook from our Jersey office. Of particular significance in the context of employee requests, the case confirmed that DSARs are purpose blind and should not be ignored if they are submitted to assist in litigation. A remark by a judge in the earlier case of Durant v Financial Services Authority [2004] had been taken by many to mean that DSARs arising from a complaint or litigation were unlikely to be enforced.

However, in this case, the Court of Appeal stated that the earlier comment in Durant concerned the definition of "personal data" and so a claimant could not claim something was "personal data" just to obtain that information for the purposes of litigation. However, it did not create a general prohibition on DSARs that were submitted to assist in litigation. This was also the position recently adopted in the Jersey case of Alwitry v The States Employment Board and another [2016] JRC 050.

The second recent case is Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd and Others [2017], where the Court of Appeal agreed that DSARs are purpose blind but added that the data subject's motives may still be relevant to the exercise of the court's discretion to order subject access compliance. 

Notwithstanding this useful qualification, the most important point to note is that no matter what the motive of the data subject is, and no matter how onerous the request is, a data controller must comply with that request. Helpfully for data controllers, the Court did reiterate that a data controller's implied obligation to search for documents is limited to what is reasonable and proportionate and that their obligation is to supply information and not documents. Therefore whilst labour intensive, in the context of litigation or threatened litigation, it may indeed be beneficial for a data controller to seek advice and consider providing only the personal data rather than the documents in their entirety. 

These cases are in line with our experience and approach of dealing with DSARs, which are becoming increasingly common in disputes between employers and employees. They should never be ignored and a consistent and considered approach should be adopted to compliance. If you would like to discuss your approach to compliance or data protection training generally, please contact us.