SARs are becoming an increasingly common tool of claims management companies in their pursuit of insolvency practitioners and the organisations that they work for. As a result, I thought that the recent decision in the case of Dawson-Damer -v- Taylor Wessing LLP might provide some comfort. Whilst the decision was not related to insolvency and involved arguments as to whether a manual filing system was subject to the Act and whether third parties rights were affected, there are some useful statements on the law that might assist Insolvency Practitioners.
An SAR is often used as (and, possibly, more often seen by the recipient as) an attempt to start a fishing expedition for information that might allow a claim to be pursued against the party to whom it is directed. The Court in this case returned to first principles by pointing out that the Data Protection Act, 1998 (the “Act”) was the introduction into UK law of the Directive 95/46/EC of 24th October 1995 On The Protection Of Individuals With Regard To The Processing Of Personal Data And On The Free Movement Of Such Data (the “Directive”). The aim of the Directive was, the Judge said: “to protect individuals’ fundamental rights, notably the right to privacy and accuracy of their personal data held by others” and that the Act: “provides an individual with a right of access to ‘personal data’, entitling him to know whether a data controller is processing any of his personal data and, if so, to be told what it is, its source, why it is being processed and to whom the data are or may be disclosed.”
As you will appreciate, this is far from entitling the individual to make a request for all the information relating to them. An individual is entitled (section 7 of the Act) to be informed if personal information is held about them; the nature of, use of and dissemination of that data; and, copies of the data held and its source. The notes that an Insolvency Practitioner makes concerning the individual and the advice to be given, the basis of that advice and the decisions taken with regard to the case are all outside the scope of the Act. The data relating to the conduct of an insolvency is often a separate matter from the data relating to the individual and the two should not be confused.
As always, the circumstances of each case will dictate the correct approach, but it is useful to have a recent Court judgement upon which to base these decisions.