Case law update - Subject access requests, will the courts intervene?

Why was the individual asking to see information held about him?

This case has a complicated factual background. It involved an employee of an NHS trust, who, when he was dismissed, complained extensively to the Welsh National Assembly (WNA), which did not have a role in his dismissal. In support of his claim of unfair dismissal against the NHS trust, he made five requests under the Data Protection Act 1998 (DPA) (subject access requests) to see what documents the WNA held about him.

The WNA did not provide the documents he expected to see and he complained to the High Court, asking it to order the WNA to comply and seeking damages.

What were the WNA’s legal obligations?

The DPA provides that, when an individual makes a proper subject access request, an organisation which holds ‘personal data’ about that individual must give him copies of that information, unless this is not possible or would involve a disproportionate effort. Personal data is information about an individual which is either held in electronic form or is held in highly structured paper files. The individual must be the focus of the information in the document.

Reading the facts of this case, most employers will breathe a sigh of relief to hear that the High Court did not grant the claimant’s request and did not order any damages to be paid – particularly given that he did not even work for the WNA.

Whilst the case clearly turned on its own unusual facts, it is nevertheless interesting to note the following:

• The Court was reluctant to allow the claimant to use the DPA to "to obtain discovery of documents that may assist him in litigation or complaints against third parties". It had discretion as to whether or not to grant an order and it was reluctant to exercise that discretion here where it was clear that the purpose of the request was to fuel separate legal proceedings, since the discovery rules would be more appropriate.

• The claimant argued that the WNA should have approached other departments to find out whether they held any personal information about him. However, the Court gave weight to the fact that organisations do not have to go to a disproportionate effort to comply with subject access requests. It took into account that:

• the vast majority of the information the claimant sought was held in "unstructured" form, and so would not fall within the definition of personal data; and

• it was unlikely that departments or agencies other than those already approached in response to the claimant's requests held any personal information about the claimant.

• There was no evidence that, even had the WNA failed in its duties under the DPA, any loss flowed from this. Therefore the claimant was not entitled to any damages.

Will this case help you decide what you need to do to comply with a subject access request?

Each subject access request is, of course, unique in terms of the type of information held and where it is stored. No case can tell you exactly where you will need to look in any particular situation.

However, it is reassuring that the High Court in this case took a realistic view of what sort of investigation would have been disproportionate. Bear in mind that it put an emphasis not so much on the time that it would have taken to look in particular places, but how likely it was that such a search would have reaped dividends. When deciding whether to open up a whole new area of the business to a search, think this through and record how likely it is that any personal information will be found there.

This case also indicates the reluctance of the High Court to allow litigants to use the DPA to fuel litigation against a third party.

Note of caution

You should be aware, however, that the High Court in this case was a little more sympathetic to employers than the Information Commissioner is in its Guidance ' ‘Determining what personal data is’. The court also relied heavily on the quite restrictive definition of personal data that was set out in the Durrant case - the Information Commissioner has some qualms about this.

For more information about how to deal with a subject access request and what sort of information is covered by the DPA, see EEF guide ‘Data Protection: A practical guide to the law’.