Data Protection Act – subject access requests

The Data Protection Act enables an individual to be informed of any data which refers to that individual which is held or being processed by or on behalf of a data controller, such as an employer or credit card provider.

 

In the recent case of Elliot v Lloyds TSB Bank PLC, the Claimant Mr Elliott, made subject access requests to Lloyds TSB Bank PLC, however he was not satisfied with the outcome. Mr Elliot disputed Lloyds’ compliance with s.7(1) of the Data Protection Act 1998 as to whether Lloyds was required to search for his personal data (if any) from the records of six senior managers within the bank. The bank refused to undertake a further search which prompted Mr Elliot to seek damages for breach of the Act and an order from the Court for further disclosure. 

 

Lloyds argued that Mr Elliot’s application was to further his potential claims against them and not for the dominant purpose of obtaining information. The court found that Mr Elliot had mixed motives in bringing the claim although rejected Lloyd’s “dominant purpose” test; instead the Court applied the “but for” test, stating: “the application will not be an abuse of process unless it can be shown that but for the collateral purpose the application would not have been brought at all”. The court held that Mr Elliot would have brought the claim regardless of the prospective claim and so it was not an abuse of process.

 

The court, however, held that the Lloyds was only obliged to conduct a reasonable and proportionate search and that it would be disproportionate to order further searches, namely searching the records of the six senior managers identified by Mr Elliott; this being the usual test applied for standard disclosure under Civil Procedure Rule 31.

 

Lloyds had disclosed a substantial amount of new data after Mr Elliot lodged his claim. It was determined that the initial searches carried out by Lloyds would not have been sufficient to satisfy its obligations under the Act, accordingly Lloyds were ordered to pay a substantial part of Mr Eliot’s costs as a result of this failure. Although it was held to be disproportionate for Lloyds to carry out further searches this case serves as a timely reminder to ensure that proper searches are originally undertaken in order to avoid paying costs borne out of this failure.