Gurieva & Anor v Community Safety Development (UK) Ltd

A data controller claiming an exemption from subject access rights must justify it by convincing evidence and cannot rely on generalised or blanket assertions. The crime exemption requires a selective assessment of whether disclosure would create a weighty and significant chance of prejudice. Any restriction must also be necessary and proportionate.

Litigation privilege protects only data shown to satisfy the established conditions for privilege. A subject access request may ordinarily be enforced unless the controller shows a good reason against enforcement. A collateral interest in litigation does not, without more, make the request abusive.

Two individuals made a subject access request to a private investigation company which held about 1,500 documents containing their personal data. The company had undertaken civil, regulatory and criminal investigative work for clients involved in a dispute with the claimants. It declined to provide any data, relying on alleged defects in the request, the crime exemption, litigation privilege, proportionality and abuse of process.

The claimants sought a declaration of non-compliance and an order under section 7(9) of the Data Protection Act 1998. The issues were whether the request was valid, whether the personal data were exempt, and whether the court should exercise its discretion to order compliance.

1. The claim succeeded. The subject access request was valid, the defendant had failed to comply with it, and there was no good reason to withhold enforcement. The court would make a declaration and an order requiring compliance.

2. A controller may seek further proof of identity under section 7(3) of the Data Protection Act 1998 only where it reasonably requires that information. The defendant already knew the claimants' identities. A firm of solicitors which confirms its authority in the request should ordinarily need to provide nothing further.

3. The crime exemption required proof that the data were processed for a specified purpose and that applying the subject access provisions would be likely to prejudice that purpose. The defendant showed that some data were probably processed for detecting or prosecuting crime, but did not establish this for all the data. It also failed to identify any specific, weighty and significant chance of prejudice. A blanket exemption for private investigators was inconsistent with the selective, targeted and proportionate assessment required by section 29(1).

4. The claim to litigation privilege also failed. The defendant had not analysed the documents or supplied sufficiently specific evidence of their purpose. Its work had several purposes, and pre-existing documents did not become privileged merely because an investigator obtained them for litigation. Some data might be privileged, but the defendant had not proved that all were protected.

5. An enforcement order requires the controller to review its data, disclose non-exempt personal data and give reasoned grounds for any exemption claimed. It does not require disclosure of privileged data or data whose disclosure would prejudice a criminal investigation or prosecution. Disclosure concerns information, not necessarily the underlying documents.

6. The discretion under section 7(9) should ordinarily favour a person who has made a valid request unless there is a good reason otherwise. Reviewing about 1,500 identified documents was not disproportionate. The possible existence of a later disclosure exercise in foreign proceedings did not justify withholding relief.

7. The court should generally avoid investigating the requester's purpose. Even assuming that abuse of process can apply, no abuse was proved. The request was supported by a genuine concern that inaccurate personal data were being processed. Seeking information which might also assist in actual or contemplated litigation is not inherently improper.

8. The court declined to inspect the data under section 15(2). The controller had to undertake the primary assessment first; the court's function was to review its conduct.

not stated in the judgment.