New High Court ruling on Subject Access Requests

Clients who ask Starford to manage a DSAR they've received are always concerned about what information can be redacted, and particularly the rights of others who don't want their identities revealed.

In Harrison v Cameron and another [2024] EWHC 1377 (KB), the High Court has ruled that a company can rely on the ‘rights of others exemption’ under the Data Protection Act 2018 (DPA 2018) and refuse a data subject access request (DSAR) for the identities of the people to whom data in scope of the request has been disclosed, due to a significant risk of those individuals facing intimidation from the requester.
 
The focus of the case was on the disclosure of a recording of a heated telephone conversation between the claimant and first defendant, in which the claimant could be heard making threats of violence, and the claimant’s rights to gain access to the identities of the two dozen or so individuals to whom the recording had been disclosed.
 
The defendants relied on an exemption in the DPA 2018 to deny revealing the identities of recipients of the recording. This was upheld on the ground that in view of the threats made and intimidatory tone of some of the legal correspondence by and on behalf of the claimant, the second defendant (ACL) had exercised its discretion (as the controller) reasonably to use the ‘rights of others’ exemption to shield the recipients from a significant risk of hostility.

This judgment was only recently released and will be of interest because of its examination of the scope of access rights and several defined key terms and their related obligations under the UK GDPR.

At Starford, we understand the pressure on organisations to respond to a DSAR within 30 days (extended to 90 days in certain circumstances), yet we know that most in-house teams do not have the processes or resources in place to do this effectively.  We work with clients to understand what support they need to extract and redact documents and all our DSAR projects are reviewed by an employment lawyer to ensure any potentially contentious documents are flagged to the client, thereby mitigating the legal risk should an employment tribunal claim be lodged. 

If you would like our team to support you with Subject Access Requests, get in touch via hello@starfordlegalhr.com