Data Protection: Subject Access Rights

January 26, 2017

A recent High Court judgment concerned the adequacy of a search following a subject access request and the limits of legal professional privilege in that context

In Holyoake v Candy [2017] EWHC 52 (QB), Mr Justice Warby was faced with a claim concerning two main issues: whether an adequate search had been carried out in relation to a subject access request and whether legal professional privilege applied. Claims relating to abuse of process were inextricably linked but not ruled upon.

The parties to the dispute concerning the subject access request (Mark Holyoake and Nick Candy) were engaged in other litigation arising from a property development in which large sums were at stake. That litigation had spilled over into other proceedings where an injunction was ought to restrain disclosure of a recording made by Mrs Holyoake (Mark Holyoake’s wife) on the basis that it was information confidential to Mr Candy.

It is a tangled web, involving alleged surveillance, mysterious informers and a fair amount of vitriol. One less complicated issue was the extent to which the subject access request was an attempt to circumvent or improperly supplement the litigation disclosure in the main proceedings.

As to the adequacy of the search carried out in relation to the subject access request, Warby J observed that the work involved the review of over 17,000 individual documents and generated time charges in excess of £37,000. The claimant took the view that the search was flawed in that it failed to include asking ‘the defendants in terms whether they commissioned any investigations/surveillance of Mr Holyoake’ and because individuals were not asked to search their private email accounts for information within the scope of the request. The first alleged flaw received short shrift from Warby J but the second demanded a more considered response. He accepted that the subject access right eAxtends to personal data which are being processed ‘on behalf of’ the data controller and thus might extend to directors’ private email accounts. But he was not persuaded on the facts, saying (at [61]):

the general proposition that something might be so does not mean that there is any reason to believe it was so in an individual case. A company director who has used a personal email account for corporate business may owe the company a duty to allow access to that account, if that is needed to enable the company to comply with a SAR. But I do not believe the company is bound to ask the question unless there is some sufficient reason to do so. Nor does it seem to me that the company has a general right of access in order to check the position. To search a private email account would be an intrusion requiring justification. The Court must ask itself whether enquiry and/or search in relation to a director’s private email account is a requirement of a reasonable and proportionate search by a corporate data controller. Its approach must be tailored to the facts before it.

Warby J found that the searches undertaken were reasonable and proportionate and compliant with the defendants’ obligations under s 7 of the Data Protection Act.

Turning to the question of legal professional privilege (LPP), the main area of interest in the judgment was the treatment of the principle that LPP cannot be used as a basis for withholding material that is evidence of iniquity. The claimant’s, ultimately doomed, contention was that at least some of the withheld material was of precisely that nature. The ‘iniquity’ in question was a possible offence under the Data Protection Act in seeking information about the claimant’s criminal record – the suggestion being that agents of the defendant had improperly obtained or commissioned another to obtain access to the Police National Computer. Warby J was unimpressed by the evidence and indicated that ‘[i]t cannot be said that the instruction of private investigators necessarily involves a breach of s 55, or even that it is inherently suspicious’.

The claimant’s further submission that reliance on the LPP exemption could not prevail where the data for which exemption is claimed may reveal breaches of fundamental human rights was described by Warby J as ‘legally ambitious’. The consideration of the argument is well worth attention but it foundered on the facts and because it represented a ‘quite radical extension of the iniquity principle’ that the court was not prepared to undertake.

As to the ancillary question of whether the court should inspect the material in respect of which the LPP exemption was claimed, Warby J recognised the established approach of the court that it should inspect such material only as a last resort. He was not convinced that the circumstances justified such an inspection.