This Court of Appeal decision is a useful reminder of the obligations of data holders under the data protection act. Those who wish to argue that material is privileged have to show that it is and the amount of work required to do so will not be an excuse unless it is disproportionate.

Lady Justice Arden:.

Meaning of paragraph 7 of Schedule 10 to the DPA

39. The preliminary issue here is the true interpretation of the words “legal proceedings” in paragraph 10 of Schedule 7 to the DPA (set out in the Appendix to this judgment). In my judgment, these words refer to legal proceedings in any part of the UK.

40. Parliament has not expressly limited the words “legal proceedings” to proceedings in the UK. But in general it is presumed that Parliament does not intend to legislate for events which occur outside the territory of the relevant parts of the United Kingdom.

41. That presumption is reinforced by the fact that, in creating the Legal Professional Privilege Exception, Parliament was exercising the member state option in Article 13(1)(g) of the Directive. It could, therefore, legislate only for measures to safeguard “the rights and freedoms of others”. Privilege is a fundamental human right (see R(o/a Morgan Grenfell Ltd v Special Commissioners of Income Tax [2003] 1 AC 563).

42. In the context of a member state option, those rights must be the rights recognised by the relevant member state under its own law. So, when paragraph 10 refers to legal professional privilege which may be recognised in legal proceedings, it means proceedings in any part of the UK. That is the only form of privilege which the domestic rules of the law of any part of the UK recognise.

43. This interpretation is further supported by (the) point that the Directive introduces a requirement for regulation on a territory by territory basis… leaves it to the member state in which a data controller is based to regulate its activities…

44. Moreover, if Parliament had intended to refer to proceedings in any part of the world, it would surely have introduced some provisions to identify which parts of the world would be relevant for the purpose of any particular information, and also some provisions to restrict abuse where the data controller sought to rely on a system with an unusually wide form of privilege.

45. Therefore, the Legal Professional Privilege Exception relieves the data controller from complying with a SAR only if there is relevant privilege according to the law of any part of the UK.


74. This Issue turns on the true interpretation of section 8(2) DPA (see Appendix). This qualifies the data controller’s obligation under section 7(1)(c)(i), which is to supply copies of information constituting personal information in permanent form, by the words “unless …the supply of such a copy is not possible or would involve disproportionate effort.”

75. It therefore falls to the data controller to show that the supply of a copy of the information in permanent form would involve disproportionate effort.

76. …I do not consider that the difficulties that can be taken into account in determining whether the supply of information in permanent form would be disproportionate for a data controller are limited to those which arise in the process of producing a copy of a document, but include difficulties which occur in the process of complying with the request which might result in the supply of the document involving disproportionate effort….

77. In my judgment, the word “supply” is used so that what is weighed up in the proportionality exercise is the end object of the search, namely the potential benefit that the supply of the information might bring to the data subject, as against the means by which that information is obtained. It will be a question for evaluation in each particular case whether disproportionate effort will be involved in finding and supplying the information as against the benefits it might bring to the data subject.

78. It appears that section 8(2) was applied on that basis in Ezsias.

79. Ezsias usefully shows that proportionality means that in appropriate circumstances there will be bounds to a search: the very words of section 8(2) assert that possibility. However, it is clear from the recitals to the Directive that there are substantial public policy reasons for giving people control over data maintained about them through the system of rights and remedies contained in the Directive, which must mean that where and so far as possible, SARs should be enforced. Moreover, most data controllers can be expected to know of their obligations to comply with SARs and to have designed their systems accordingly to enable them to make most searches for SAR purposes.

82…No doubt TW were also influenced by the view that Legal Professional Privilege Exception was available, and did not comply with the Request. In my judgment, when the narrow view is taken and the judge’s findings are examined, it is plain in this case almost beyond argument that further compliance with the Request would not involve disproportionate effort by TW.

83. In those circumstances, I have no doubt that TW have not made good its claim that it would involve disproportionate effort to take any further steps to identify personal data. The court is not yet at a stage when it could say that any particular steps would be disproportionate.

84. TW must produce evidence to show what it has done to identify the material and to work out a plan of action. It has singularly failed to do this and so has not discharged the onus on it.

Edited for ease of reading