The increasing number of requests under data disclosure laws for organisations to reveal the personal information they hold may be stemmed by the imminent verdicts in two appeal cases, according to IT lawyers.
Any deterrent would be welcomed by data controllers and IT staff who are being asked to ferret out information. Data Subject Access Requests (DSARs), most commonly issued by dismissed staff, are an increasing nuisance for many firms.
"A year ago I didn't have any but in the last month I've had five cases [of companies seeking advice to help them respond to DSARs]," said George Gardiner, a partner at London law firm Stephenson Harwood. "They range from 'What do we do?' to hugely experienced data protection officers who have complex cases that could lead to something serious."
DSARs are allowed under the 1998 Data Protection Act and can be requested by any individual to discover data regarding themselves held by employers or other organisations. Generally, the organisations must supply the data within 40 days of receiving a request and charge less than £10 for the service.
However, two appeal cases could change the picture by setting a precedent on what constitutes a "relevant filing system" that can be examined, and by defining fair reasons for requests. The cases - Financial Services Authority v Durant and R v Wozencroft - could influence the way DSARs are viewed in the future, said experts.
In both cases the original judgements suggested that requests had been irrelevant. "These two cases give employers a little bit of comfort if they decided not to respond to borderline cases," said David Mallon, associate at law firm MacRoberts. "Courts tend to take a pragmatic, commonsense approach."
Mike Pullen, data protection lawyer at law firm DLA, said that in some cases requests cost firms between £10,000 and £500,000 to process. However, he predicted that the appeal cases and a recent government consultation process would not bring relief to firms.
"We're seeing dozens of cases a month," said Pullen. "DSARs are being used as weapons to go beyond usual disclosure [but] there's no chance the law will be trimmed. You have an absolute right to gain information held about yourself. Companies should have systems to deal with it - prevention is better than cure."






reader comments