On 16 February 2017, the Court of Appeal issued its long-awaited judgment in Dawson-Damer v Taylor Wessing clarifying certain aspects of the subject access right (SAR) under the Data Protection Act 1998 (DPA). The Information Commissioner's Office intervened to make submissions in the case.
Subject to the possibility of an application for permission appeal to the Supreme Court, the Court's decision should be seen as upholding the fundamental right of a data subject to access personal data processed by a data controller. It also underlines the need for data controllers to take a careful approach to all SARs in order to avoid a breach of the DPA requirements.
In particular, the Court's decision confirms that the fact that a data subject has some other, collateral purpose in making a SAR does not matter – albeit it may do so if the SAR is considered to be abusive.
Further, it is common for a data controller to argue that the supply of a copy of the information in permanent form would involve disproportionate effort. The Court's decision confirms that an assertion of disproportionate effort under the DPA can extend to the search for the information, as well as the supply of the information, but it is not sufficient for a data controller to assert that it would be a disproportionate effort to search through voluminous papers. In reaching its decision, however, the Court failed to distinguish between those circumstances when the proportionate effort criterion applies and when it does not. Further, whilst the Court decided that the balance needs to be tested between the effort to search and supply data, and the interests of the data subject, it could be argued that that the proportionality test lies between the efforts required and the volume of data held. The data subject's interest is the fundamental right to know what personal data is being held by the controller.
Finally, the decision confirms that where a data controller intends to rely on the exception for information covered by legal professional privilege, this will be given a narrow interpretation, limited to UK jurisdictions only.
Read the full article here.