This article was originally written for and featured in Fresh Business Thinking.
Employers who have dealt with subject access requests know only too well that doing so is time consuming and can distract management from the day to day running of their business. It therefore comes as a relief to employers that a judgment made earlier this year, Elliott v Lloyds TSB Bank, has provided hope to employers who may wish to circumvent having to carry out disproportionate searches for personal data or carrying out searches which, but for the prospect of litigation, would not have been made. Burdening an employer with a subject access request has been a tactic often used by discontented employees in order to gather information which may help in bringing a claim against the employer.
Mr Elliott owned two motor auction companies. A proposed management buy out of the companies was being worked on, with Lloyds TSB providing the investment. However, the companies fell into administration and were sold to a third party. Mr Elliott initiated court proceedings as he was aggrieved with Lloyds TSB’s handling of the matter. As part of those proceedings, Mr Elliott sought disclosure of certain information. When this was refused, he submitted a broad subject access request. A large amount of information was disclosed, but Mr Elliott was not satisfied and sought further information. In particular, he wanted a search of information held about him by six senior individuals at Lloyds TSB. In order to obtain this information he brought a separate claim against Lloyds TSB in the County Court, suggesting that it had not complied with the subject access request.
The Court had to consider two issues.
1. Mr Elliott’s motives
Lloyds TSB argued that as the searches were being pursued, at least in part, for the purpose of gathering information for litigation, the subject access request was an abuse of process.
The case of Durant v FSA makes it clear that it would be an abuse of process if the request is being pursued purely for an alternative purpose. However, Mr Elliott had mixed motives – he wanted information which would benefit him in his litigation, but he also wanted to discover whether Lloyds TSB had misused any personal information. In such circumstances, and following the case of Iesini v Westrip, the ‘but for’ test must be applied. In other words, but for the litigation, would Mr Elliott have nonetheless made the subject access request? The Court concluded that Mr Elliott would have made the request nonetheless, and therefore it was not an abuse of process.
2. Was it proportionate?
Could Lloyds TSB limit the scope of the search to what was reasonable and proportionate? Mr Elliott argued that the legislation did not introduce the concept of proportionality. Rather, Lloyds TSB could only rely on what was proportionate when it came to supplying the information which had been revealed by the search. This reflected guidance published by the Information Commissioner.
However, the case of Ezias v Welsh Ministers contradicts this, stating that “a data controller must take reasonable and proportionate steps to identify and disclose the data he is bound to disclose.” The Court followed the principle of Ezias and concluded that the further searches sought by Mr Elliott would be disproportionate. The Court said that the information held by the individuals would relate to the companies rather than Mr Elliott himself and any information would likely duplicate the information which had been found pursuant to the searches already carried out.
It was noted that Lloyds TSB had already spent almost 190 hours carrying out searches. Accordingly, although the searches need only be reasonable and proportionate, this does not automatically set a low threshold.
How can employers utilise this judgement to their benefit?
This case clarifies that:
1. if a subject access request is made by an individual who, as well as having a legitimate reason for the request, has an ulterior motive such as gathering information to benefit it in actual or proposed litigation, if the individual would not have made the request but for the litigation, the request will be an abuse of process and struck out; and
2. the search, as well as the supply of information found pursuant to the search, need only “reasonable and proportionate.”
This provides some relief for employers who may find themselves wasting valuable resources dealing with subject access requests. However, this case should be considered with caution. The United Kingdom has long been criticised for not implementing the rules set out by the European Union strictly enough. The EU has proposed legislation which will have direct effect in the UK which is likely to mean that the position will change, but in the meantime, employers can use this case to resist any onerous subject access requests.