An individual can make a Data Subject Access Request (DSAR) to enforce their right to access their personal data held by organisations. Failing to handle the requests correctly can result in substantial fines, penalties from the Information Commissioner’s Office (“ICO”) and reputational damage.

However, there has been an increase in individuals making such requests either as part of, or before embarking on litigation.

In Dawson-Darmer v. Taylor Wessing LLP [2017] EWCA Civ 74, the Court of Appeal considered whether a court could use its discretion under section 7(9) of the Data Protection Act 1998 (“the Act”) not to compel compliance with a DSAR where the data subject’s real motive is to use the personal data to assist in litigation.

The Court of Appeal rejected the notion that the court’s discretion should be limited based on the underlying purpose of the DSAR, as the Act did not limit the purposes for which a DSAR may be made.

As many data controllers will be aware, the right of access to data is often invoked by discontented individuals seeking to obtain evidence that they believe will enable them to pursue a grievance, complaint, or claim. It is becoming common practice for a litigant, or their legal representatives, to bring a DSAR at the pre-action stage in an attempt to sidestep the impact of pre-action disclosure rules that only allow for limited and targeted sharing of information.

Requestors often incorrectly believe that they are entitled to obtain copies of original documents under the right of access to data. They can also misunderstand the scope of the right – which is limited to an individual’s data only (not that of third parties) and does not include material covered by the exemptions as set out in the Data Protection Act 2018.

In X v. The Transcription Agency and Master Jennifer James [2023] EWHC 1092 (KB), Mrs Justice Farbey stated that the right of access

“has a specific and limited purpose, which is to enable a person to check whether a data controller’s processing of his or her “personal data” unlawfully infringes privacy rights and, if so, to take such steps as the DPA 2018 provides … It is impermissible to deploy the machinery of the Act as a proxy for the wider purpose of obtaining documents with a view to litigation or further investigation.” [emphasis added]

Pre-action disclosure and DSARs are entirely separate and must be treated as such to minimise risk and avoid exacerbating what may be an already difficult situation.

If you have a dispute and wish to discuss possible ways to obtain information, your team at Griffin Law is ready to help you decide upon the best approach.