The Latest from Cloisters

News, Publications, Policies, Events and Blogs

Proportionality and Data Protection

Proportionality and Data Protection

Declan O'Dempsey and Catherine Richmond assess the amount of effort required to respond to a data subject access request: the Information Commissioner goes one way but the courts go another.

The Information Commissioner’s Office has never liked the suggestion of the High Court in Ezsias v Welsh Ministers [2007] EWHC B15 (QB) (23 November 2007) that data controllers only need to take “reasonable and proportionate steps” to identify and disclose personal data. It is true that whilst there is a reference to “disproportionate effort” in section 8 of the Data Protection Act 1998, it seems to relate only to the communication of the data, not the extent of the search. That was certainly the ICO’s view, as it released guidance essentially disapproving Ezsias and stating that the disproportionate effort test in section 8(2) DPA does not apply to the identification or location of personal data. But later the County Court in Elliott v Lloyds TSB Bank plc and anor [2012] EW Misc 7 (24 April 2012) followed Ezsias, commenting that in its view, “the obligation to carry out searches is part and parcel of the obligation to supply the information or to inform the individual…[T]he reference to disproportionate effort in section 8(2) includes a reference to the search”.

The Information Commissioner’s current guidance on this, within the Subject Access Code of Practice, states that the DPA “does not place any express limits on your duty to search for and retrieve the information”. However the High Court, in Dawson-Damer v Taylor Wessing LLP & Ors [2015] EWHC 2366 (Ch), has firmly stuck to the position that the data controller is only required to provide the individual with such personal data as is found after a reasonable and proportionate search. It was clear that much of the information could be withheld from the Dawson-Damer family on the basis of paragraph 10 of Schedule 7 of the Data Protection Act, which exempts information protected by legal professional privilege from disclosure under a subject access request, and the court agreed with Taylor Wessing’s argument that it would not be reasonable or proportionate to expect skilled lawyers to assess whether each document found was privileged. That was in the context of the “modest fee” (the standard £10 fee) paid by each of the claimants and the likelihood that the data sought was likely to be the subject of disclosure in litigation between the claimants and Taylor Wessing’s client.

The case raises the interesting question of whether such a proportionality test can be introduced into the DPA compatibly with the underlying EU law.  On the one hand, on the face of the Directive 95/46/EC of 24th October 1995 On The Protection Of Individuals With Regard To The Processing Of Personal Data And On The Free Movement Of Such Data ("the 1995 Directive") there is no limitation on the kind of search that must be conducted for compliance so that section 8(2) appears to put an unwarranted limitation on the rights in the Directive.   

On the other hand, the principle of proportionality is a general principle of EU law.  In Case C-2/10 Azienda Agro-Zootecnica Franchini Sarl v Regione Puglia [2011] at [73], the CJEU stated that the principle

"… requires that measures adopted by Member States in this field do not exceed the limits of what is appropriate and necessary in order to attain the objectives legitimately pursued by the legislation in question; where there is a choice between several appropriate measures recourse must be had to the least onerous and the disadvantages caused must not be disproportionate to the aims pursued."

Member states must interpret their national law in a manner consistent with directives and ensure that they do not rely on an interpretation that conflicts with the fundamental rights or with other general principles of Community law, such as the principle of proportionality (see e.g. Productores de Musica de España (Promusicae) v Telefonica de España SAU (Case C-275/06) [2008] 2 CMLR 17 at paragraph 68).

In neither Dawson-Damer, nor Ezsias is there a discussion of the provisions of the Directive in this regard, but the point remains open for another case and may require a ruling from the CJEU. 

The Dawson-Damer family were given leave to appeal to the Court of Appeal.

Declan O'Dempsey to speak at ERA Seminar - Applyin...
Cloisters' barristers join 343 lawyers in criticis...