February 27, 2017
The reaction of most employers when faced with a Subject Access Request from a current or former employee is one of dread. It can be time consuming and a real administrative burden and the consequences of getting it wrong can add to the disruption.
In a prominent judgment, the High Court refused an application to order a business comply with a subject access request (SAR) on the basis that searches had been reasonable and proportionate and refusal to provide some documents through protected legal professional privilege was properly claimed.
The claimant in the case of Holyoake v Candy challenged the adequacy of the data controllers’ searches and, in particular, felt that the searches were flawed as the company directors’ involved had not been asked to search their private email accounts.
The Judge felt that such a search would be an “intrusion requiring justification”. Whilst he accepted that a director who used a private email account for work may owe the company a duty to allow access to this, the company was not bound to ask for access unless there was a “sufficient reason to do so”.
The claimant also argued legal professional privilege (discussions between a client and their lawyer) could not be relied on as there was a suspicion that some of the activities were tainted by criminal conduct. However the Judge confirmed that there would need to be strong evidence of wrongdoing to justify an inspection of privileged documents not just a speculative case.
This decision is useful as it restates the position that searches need only be “reasonable and proportionate” and gives further guidance on the searching of private email accounts. However, the court’s view is difficult to reconcile with that of the ICO which has stated that the ‘disproportionate effort’ exemption found in the Data Protection Act relates to the production of a copy of the data and not the search itself.
How we can help
Responding to a Subject Access Request isn’t as simple as it sounds. There can be very good reasons not to comply fully with the request – particularly if there is the threat or actual litigation in process.