This is the third decision in this long running litigation. Following receipt of DSARs the law firm defendant stated that all personal data it held in relation to the Claimants was covered by legal professional privilege (LPP) and therefore exempt from disclosure. It also claimed it was disproportionate to expect it to carry out searches to find any documents which were not privileged. The law firm also argued that the paper files it had maintained before moving to an electronic filing system were exempt because they were not part of a "relevant filing system".
The initial High Court decision essentially agreed with the law firm, but this was overturned by the Court of Appeal which remitted the three issues above back to the High Court for determination.
What is a relevant filing system? The High Court decided that the law firm's paper files held under a generic client description and arranged in chronological order were a relevant filing system. This is a different approach from that applied in the leading data protection case of Durant v Financial Services Industry . The Durant case limited the obligations relating to disclosure of paper files by the ease with which the information could be located (known colloquially as the "temp test" ie could a temporary worker easily retrieve the information?). The High Court's logic behind the departure from Durant is that since 2004 the protection of personal data has been enshrined as a fundamental right in EU law, and as a result, in 2019, protecting the data subject is more of the focus than the burden on the data controller. The protection should not be circumvented by whether the personal data can be easily retrieved. The test is whether it was structured by reference to specific criteria "related to individuals". Here the 35 paper files, being chronological in order, could be page turned to locate the personal data. This was not unduly onerous.
Reasonable and proportionate searches: Earlier case law has made it clear that when considering what is constitutes a disproportionate and unreasonable search all aspects of the data controller's efforts to respond should be taken into account. This is a data controller friendly approach. However, in this case, the law firm had not served evidence setting out the time and cost involved in conducting a search for personal data in documents already disclosed, and therefore they had not discharged the burden in showing that this search was disproportionate. It was also not disproportionate for the law firm to search personal workspaces of current employees. By contrast, the High Court held it was disproportionate to require the law firm to conduct searches for documents held on a back-up system (Mimecast) as this would reveal confidential information about their employees of other unrelated clients.
The exemption for legal professional privilege: The Court of Appeal had held that the LPP exemption only applied to information over which privilege could be asserted under UK law. It did not consider the effect of Bahamian trust law on the issue. The High Court has now done so, finding that there were no trust law rights which limited or qualified the law firm's claim to LPP.
WHAT THIS MEANS FOR DATA CONTROLLERS
While this litigation is being considered under the old Data Protection Act 1998, the issues are still as relevant under the GDPR and the Data Protection Act 2018. Indeed, in the past year the number of DSAR's have significantly increased.
Permission to appeal on the relevant filing system issue has already been granted. If the Durant orthodoxy is not restored on appeal, managers need to be careful not to create paper files, or notebooks, about employees by name if they wish for those notes to be exempt from disclosure in a DSAR response.
The High Court's finding that evidence is needed for why a DSAR response is disproportionate is at odds with the approach of the Information Commissioner's Office who are more likely to accept assertions in response to complaints. This case makes it clear that the High Court will treat any such assertions as just that. Documenting the thinking process and the time and cost involved will be crucial to prevailing in arguments that searches are disproportionate in High Court proceedings.
Finally, while the finding on LPP is context specific and won't arise in employment DSARs, an important lesson from this litigation is that any assertions of legal professional privilege, to withhold documents from DSAR responses containing personal data, should be targeted and not general in nature.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.