This DechertOnPoint reports on a recent County Court decision on UK data subject access requests which suggests that an employer’s (or other data controller’s) search for personal data need only be proportionate and that a SAR cannot properly be made for the purposes of actual or contemplated litigation rather than the right to be informed of the processing of personal data.

Dealing with a data subject access request (SAR) served by an individual, whether or not that person is an employee, pursuant to section 7 of the Data Protection Act 1998 (DPA) can be very time consuming given that it entails the process of identifying the electronic material which refers to the individual in question and then analysing that material to assess whether it falls properly to be disclosed as personal data for the purposes of the DPA.

Data controllers (often employers) may on occasion be concerned that a SAR is being made as a “fishing expedition” for the purposes of actual or intended litigation and the question then arises of whether they can refuse to comply on the basis that the SAR was not designed to force them to search for and reveal documentation outside the normal process of disclosure in actual litigation.