DSAR: Disclosure of mixed personal data.

Summary: (a) There is no presumption of non-disclosure in cases of mixed data, and (b) the motivation of the requestor will not devalue the request.

DB v GMC [2018] EWCA Civ 1497?is now the leading case on the treatment of mixed personal data when assessing the balance of interests between the requester of a subject access request (DSAR) and third parties whose data might be disclosed as a result.

The case concerns the General Medical Council's (GMC) appeal against an injunction granted in favour of Doctor D for restraint of the disclosure of an expert report to a patient. It was argued that Doctor D's interests, as a third party, were protected by the Data Protection Act 1998.

In terms of the restriction for mixed personal data cases, Schedule 2 paragraph 16 of the DPA 2018 largely mirrors the now repealed provisions of Section 7 of the DPA 1998.

The Court of Appeal held that the starting point in cases concerning mixed personal data, where the third party does not consent to the disclosure, is not a presumption of non-disclosure. The question data controllers need to ask themselves is whether it was reasonable in all the circumstances to comply with the DSAR without the consent of the other individual (third party). In the unlikely event that a data controller, having undertaken the balance of interests, decides that the considerations for and against disclosure are equal, a presumption against disclosure should be used as a "tie breaker" (para. 68).

Furthermore, there is no general principle that the requester's interests, when balanced against those of the third party, should be devalued by the requester's motivation in seeking to obtain information that might assist the requestor in litigation against the objector (para.79). The general position is that the rights of subject access to personal data under Article 12 of the Directive and section 7 of the DPA are not dependent on appropriate motivation on the part of the requester: see?Durham County Council v Dunn?[2012] EWCA Civ 1654, [16] (Maurice Kay LJ);?Gurieva v Community Safety Development (UK) Ltd?[2016] EWHC 643 (QB), [72] (Warby J);?Dawson-Damer v Taylor Wessing LLP?[2017] EWCA Civ 74;?[2017] 1 WLR 3255, [105]-[113] (Arden LJ);?Itthadieh v 5-11 Cheyne Gardens?[2017] EWCA Civ 121;?[2017] 3 WLR 811, [104]-[110] (Lewison LJ); and see also the Information Commissioner's?Subject Access Code of Practice?("the purpose for which a [SAR] is made does not affect its validity, or [a data controller's] duty to respond to it": version 1.1, p. 20; version 1.2, p. 26).

The Court of Appeal also considered the risk, in cases of mixed personal data, that the recipient might use the information obtained for an unlawful purpose, e,g, to post the information on the internet to try to traduce the objector (para. 79). It was suggested that it would be open to the data controller in such a case to invite the requester to consider giving a binding contractual undertaking to the data controller or the objector or both, to restrict the use to which the information might be put. In conducting the balancing exercise under section 7(4), the data controller would then be entitled to take into account whether such an undertaking had been proffered, or not, when deciding whether it was reasonable to make disclosure. The Court of Appeal did not think that this would usually be an appropriate course to try to restrict a requester from using information sought by means of a SAR in litigation thereafter. Later use in litigation is not something which is illegitimate in itself, so far as the subject access regime is concerned (para.83).?

If you would like to discuss the topic of GDPR readiness in more detail or any of the other?services we offer, please feel free to get in touch:?[email protected]

If you found this article useful, please feel free to like and share, connect with or follow me.