In the first of two cases about the extent to which recipients of data subject access requests must comply and respond appropriately, the Court of Appeal considered the role of ‘legal professional privilege’ (protecting the confidentiality of communication between a lawyer and client for the purposes of taking legal advice) as an exemption for complying with a Data Subject Access Request, finding that relying on privilege under UK law will be acceptable but that no reliance could be placed on the laws of privilege of another nation. Further, although those in receipt of a request for personal data can assert that it would involve disproportionate effort to respond, the Court of Appeal confirmed that it must involve something more than an assertion that it is too difficult to search through voluminous papers. Finally, the Court of Appeal confirmed that the fact that the request had been made in the context of litigation did not mean that the obligation to respond to the request was lifted.
A subsequent Court of Appeal decision held that there is no obligation to “leave no stone unturned” when searching for personal data. In other words, although on the one hand a blanket refusal to comply with a DSAR could not be justified, on the other, as long as a reasonable and proportionate search has been made, a more extensive search would not be required even if it would have revealed more personal data.
The subsequent Court of Appeal case also confirmed that the motive for making a DSAR should not be taken into account when deciding whether to comply with the DSAR. However, it may be taken into account when deciding whether enough has been done to comply with a request. Other factors that may be taken into account are: whether there was a more appropriate route to obtaining the data (e.g. by disclosure in legal proceedings); whether the DSAR was an abuse of rights (e.g. made during legal proceedings for the purpose of putting additional pressure on the other party); whether the request was for documents rather than personal data; and the potential benefit to the individual.