Court of Appeal Judgment on Subject Access Requests
Thu 11 May 2017
Following on from last month’s judgment in the case of Dawson-Damer, the Court of Appeal (“CoA”) has given further guidance on Subject Access Requests (“SARs”) in the cases of Ittihadieh and Deer. In particular the CoA offered guidance for employers on how far they must go in searching for data when responding to a SAR whilst granting discretion to the courts to consider a variety of factors when assessing a SAR.
By way of background, under the Data Protection Act 1998 (“DPA”), which implemented EU Directive 95/46/EC, a ‘data subject’ is entitled to access their personal data held by a data controller (such as an employer) in an intelligible permanent form. The personal data can be accessed through the data subject making a SAR under the DPA, which, provided they pay the £10 fee if requested, must be given by the data controller (employer). Should the data controller fail to do so, the court has discretion to order compliance with the SAR.
In the case of Deer, Dr Deer brought several discrimination claims against her ex-employer, the University of Oxford. She had also made two subsequent SARs under the DPA. Oxford ignored the first on the basis its essential purpose was to obtain documents for litigation which it considered an abuse of process. Oxford changed its stance with the second SAR and disclosed some information previously withheld. Dr Deer thought the information disclosed was inadequate and sought a court order.
In the case of Ittihadieh, the data subject was the owner of a flat in a building managed by RTM. Mr Ittihadieh attempted to become a board member and when unsuccessful, made a SAR to RTM and its directors. RTM disclosed 400 documents but Mr Ittihadieh asked for further information, including on the directors personally.
The CoA held:
(1) that if an applicant does not have a valid reason for making a request, relief may not be granted. The CoA upheld the High Court’s decision that there should be a 25% reduction of Dr Deer’s costs because of the essentially “antagonistic” reasons for the SAR;
(2) that employers will no longer be able to ignore a SAR on the basis they believe it is submitted for litigation purposes meaning it has been submitted to obtain documents or information: the CoA stated that the SAR would remain valid.
(3) that the employers’ scope of efforts need to be reasonable and proportionate;
(4) the judge has discretion to order compliance on a number of areas and has to consider
a. whether there is a more appropriate route to obtain the requested information, such as disclosure;
b. the reason for the SAR;
c. whether the data subject has received the relevant data or document through other means;
d. whether the request is an abuse of rights or procedure;
e. whether the request is really for documents rather than personal data; and
f. the potential benefit to the data subject.
 Dawson-Damer and others v Taylor Wessing LLP  EWCA Civ 74
 Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd  EWCA Civ 121
 Deer v University of Oxford