Can your privileged material be obtained through a data subject access request?

14 Mar 2017

The courts have grappled with the limits of legal advice privilege (i.e. the confidentiality of documents recording advice between lawyer and client) and the scope of data subject access requests (“DSAR”) under the Data Protection Act in recent litigation. The decisions of the courts provide some helpful guidance on the protection afforded by the privilege exemption and its limits for any data controller (“DC”) who might be subjected to a tactical DSAR.

In Holyoake v Candy and another, a property dispute, the High Court had to decide whether to order the DC’s further compliance with a DSAR. In reaching its decision, it had to consider whether the DC had carried out adequate searches for personal data in response to the DSAR, and whether it was entitled to rely on the legal professional privilege exemption to limit what was included in its response.

The court decided that no order for further compliance should be made. The records of legal advice between the DC and its lawyers were exempt from disclosure because they qualified for legal professional privilege. However, this might not be the case held the court, if there was evidence of iniquity i.e. the documents formed part of some fraudulent or criminal design. The possibility that the data might reveal a breach of a data subject's right to privacy did not meet the threshold to remove the exemption.

So far so good for the DCs, but a note of caution from the Court of Appeal’s decision in Dawson-Damer and others v Taylor Wessing LLP.

The law firm, Taylor Wessing, did not comply with a DSAR submitted by the beneficiaries of a trust administered by one of its clients. The firm made a blanket assertion that all the personal data was covered by legal professional privilege and therefore exempt from disclosure. The Court of Appeal overturned an earlier High Court decision not to order compliance. On the issue of legal professional privilege, it held that a narrow interpretation had to be used. This meant that:

  • only data for which there was relevant privilege according to the law of any part of the UK was exempt. Data which the DC could refuse to disclose under the laws of another jurisdiction was not exempt from disclosure in the context of the DSAR; and
  • the fact that Taylor Wessing were an agent for a trustee who was not before the court, and who could not be ordered to disclose the documents under the foreign law applicable to the trust, did not affect Taylor Wessing’s duty to disclose personal data to which the legal professional privilege exemption under UK law did not apply.

There is some comfort for DCs in these decisions, and some helpful clarification, but the note of caution is clear. DCs must be wary of relying on legal professional privilege too liberally when seeking to resist disclosure in response to a DSAR made under the UK's Data Protection Act. Only data that is protected under the UK rules on privilege will be exempt, and that exemption will be lost if there is evidence of iniquity.

For more information please contact:

Further reading

Destination: office?

Blog, News & PR
29/07/2021
Emily Wood considers the results of our recent survey and the implications for the future of the post-pandemic workplace
Read more Read

Commercial lease renewals and pandemic clauses

Blog
28/07/2021
Will commercial reality trump the law when leases are up for renewal? Property expert James Picknell takes a look
Read more Read

Permitted Development Rights and the revised NPPF: Article 4 directions

Blog, Legal Updates
22/07/2021
A revised National Planning Policy Framework has just been published. Holly Stevenson focuses on the change to Article 4 Directions
Read more Read

Can commercial lessees now ‘relax’ given the extended Government moratorium on forfeiture for non payment of rent?

Legal Updates
20/07/2021
Property Litigation Partner, Keith Pearlman, doesn't think so and explains why they could be in for a nasty shock from 1 October of this year
Read more Read
  • Brighton Office

    1 Jubilee Street

    Brighton

    East Sussex

    BN1 1GE

  • Gatwick Office

    Griffin House

    135 High Street

    Crawley

    West Sussex

    RH10 1DQ

  • Guildford Office

    Wonersh House

    The Guildway

    Old Portsmouth Road

    Guildford

    Surrey

    GU3 1LR

  • Horsham Office

    Ridgeland House

    15 Carfax

    Horsham

    West Sussex

    RH12 1DY

  • London Office

    6 New Street Square

    New Fetter Lane

    London

    EC4A 3BF

  • Get in touch