Case Study 3 - Access request – legal advice that it should not be granted because of High Court proceedings – compliance following intervention by Office
I received a complaint from an employee of a residential care school, regarding the apparent failure of the school to comply with a request for access to personal data held by the school relating to him.
I pointed out to the data controller that under section 4 of the Data Protection Acts, an individual is entitled to obtain from any data controller, upon request in writing, a copy of all personal data relating to him held by the data controller on computer or in a relevant filing system. This right of access is subject only to some very limited exceptions as specified in the Acts (such as where allowing access would impair the investigation of an offence, or would cause serious harm to the individual's physical or mental health).
My staff asked
- whether the school held any personal data relating to the data subject at the time of his access request,
- if so, why those details had not yet been provided to him, and if not, why he had not been informed
- what action, if any, they now proposed to take to address this matter.
The Data Controller indicated that the complainant had a personal injuries action pending. He had sought voluntary discovery of various documents relating to his claim. The Data Controller had agreed to comply with the request for voluntary discovery which had the same effect as a High Court order. On the basis of their legal advice, the Data Controller submitted that the invoking of the jurisdiction of the High Court precluded the data subject from using the Data Protection Acts’ subject access provision as ‘a parallel process’ to obtain documentation and that his request for access to his personnel file was premature given that there were High Court proceedings in being.
My staff pointed out that there is no provision in section 4 or section 5 restricting access to personal data which might impact on forthcoming proceedings, other than data in respect of which a claim of privilege could be maintained. They indicated that they did not accept that, as the data subject had invoked the jurisdiction of the High Court, he was precluded from using data protection legislation as a ‘parallel process’ to obtain documentation. They were advised that the Acts require the data controller to provide the data subject with access to his personal data unless one of the exemptions in section 5 applied.
Having taken legal advice, the Data Controller agreed to comply with the access request.
This case shows that a Data Controller must have a clear statutory basis for refusing an access request.
» Permanent Link