The Paramountcy of Data Subject Access Rights

In early 2017 an action was brought in the Bahamas Supreme Court by members of a discretionary class of beneficiaries under a family trust settled in the Bahamas and consisting of assets worth over $400 million. Most of the beneficiaries were resident in Australia. The claimants were objecting to a prior distribution made by the defendant trustee in favour of certain other members of the discretionary class, to the exclusion of the claimants, which had left only $9 million remaining in the trust fund.

The claimants faced a difficulty in that they were unable, in the Bahamian court, to obtain an order against the trustee for disclosure of documents that might reveal the trustee’s reasons
for the distribution, because of the principle in Re Londonderry’s Settlement [1965] Ch 918 and section 83(8) of the Bahamian Trustee Act 1998, which provided that trustees could not be compelled to disclose reasons pertaining to the exercise of their discretionary powers.

Accordingly, while the action was ongoing in the Bahamas, the claimants brought proceedings (Dawson-Damer v Taylor Wessings LLP [2015] EWHC 2366 (Ch)) in the High Court in England against TW, the trust’s English solicitors who, it was claimed, were in possession of documentation which would reveal the information sought by the claimants. The claimants invoked the SAR (‘subject access request’) procedure under s.7 of the Data Protection Act, 1998 (UK) against TW. One of the exceptions to the right of access to personal data under the section, contained in para.10 of Sched. 7 of the DPA, is the legal professional privilege exemption. Behrens J, in the High Court, held that the legal professional privilege exemption from disclosure applied in this case because the relevant documentation would be privileged under Bahamian law; but the Court of Appeal ([2017] EWCA Civ 74) reversed the lower court, holding that the para.10 exemption applied only to
cases where legal professional privilege could be claimed under English law. Accordingly, the exemption did not apply in the present case.

The Court of Appeal held that TW were bound to supply the information on the following grounds:

1. TW were data controllers within s.7 of the DPA.

2. The documentation relating to the exercise of the trustee’s discretionary powers was ‘personal data’ within the DPA.

3. DPA, Sched. 7, s.10 provides that ‘Personal data are exempt from the subject information provisions in s.7 if the data consist of information in respect of which a claim to legal professional privilege could be maintained in legal proceedings’.

Behrens J had interpreted s.10 as referring to legal proceedings anywhere (including the Bahamas) (the ‘wide view’), so that TW could rely on the exemption; but the Court of Appeal preferred the ‘narrow view’, that the exemption applied only to legal proceedings in the United Kingdom, and TW could not rely on the exemption because no proceedings were being brought in the UK concerning the trust.

4. TW, as an agent of the trustee, was bound to disclose the data, even though the trustee was not before the court, and even though a similar order could not have been obtained in the Bahamas.

5. The fact that the process of finding personal data would be costly and time-consuming was not a reason for not complying with a SAR. The onus was on the data controller to show that it had conducted a ‘reasonable and proportionate’ search for the data.

6. DPA, s. 7(9) gives an ‘untrammelled’ discretion to the court to make an order against a data controller to comply with a SAR. The court must apply the discretion with a view to fulfilling the purposes of the DPA, which confers rights on the data subject; the court was not exercising any jurisdiction in relation to the administration of trusts, which was a matter for the Bahamian courts. Accordingly, the court would not hold the SAR to be invalid merely because it was made for the collateral purpose of assisting litigation in the Bahamas.