What Is A Subject Access Request?

Subject Access Request Overview

A subject access request is a request by an individual for their personal data and for details concerning the holding of their personal data.

Under Article 15 of the UK GDPR (“Article 15”), an individual can obtain access to their personal data that a data controller has on them along with details of the categories of data, the reason and lawfulness of the data controller processing their personal data, details of the persons (or categories of persons) to whom their data has been disclosed and the period the data is to held. Compliance with Article 15 should be within one month in light of Article 12.

In addition, the individual can ask for rectification and erasure of their personal data.

Purpose Of A Subject Access Request

The purpose of a subject access request is to check intended to check the accuracy of a person’s personal data and that it is being lawfully processed. In the case of Rotterdam v M. E. E. Rijkeboer the Court said:

That right to privacy means that the data subject may be certain that his personal data are processed in a correct and lawful manner, that is to say, in particular, that the basic data regarding him are accurate and that they are disclosed to authorised recipients.

What Is Personal Data?

Personal data is data about an individual such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.

The following was said about personal data In the case of Durant v Financial Services Authority [2003] EWCA Civ 1746 (“Durrant”):

 …not all information retrieved from a computer search against an individual’s name or unique identifier is personal data within the Act…the mere fact that a document is retrievable by reference to his name does not entitle him to a copy of it under the Act

Personal data is not documents; it is data.

The Right To Personal Data Is Not A Right To Documents Containing The Personal Data

A subject access request is not a right of the data subject to discovery as would be the case in litigation.

A Subject Access Request is an entitlement to personal data set out inter alia in Article 15(1) of the GDPR; it is not an entitlement to documents or copies of the documents.

In the Court of Appeal’s decision in the matter of Durant v Financial Services Authority [2003] EWCA Civ 1746:

It is not an entitlement to be provided with original or copy documents… Nor is to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against third parties.

 The Information Commissioner’s Office confirms the same in its right of access and how to supply information to the requester guidance:

The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data.

In the case of Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd& Ors [2017] EWCA Civ 121 the following was highlighted about an SAR:

.. it is not an obligation to supply documents: Dunn v Durham CC [2012] EWCA Civ 1654, [2013] 2 All ER 213 at [16]. It is of critical importance to distinguish between the two. Although it may be more convenient and cheaper in some cases for a data controller to supply copy documents, there is no legal obligation to do so. It is very easy, however, to slip from dealing with personal data into dealing with electronically generated or stored documents in which personal data are recorded.

In essence, a subject access request is not an alternative to obtaining documents via the discovery and disclosure process in litigation but the purpose that the data subject wishes to deploy the data does not appear to fetter their rights to obtaining it:

“…a collateral purpose of assisting in litigation is not an absolute bar: Dawson-Damer at [112]”

What Is The Scope of UK GDPR?

As set out in Article 2 of UK GDPR the scope of UK GDPR regulation is largely confined to the automated or structured processing of personal data. This relates to data that is or is largely part of a filing system. 

What Is A Filing System?

A filing system is defined as “any structured set of personal data which are accessible according to specific criteria…” in Article 4 UK GDPR definitions.

This position was explained in the case JEHOVAN TODISTAJAT v. TIETOSUOJAVALTUUTETTU / Case C-25/17 / (10 July 2018)

As is clear from recitals 15 and 27 of Directive 95/46, the content of a filing system must be structured in order to allow easy access to personal data. Furthermore, although Article 2(c) of that directive does not set out the criteria according to which that filing system must be structured, it is clear from those recitals that those criteria must be ‘relat[ed] to individuals’. Therefore, it appears that the requirement that the set of personal data must be ‘structured according to specific criteria’ is simply intended to enable personal data to be easily retrieved.

UK GDPR does not appear to apply to data that is not part of a ‘filing system’: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/what-is-personal-data/

The UK GDPR does not cover information which is not, or is not intended to be, part of a ‘filing system’.

Exemption For Legal Privilege?

Legal privilege (“LP”) is usually paramount to protect the holder of such privilege from the requirement to be compelled to disclose the same. How does this influence a subject access request?

Schedule 2 of the Data Protection Act 2018 provides the following exemption at Part 4 paragraph 19:

The listed GDPR provisions do not apply to personal data that consists of—

(a)information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings, or

(b)information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

The position of the Court was set out in terms of LP and a subject access request in Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd& Ors [2017] EWCA Civ 121:

Where documents are covered by legal professional privilege the combined effect of sections 27 (2) and Schedule 7 paragraph 10 of the DPA means that the “subject information provisions” do not apply. Those provisions include section 7. Since an implied obligation to search arises only by reason of section 7 as amplified by section 8 (2), it follows, in my judgment, that there is no obligation to search for material covered by legal professional privilege in proceedings within the UK. This is consistent with the conclusion of this court in Dawson-Damer at [45] that the legal professional privilege exception relieves the data controller from what would otherwise be his obligation to comply with the SAR. Plainly, this only applies to the extent that personal data are covered by legal professional privilege. If some personal data are covered by legal professional privilege and others are not, the data controller will have to carry out a proportionate search to separate the two: Dawson-Damer at [83]. In addition data may be exempt under one or more of the other exemptions in Schedule 7 to the Act; and once again the question whether they are is a matter of evaluative judgment which must be carried out by a human being.