Court of Appeal considers whether paper files constituted a “relevant filing system” under the DPA

27th March 2020 Media Law

The Court of Appeal recently revisited the issue of whether a paper file constitutes a “relevant filing system” within the meaning of section 1(1) of the DPA 1998. In this blog, I will consider the Court of Appeal’s decision and its relevance for both data controllers and data subjects.

Background

The Claimants, a widow and her two children, sought access to documentation relating to a number of family trusts, which held in excess of $400million from the Estate of the late Gerge Skelton-Yuill and were administered under Bahamian laws. The Claimants were beneficiaries of the trusts and seeking to challenge the validity of certain trust appointments and restructuring in legal proceedings commenced in The Bahamas. Those proceedings remain ongoing. The Claimants made a number of data subject access requests under the English DPA 1998 to gain access to documentation held by Taylor Wessing, who were the trusts’ solicitors, and which related to them.

This is in fact the second time that the Court of Appeal was asked to give judgment in the matter of Damson-Damer v Taylor Wessing [2020] EQCA Civ 352 on issues that involved the interplay of legal professional privilege and data protection. This blog considers only the latter. 

The Court of Appeal was asked to consider whether Taylor Wessing’s unstructured paper files constituted a “relevant filing system”, with the High Court having concluded that certain paper files did for the purpose of the DPA 1998.

The High Court

The Judge in the High Court held that Taylor Wessing’s 35 paper files under the client description “Yuills Trusts”, arranged in chronological order, and the client being the trustee of those trusts, were a relevant filing system, and Taylor Wessing was required to search these for personal data of the Claimants.

The Court of Appeal

Taylor Wessing argued that the paper records were not structured in a way that allowed data to be easily retrieved, and fell outside of the scope of section 1(1) of the DPA. 

The Court of Appeal agreed.

A “relevant filing system

Within section 1(1) of the DPA 1998 a “relevant filing system” is defined as:

“any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible."

In reaching its decision, the Court of Appeal revisited the earlier Court of Appeal decision in Durant v Financial Services Authority [2003] EWCA Civ 1746 and how that fits alongside a later decision of the CJEU. 

In Durant, the Court of Appeal, held that a manual filing system can constitute a relevant filing system, if it was of a sufficient sophistication to provide ready access to data. That required a filing system referenced or indexed in a way to enable the data controller’s employees to identify with reasonable certainty and speed the files in which specific data relating to the person requesting it was located and to locate the relevant information about it in the files, without a manual search.

The Court of Appeal also referred to the ICO’s Guidance from May 2011 known as the “temp test” that is,

“If you employed a temporary administrative assistant (a ‘temp’), would they be able to extract specific information about an individual from your manual records without any particular knowledge of your type of work or the documents you hold?”

The Court of Appeal in this case endorsed the ECJ approach in Case C-25/17 Tietosuojavatuutettu. The CJEU adopted a much broader test, one of functionality as to whether a specific criteria enabled the data to be easily retrievedIn light of the CJEU’s judgment, the requirement in Durant that files forming part of the system must be structured in such a way as to clearly indicate at the outset of a search whether specific information relating to an individual is held, and if so, in which file(s) was too narrow. If the structure is such that ready access to information is enabled, that is sufficient. In addition, the necessity of a level of sophistication in the structure and accessibility of files was held to not sit happily alongside the CJEU’s broad interpretation.

What then is the test?

In light of the CJEU’s broad interpretation, the Court of Appeal held that the tests to be applied are:

1. Are the files “a structured set of personal data”?

2. Are the data accessible according to specific criteria?

3. Are those criteria “related to individuals”? 

The Court of Appeal held that the degree of specificity does not preclude a finding that it relates to an individual. It could be their name or as remote as the street on which they live.

4. Do the specific criteria enable the data to be easily or readily retrieved?

The evidence of Taylor Wessing was that the 35 paper files were not held in reference to any particular individual or piece of advice that might directly concern the Claimants, and extracting personal data would require an individual to review each page of the 35 files. The criterion “Yuills Trust” was unspecific or of no assistance in the retrieval of personal data relating to individual beneficiaries.

The Court of Appeal held that “ready access” must be enabled by the criteria (i.e. the structure of the files). If access required the use of trainees and skilled lawyers reviewing the pages to identify material, that is a clear indication that the structure itself did not enable ready access. There has to be a causative link between the criterion and the ease of retrieval, and the “rule of thumb” in the ICO’s temp test can assist in this consideration.

There was no support for a finding of ready access to personal data and on that basis the 35 files were not a relevant filing system within the meaning of the DPA. 

Looking ahead

Whilst the case was decided under the old DPA regime, which has since been replaced by the GDPR and Data Protection Act 2018, the Court of Appeal’s decision will be of interest to both data controllers and data subjects, not least when considering a subject access request or how personal data is processed and stored. The GDPR applies to the processing of personal data by both automated and manual means, provided that the personal data is held within, or intended to be held within, a filing system. Within the GDPR, a “filing system” is defined as “any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis” (at Article 4(6)). It remains to be seen how the Courts interpret this in light of the recent Court of Appeal decision. ​​​

We're Social

Rebecca Young is a Senior Associate located in Manchesterin our Commercial LitigationMedia Law departments

View other posts by Rebecca Young

Let us contact you

*
*
*
*
*

COVID-19 Update - Our website and phone lines are operating as normal and our teams are on hand to deal with all enquiries. Meetings can be conducted via telephone and video conferencing.

View our Privacy Policy

Areas of Interest