Data Subject Access Requests - Proportionality and Motive

The UK Court of Appeal has clarified the scope of the disproportionate effort exemption, and the relevance of motive, when responding to Data Subject Access Requests (DSARs).  The decisions are interesting as the scope of the "disproportionate effort" exemption has caused considerable confusion in both the UK and Ireland.  Neither the English nor Irish Data Protection Acts (DPAs) define what constitutes "disproportionate effort" and there is a paucity of Irish case-law on the issue. Nor has the Irish Data Protection Commissioner (DPC) provided any comprehensive guidance on the exemption. 

In Dawson-Damer v Taylor Wessing [2017] EWCA Civ. 714 and Deer v University of Oxford and Ittihadieh v 5-11 Cheyne Gardens RTM Co. Ltd [2017] EWCA Civ. 121, two differently constituted Courts of Appeal held that the data subject's motive for making an access request is irrelevant, thus clarifying that an access request can be used as a litigation tool. The Irish courts have similarly found that data access requests can be made for the purpose of furthering litigation (Dublin Bus v Data Protection Commissioner [2012] IEHC 339). 

In addition, the UK courts held that the disproportionate effort exemption applies to both the effort involved in searching for the personal data requested, and in supplying that data in permanent form.  The courts held that this approach is consistent with EU law, which did not intend to impose excessive burdens on data controllers. The courts noted that EU law recognises the principle of proportionality (Case C 101/01, Lindqvist), and that principle justifies limiting the scope of the efforts that a data controller must take in response to a DSAR. This approach, however, conflicts with that taken by the UK Information Commissioner (ICO) who views the disproportionate effort exemption as applying only to the effort involved in "supplying"  the personal data in permanent form, and not to searching for the data. The ICO's Code of Practice states: "The DPA…does not place any express limits on your duty to search for and retrieve the information they want… it will never be reasonable to deny access to the requested information merely because responding to the request may be labour-intensive or inconvenient." 

Similarly, in Ireland, the disproportionate effort exemption, set out in section 4(9) of the DPAs, is generally taken to apply only where the effort required to "supply" a copy of the information in permanent form is disproportionate to the benefit derived by the data subject in receiving such a copy.  Given that a DSAR is a fundamental right under the DPAs, the exemption is not generally construed as applying in regard to difficulty in searching for and retrieving the data.   

We await further guidance from the Irish DPC as to what precisely constitutes "disproportionate effort" and the circumstances in which the exemption can be safely invoked. The UK courts' broad construction of the exemption will be welcomed by UK data controllers, and will be of persuasive value to the Irish courts if the issue arises for consideration here. 

For further discussion on how to handle access requests, see here.

Date Published: 7 March 2017