The Court of Appeal has ordered international firm Taylor Wessing to comply with an application for information it held about parties embarking on litigation despite the firm's claim that the data was covered by legal professional privilege. 

The firm had acted for the trustee of a Bahamian trust known as the Glenfinnan Settlement, and had refused the request from a beneficiary of the trust for personal data relating to themselves.

The beneficiary had served a subject access request under section 7(2) of the Data Protection Act and applied to the court for a declaration that Taylor Wessing had not complied.

In August 2015, His Honour Judge Behrens dismissed this application, but that decision was overturned by the Court of Appeal following a two-day hearing in November 2016.

Taylor Wessing had replied to the original request stating that the personal data was covered by legal professional privilege and was exempted from disclosure.

Behrens had ruled the purpose of the Data Protection Act was not to provide parties with information which might assist them in litigation against the trustee.

He also held that it was not reasonable or proportionate to expect Taylor Wessing to carry out any search or to expect it to be able to determine which documents were privileged, suggesting this was a time-consuming and costly exercise.

In the appeal, Taylor Wessing submitted that the legal professional privilege exemption showed parliament had not intended that a data subject should be able to ‘use a solicitor as a means to reach the client’. The firm argued that the trustee retained the privilege and the data controller was bound to assert it.

The Information Commissioner’s Office (ICO) intervened in the appeal and asserted that the burden of proof was on the data controller to show why the subject access request should not be complied with. It added that solicitors cannot refuse to comply with a request simply on the basis that it would be costly and time-consuming.

The ICO said Behrens should have concluded Taylor Wessing had breached its obligations under the Data Protection Act and that not to do so was a material error of law.

It added that the firm could not properly say at the outset that it would do nothing, and the act was intended to put power into the hands of the data subject.

In Dawson-Damer & Ors v Taylor Wessing LLP, Lady Justice Arden agreed that it fell to the data controller to show that the supply of a copy of the information requested would involve disproportionate effort.

‘I have no doubt that TW have not made good its claim that it would involve disproportionate effort to take any further steps to identify personal data,’ she said. ‘The court is not yet at a stage when it could say that any particular steps would be disproportionate. TW must produce evidence to show what it has done to identify the material and to work out a plan of action. It has singularly failed to do this and so has not discharged the onus on it.’

Arden said an order for disclosure should be made and remitted the matter to the Chancery Division.