On 21 October 2020, almost a year after the UK’s Information Commissioner Office (ICO) provided draft guidance on the right of access, the ICO published its updated guidance on data subject access requests (DSARs), available here (Guidance).

In a previous post available here, we covered what DSARs are and the principles areas of focus of the draft guidance.

So, what has changed? Overall, the Guidance provides more in-depth advice and further examples to help organisations understand how they can meet Article 15 of the General Data Protection Regulation (GDPR) requirements in handling DSARs.

There are, however, three particular areas of note, where the ICO provided further explanation.
Continue Reading ICO releases updated guidance on data subjects’ right of access

In August, the High Court, in Dawson-Damer & Ors v Taylor Wessing [2015] EWHC 2366 (Ch), refused an application to compel a UK law firm (“TW”) to comply with a data subject access request (“DSAR”) under the Data Protection Act 1998 (“DPA”).  Applying his findings from an earlier judgment (Elliott v Lloyds TSB (2012)), His Honour Judge Behrens (i) took account of the motive behind the DSAR and (ii) held that any search responsive to a DSAR did not have to go beyond what was reasonable and proportionate.

The court application and the original DSAR were made by Mrs Dawson-Damer (“DD”), the beneficiary of a Bahamian trust who is suing the trustee, the Grampian Trust Company, in the Bahamas in its refusal to make distributions for the benefit of her adopted children (among other things).  TW have been Grampian’s English solicitors for 30 years, holding more than 50 historical paper files, as well as more recent computerised ones.  A DSAR was made to TW requesting a copy of all personal data held about DD (DSARs were also made for DD’s children).  The firm refused, claiming the exemption for legal professional privilege would apply to the majority of documents held, and that it would be disproportionate and unreasonable to expect TW to search through in order to determine what – of 30 years’ of accumulated material – was privileged or not.  TW also said that the extent of any legal privilege was a matter of Bahamian law, not English, and that this could only be established in the proceedings brought by DD in the Bahamas.
Continue Reading Data Subject Access Requests – Stick to What’s Reasonable, Proportionate, and Has the Proper Motive, Says UK Court