S - Subject access requests
18/7/18
LONSDALE v NATIONAL WESTMINSTER BANK PLC [2018] EWHC 1843 (QB)
Cross-applications for summary judgment were dismissed. In respect of a claim that a bank acted in breach of contract (by freezing the claimant’s accounts on submitting reports under the Data Protection Act 1998 to the National Crime Agency), the issue whether the bank genuinely suspected that money in the accounts was criminal property was not suitable for summary determination (Shah v HSBC, 2009). Although there was no clear evidence from the bank that it held any relevant genuine suspicion, it could not be said the bank had no reasonable prospect of defending. In respect of a claim that the bank wrongly withheld personal data in response to subject access requests (SARs), there was a strong claim that data processed to determine whether to make the reports to the NCA was personal data but without seeing the withheld documents the court could not be sure they contained personal data. There were also issues fit for trial as to whether the refusal to provide them could be justified on grounds that they included ‘mixed data’ (of other data subjects) and whether the exemption in s 29 DPA applied (because provision of the data would be likely to prejudice detection of crime). A defamation claim could not be struck out. Internal communication of the bank’s suspicions to its employees was publication and was capable of amounting to defamation. There could be a defence of qualified privilege because the bank was obliged by law to report to the NCA, but this would turn on an assessment of the factual evidence. It was appropriate to allow the claimant to inspect the SARs which had been referred to in the pleadings, as this was necessary for the fair disposal of the claims.
3/3/17
ITTIHADIEH v 5-11 CHEYNE GARDENS RTM CO LTD [2017] EWCA Civ 121; [2018] QB 256 (CA)
Considers the Data Protection Act 1998 including the meaning of “personal data” [61]-[69], who is a “data controller” [70]-[71], the form of a DSAR [78]-[81], the purpose of a DSAR [82]-[90], the form of a DSAR response [91-94], proportionality of search [95]-[103] (confirming that what is required is a “reasonable and proportionate search”), and the exercise of the court’s discretion [104] – [110] (confirming that relevant factors in the exercise of discretion include the absence of legitimate reason for a DSAR, the fact that the real quest is for documents, and the fact that the data is of no real value to the data subject).
16/2/17
DAWSON-DAMER v TAYLOR WESSING LLP [2017] EWCA Civ 74; [2017] 1 WLR 3255
It is no objection to a data subject access request that it is made for the collateral purpose of assisting with actual or contemplated litigation [112].