Dawson-Damer & Ors v Taylor Wessing LLP
Case date: 16/02/2017
Court: Court of Appeal
Area/s of law: Data protection
The Claimants are beneficiaries under various Bahamian trusts. The Defendant (‘TW’) is a firm of solicitors who act for the trustees (although they no longer act for the trustees of any trusts of which the Second and Third Claimants are beneficiaries). There is ongoing litigation in the Bahamas in which the First Claimant is challenging the validity of certain appointments made by the trustee of one of the trusts. Under the Bahamian Trustee Act 1998 (‘BTA’) no trustee can be compelled to disclose certain trust documents and the Bahamian court would be unable to order their disclosure.
The Claimants made subject access requests (‘SARs’) to TW under the Data Protection Act 1998 (‘DPA’), s7. TW had already reviewed the relevant files when notified of the potential challenge to the validity of the appointments, but there was no evidence that they took any further steps, in response to the SAR, to search the files and identify the Claimants’ personal data. TW responded to the SAR asserting that the data was exempt from disclosure under DPA Sch 7, para 10 (‘the Legal Professional Privilege Exception’). The Claimants applied to the court for an order under DPA s7(9) compelling TW to comply with their SAR.
At first instance, HHJ Behrens QC, sitting as a deputy High Court Judge, dismissed the application. He held that the Legal Professional Privilege Exemption was to be interpreted so as to include all the documents in respect of which the trustee would be entitled to resist compulsory disclosure in the Bahamian proceedings; that, in those circumstances, it was not reasonable or proportionate to expect TW to carry out any search, or to determine which documents were privileged (a time-consuming and costly exercise given the Bahamian law issues involved); and that he would not have exercised his discretion under s7(9) to order disclosure, because it was not a proper use of the DPA to assist the Claimants in the Bahamian proceedings, or to enable them to obtain documents which they could not obtain by disclosure in the Bahamian proceedings. The Claimants appealed.
Issues before the Court of Appeal
Arden LJ (with whom the other members of the court agreed) identified 3 issues:
(1) The extent of the Legal Professional Privilege Exception: specifically, whether the Exception is limited to documents to which any privilege attached was legal professional privilege under English law (‘the narrow view’) rather than the ‘wide view’ taken by the Judge;
(2) Whether, if the narrow view is correct, any further search by TW would involve “disproportionate effort”;
(3) Whether the Judge would have been entitled to refuse to exercise the s7(9) discretion in favour of the Claimants because their real motive was to use the information in legal proceedings against the trustee.
Decision and reasons
On the first issue, Arden LJ held that the Judge had been wrong to adopt the ‘wide view’. On a proper construction of Schedule 7 of the DPA, “information in respect of which a claim to legal professional privilege …could be maintained in legal proceedings” must refer to legal proceedings in any part of the UK, and the exception applies only where there is a relevant privilege according to the law of any part of the UK -. Although in English law trustees cannot be obliged, save by order of the court, to disclose certain documents, that is not a form of legal professional privilege and there is nothing in the Directive which the DPA implements to support an interpretation of “legal professional privilege” which extends to other rights of non-disclosure: -. Solicitors who hold documents as agents for their clients are not in any special position so far as the Legal Professional Privilege Exception is concerned. They can and must claim privilege to which their client is entitled, but the fact that TW are an agent for a trustee who is not before the court and could not be ordered to disclose the documents under Bahamian law does not affect TW’s duty to disclose personal data to which the Legal Professional Privilege Exception does not apply: -.
On the second issue, Arden LJ held that DPA s8(2), which on its face qualifies only the data controller’s duty to supply data in permanent form, also applies to the process of finding the information: a controller should “apply proportionality to all stages of the process of compliance”. Thus, a data controller need not conduct a search that is so extensive as to “involve disproportionate effort”. The proportionality exercise requires balancing the potential benefit that the supply of information might bring to the data subject as against the means by which that information is obtained. However, while the law recognises the possibility of limits on the duty to search for requested data, “there are substantial public policy reasons for giving people control over data maintained about them through the system of rights and remedies contained in the Directive, which must mean that where and so far as possible, SARs should be enforced. Moreover, most data controllers can be expected to know of their obligations to comply with SARs and to have designed their systems accordingly to enable them to make most searches for SAR purposes”: -. The Judge’s decision on the second issue was vitiated by his adoption of the ‘wide view’ on issue 1. On the narrow view, it was plain that further compliance with the SAR would not involve disproportionate effort and TW had failed to discharge the onus it bore to demonstrate that it would do so: -. The existence of the Bahamian proceedings could not be taken into account for the purposes of the second issue.
On the third issue, Arden LJ held that there is no rule that requires the s7(9) discretion to be exercised in the data subject’s favour only where the data subject makes his request in order to verify and correct the data held by the data controller and for no other purpose. Nothing in the DPA or Directive limits the purpose for which a data subject may request his data, or provides data controllers with the option of not providing data based solely on the requester’s purpose. The passage in Durant v FSA  FSR 573,  which might appear to suggest the contrary is not in point. While an application under s7(9) might be refused if it was truly an abuse of process, the mere holding of a collateral purpose would not normally make it so. The court must apply the s7(9) discretion with a view to fulfilling the purposes of the DPA, which confers rights on a data subject. Thus the judge would have been wrong to refuse to order disclosure on the grounds that the Claimants wanted the information for use in the trust litigation, or because the documents could not be obtained from the trustees under the governing law of trusts: -.
The Court allowed the appeal and decided that an order under s7(9) should now be made. It identified as “the most material considerations” the fact that the validity of the SAR was not in doubt and that the efforts so far made to comply with it had been inadequate. The case was remitted to the Chancery Division for consideration of further issues falling outside the scope of the appeal (e.g. whether any particular documents were subject to legal professional privilege under English law):  & see .
This is an important case on SARs generally and in particular on the exercise of the discretion under s7(9), an area which has seen courts at first instance take wildly differing approaches. The facts were so extreme (no real evidence of a search in response to the SAR; blanket reliance on LPP) that it is not particularly easy to discern how the court would react to a more nuanced case. However, the court places notable emphasis on the fact that the SAR regime confers rights on data subjects, and that those rights in turn exist to protect fundamental EU law rights: see e.g. , , . Thus, it appears, a search may normally have to be quite extensive, with the “disproportionate effort” restriction coming into play only at the margins, as in Ezsias v Welsh Ministers (cited at ). Likewise, the existence of parallel legal regimes, under which access to the same information may be either permitted or prohibited, would seem to be generally irrelevant or insufficient to justify a refusal to order disclosure, as would the data subject’s motives.
The Information Commissioner intervened in the appeal and made submissions as to when it might be appropriate for a court to decline to order disclosure: . Arden LJ refused to adopt the suggested limitations, given the general nature of the discretion () but they make interesting reading nonetheless, and may give some indication of points that could assist a data controller in an appropriate case.