Data Subject Access Requests - High Court dismisses claim where DSAR regime abused

In an important decision¹ for any business with a retail customer base, the High Court of England and Wales dismissed a claim against a bank for allegedly failing to provide an adequate response to the Claimant’s data subject access request (DSARs), highlighting the robust approach that the court is willing to take where it suspects the tactical deployment (or abuse) of the DSAR regime.

Facts

Between 2010 and 2015, the Claimant entered into several ‘buy to let mortgages’ with the Defendant. The Defendant instigated possession proceedings which the Claimant unsuccessfully opposed. Over a period of two years, the Claimant made various DSARs, which the Defendant responded to.

Claim

In late 2019, the Claimant issued proceedings and sought various relief, including in connection with an allegation that the Defendant had failed to provide data, contrary to the Data Protection Act 2018 (DPA 18) and the General Data Protection Regulation (EU) 2016/679 (GDPR). Due to the dates on which the DSARs had been made, the relevant legislation was in fact the Data Protection Act 1998 (DPA 98).

Section 7(1) of the DPA 98 confers an entitlement on an individual to be provided with copies of personal data held by a Data Controller, such as the Defendant. Section 7(9) of the DPA 98 provides the Court with an ability to order a Data Controller to comply with a request if it is satisfied that the Data Controller has failed to meet its obligations under Section 7(1). Section 13 DPA 98 permits individuals to seek compensation for damages and distress from a Data Controller in the event that the Data Controller is found to have breached any requirements of that legislation. Comparable provisions are mirrored in the new regime under the DPA 2018 and GDPR.

Held

The evidence before the Court demonstrated that the Bank had provided the Claimant with a response to each of his DSARs. In each case, the answer had been adequate. However, the Judge noted, in obiter comment, that even if he were wrong on that primary finding of fact and that there had been a failure to provide a proper request to one or more of the DSARs, the court has a discretion whether or not to make an order and, in this case, there were good reasons for declining to exercise the discretion. Those reasons included:

• the issue of numerous and repetitive DSARs, which were considered to be abusive;
• the real purpose of the DSARs being to obtain documents rather than personal data; and,
• there being a collateral purpose that lay behind the requests which was to obtain assistance in preventing the Defendant bringing claims for possession. A collateral purpose of the requestor wanting the material to assist in litigation is not an absolute exemption to the DSAR obligations², but it is a relevant factor in the exercise of the court's discretion.

Comment

Individuals and claimant firms are increasingly using DSARs as a means of seeking to obtain information and documentation in support of civil claims and in parallel to or before disclosure obligations under the Civil Procedure Rules bite. Where those requests are repetitive, numerous, and the real purpose is to obtain documents and not data, businesses might reasonably resist civil claims raising similar factual issues.

Whilst the recent Information Commissioner’s Office Guidance on Rights of Access (DSARs) provides some helpful examples of what may constitute manifestly unfounded or excessive requests, it is often the case that disgruntled individuals will nevertheless commence litigation before the County Court seeking to rectify the perceived failings in responses to DSARs and/or compensation for “distress” caused. Businesses should take comfort in the stance the High Court took in this claim and not feel pressured into settling civil claims for damages where the DSAR has been responded to appropriately.

¹Lees v Lloyds Bank Plc [2020] EWHC 2249 (Ch)