Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd& Ors

A subject access request under Data Protection Act 1998 section 7 seeks personal data, not documents. A data controller must carry out a reasonable and proportionate search, but need not leave no stone unturned or search material protected by legal professional privilege.

A request may pursue litigation as well as privacy-related purposes. That collateral purpose does not invalidate it. If the controller has breached its duty, the court will ordinarily enforce compliance unless a good reason, assessed proportionately and consistently with the statutory purpose, justifies refusal. The court may consider the practical value of disclosure, an alternative route to the information, abuse, prior disclosure and the gravity of the breach.

Personal data are information relating to an identifiable individual. Mere inclusion of a name does not make all information in a document that person’s personal data.

Two appeals concerning subject access requests under the Data Protection Act 1998 were heard together.

Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd concerned a leaseholder’s request to a right-to-manage company and people connected with it, following disputes about management of a residential block. HHJ Seymour QC dismissed the claim against the individuals, declined enforcement against the company and transferred the remaining compensation claim.

Deer v University of Oxford concerned a former employee’s wide-ranging requests while employment litigation was ongoing. HHJ Harris QC held that the University need take no further step, but declared that its earlier searches had been inadequate and made a qualified costs order. Dr Deer appealed; the University cross-appealed.

The central issues included personal data, data controllership, the form and purpose of a SAR, proportionate searches, the household exemption and the discretion under section 7(9).

1. All appeals were dismissed. Lewison LJ gave the court’s reasons, with which Lloyd Jones and McCombe LJJ agreed.
2. Personal data. The definition has two limbs: the information must relate to a living individual, and the individual must be identifiable. A name may itself be personal data, but a person’s appearance in a document does not turn the entire document into that person’s data. The proper focus is the personal information contained in it. Information supplied by the data subject can still be personal data.
3. SARs and searches. A SAR need only be a written request which, read fairly as a whole, makes clear that the recipient is asked to comply as data controller. Its validity is not conditional on payment of a fee. A collateral litigation purpose does not by itself invalidate a SAR. The statutory entitlement is to information constituting personal data, rather than to copy documents. A controller must take reasonable and proportionate steps to search, but proportionality limits the effort required. It does not permit a blanket refusal. Privileged material need not be searched, subject to a proportionate search where privileged and non-privileged material must be separated.
4. Section 7(9). The discretion is directed by the statutory purpose. Once non-compliance is shown, enforcement will ordinarily follow absent a good reason. Relevant considerations include proportionality, the value of the data, the seriousness of the breach, alternative disclosure routes, prior provision, and abuse. In Ittihadieh, the request was addressed only to the RTM company; processing by residents concerning management of their own block fell within the personal and household exemption, and further enforcement would have been disproportionate. In Deer, some documents contained small amounts of personal data, but refusal of further relief was within the judge’s discretion.
5. The declaration that the University’s earlier searches had been inadequate, and the costs order reflecting both Dr Deer’s success before the Recorder and the disproportionate, antagonistic conduct of the litigation, were upheld.

• Court of Appeal (Civil Division): appeals by Mr Ittihadieh and Dr Deer, and the University’s cross-appeal, dismissed: [2017] EWCA Civ 121.
• High Court, Queen’s Bench Division: HHJ Seymour QC refused enforcement of Mr Ittihadieh’s SAR and transferred the residual compensation claim to the county court.
• High Court, Queen’s Bench Division, Oxford District Registry: HHJ Harris QC declined further relief on Dr Deer’s SARs, made a declaration concerning the University’s earlier search obligations, and made the challenged costs order.