Data Protection: does it apply to paper files?

12 Mar 2020

Dawson Damer v Taylor Wessing LLP [2020] EWCA

This has been a crucial question, particularly for organisations trying to respond to Subject Access Requests (SARs).  The answer can have a fundamental impact on the nature and extent of the searches that need to be carried out and the amount of information that may need to be disclosed.

In Dawson-Damer v Taylor Wessing LLP, the Court of Appeal has reviewed the extent to which the Data Protection Act 1998 (“the DPA”) applies to paper files. Whilst the 1998 Act has since been replaced by the Data Protection Act 2018 the terminology used is similar and the decision is likely to be relevant to the application of both Acts.

The facts

The claimants are Ashley Dawson-Damer and her two children (who are the adopted children of Ashley and her late husband).  The defendant solicitors (“TW”) acted for a number of trusts in the Bahamas which held wealth originally derived from the will of a Scottish industrialist, George Skelton-Yuill.  A number of family trusts, which held in excess of $400 million, were restructured between 1988 and 1992.  The amendments to the trusts were challenged by the claimants. As that dispute progressed the claimants made numerous SARs under the DPA to TW, as data controller, seeking all data of which the claimants were the data subjects.  

The initial decisions

In protracted litigation decisions were made by the High Court and the Court of Appeal on a variety of issues. It was concluded that (i) legal professional privilege would only apply to documents which carried privilege for the purpose of English (as opposed to Bahamian) law (ii) TW had not shown that complying with the requests would involve disproportionate effort.

A number of issues were then remitted back to the High Court, including whether paper files maintained by TW were “relevant filing systems” for the purpose of Section 1 of the DPA.  This was important because if they were not the DPA did not apply to them. 

The application of the DPA to paper files had been considered in Durant v Financial Services Authority (2004). The Court of Appeal there found that Parliament intended to apply the DPA to manual records only if they were of sufficient sophistication to provide similar ready accessibility to information as a computerised filing system. That required a filing system referenced or indexed in a way that enabled the data controller’s employees to identify, at the outset, with reasonable certainty and speed, the file(s) in which the specific data relating to the person requesting it was located and to locate the relevant information about it in the file(s), without having to make a manual search. To leave it to the searcher to leaf through files, possibly at great length and cost, to see whether they contained information relating to the person requesting it and whether that information was data within the DPA bore no resemblance to a computerised search – such files could not be a relevant filing system within the DPA.

At the heart of the dispute concerning the application of the DPA to material held by TW were 35 paper files held in chronological order under the client description ‘Yuill’s Trusts’. The judge found that these files, notwithstanding the commentary in Durant were a “relevant filing system” for the purposes of Section 1 of the DPA - TW were therefore required to search these files for the claimants’ personal data.

The High Court concluded there were three separate and cumulative developments required for a paper file to constitute a relevant filing system for the purpose of the DPA:

  1. The data must be structured by reference to specific criteria;
  2. The criteria must be ‘related to individuals’;
  3. The specific criteria must enable the data to be easily retrieved.

Applying that approach to the 35 paper files under the client description ‘Yuill’s Trusts’ the material clearly related to trusts of which the claimants were potential beneficiaries.  That description of the files was a criterion which allowed access to personal data. Giving the words ‘relating to individuals’ an expansive interpretation, the judge concluded that the fact that the files related to trusts of which the claimants were potential beneficiaries was sufficient to satisfy that requirement.

Turning to whether the specific criteria enabled the data to be easily retrieved, the files were in chronological order.  It would simply require someone to “turn the pages” to locate the personal data.  That had already been done by TW in relation to other files they had already examined. It was not an unduly onerous exercise and it enabled any personal data relating to the claimants to be easily retrieved.  If it was possible for TW to sufficiently identify the claimant’s personal data within the paper files to claim legal professional privilege for the majority of documents in the files, the retrievability of the data must be a feature of the filing system. 

The Court of Appeal decides

Reiterating the commentary in Durant (discussed above) the Court of Appeal referred to guidance issued by the Information Commissioner’s Office (“the ICO”) in May 2011 in relation to a “relevant filing system” (often referred to as the “temp test”);

“If you employed a temporary administrative assistant (a “temp”), would they be able to extract specific information about an individual from your manual records without any particular knowledge of your type of work or the documents you hold? The “temp test” assumes that the temp…is reasonably competent, requiring only a short induction, explanation and/or operating manual on a particular filing system in question for them to be able to use it.”       

The Court of Appeal endorsed the approach in the European Court of Justice case of Tietosuojavatuutettu – in which the court had said that consideration of the form of a relevant filing system is not a restrictive test. It is a functional one as to whether specific criteria enable the data to be easily retrieved. The Court of Appeal said that the tests that should be applied are:

  1. Are the files a structured set of personal data?
  2. Is the data accessible according to specific criteria?
  3. Are those criteria related to individuals?
  4. Do the specific criteria enable the data to be easily or readily retrieved?

The Court of Appeal was largely in agreement with the approach taken by the High Court until it came to the response to the last question. The ready access must be enabled by the criteria – that is the structure of the files. The Judge had concluded that the test was satisfied because a trainee and associate lawyer had been able to extract the personal data from the files and a senior lawyer had been able to identify the privileged material in them. That was not the correct approach. There had to be a causative link between the criterion and the ease of the retrieval of the data. On the facts in Dawson-Damer the structure of the files meant that there was not ready access to data. Access to data had required the use of skilled lawyers, turning the pages and reviewing the material. None of the evidence relied on by the Judge satisfied the “temp test”. There was no support for a finding of ready access to personal data and on that basis the 35 files were not a relevant filing system within the meaning of the DPA.      

What this means for you

This is a hugely significant judgment for organisations that have papers files. The effect of the High Court decision had effectively been to change the law to bring such files within the ambit of the DPA when they had not been before. The Court of Appeal’s reversal of that decision and the broad reinstatement of the previous test will therefore be particularly welcome, especially at a time when the numbers of SARs being made seems to be increasing and where SARs are frequently being used by claimants as tools in litigation.

<< Back

Disclaimer: This document does not present a complete or comprehensive statement of the law, nor does it constitute legal advice. It is intended only to highlight issues that may be of interest to customers of BLM. Specialist legal advice should always be sought in any particular case.

Related contacts


Tim Smith

Tim Smith

Partner,
London


Who to contact


For more information about any of our news releases, please contact:

Natalie King
 +44 20 7638 2811
+44 20 7920 0361
Email Natalie

Semi Da-Cocodia
+44 161 236 2002
+44 161 838 6840
Email Semi

Jo Murray
+44 20 7638 2811
+44 20 7865 4849
Email Jo

|