Gurieva V CSD: High Court Considers DSAR Exemptions And Abuse Of Process

Data subject access requests (DSARs) are often used by employees as a tactic before or during litigation against their employers. Gurieva v Community Safety Development Ltd shows that the Courts are still reluctant to find that DSARs made by employees looking to obtain early access to information for use in litigation might be improper.

In this case, the High Court ordered a private investigator to comply with a DSAR made by a Russian couple who were involved with a company that the private investigator (Community Safety Development Ltd (CSD)) was investigating. CSD had refused to comply with the DSAR on the grounds that:

two of the exemptions set out in the Data Protection Act 1998 (the DPA) applied (prevention and detection of crime and legal professional privilege) it would be disproportionate for CSD to have to comply with the DSAR the DSAR was an abuse of process as it had been made for an improper purpose, i.e. in order to gain access to information for the purposes of litigation None of these grounds were accepted by the Court, which emphasised that the general principle is that its discretion "will ordinarily be exercised in favour of a claimant who has made a valid DSAR, in the absence of a good reason not to".

CSD had also claimed that the DSAR was not valid as it had been made by the Claimant's solicitors (rather than the Claimants themselves) and insufficient evidence had been provided as to the identity of the requester. In this regard, the Court found that whilst it may be reasonable for an organisation which receives a DSAR to seek proof of authority where the requester is not the data subject, where a DSAR is requested by a firm of solicitors who confirm their authority to act, this will suffice.

The exemptions

The DPA sets out a number of specific exemptions which can be relied on to avoid data disclosure. The Court considered that the exemptions cited may have applied to some of the data held by CSD. As CSD had failed to disclose any data at all, however, and had made no attempt to analyse which data was covered by the exemptions and which was not, the Court was unable to uphold either of the exemptions. To do so would have been to grant a blanket exemption in relation to a substantial quantity of data, not all of which would, when properly analysed, fall within the relevant exemptions.

Proportionality

Requests need not be complied with where it is not reasonable or proportionate to do so, and CSD had argued that it would...