Rights and privileges

Individuals are entitled to ask organisations to provide them with information relating to personal data held about them, under a subject access request (or a SAR).  That right, under the Data Protection Act, is subject to a limited number of exemptions.  One of those exemptions relates to personal data for which Legal Professional Privilege (LPP) could be claimed in legal proceedings.

There are two types of LPP: litigation privilege and legal advice privilege.

‘Litigation privilege’ relates to confidential communications made for the purpose of providing or receiving legal advice about proposed or contemplated litigation.  The ‘client’ could be the proposed claimant or defendant, but there must be a real likelihood of litigation for litigation privilege to arise.

‘Legal advice privilege’ applies where there is no litigation pending, and covers communications between legal advisers and their clients, where the main purpose of the communication is seeking or giving legal advice.

Unless LPP applies, an organisation is not entitled to refuse to supply personal data simply because the information in question is believed to relate to potential litigation.  Indeed, even if it is being requested in connection with litigation, if LPP does not apply, the organisation that holds the data cannot refuse to disclose it on grounds of LPP.

So, can an organisation refuse to disclose personal information in response to a SAR where litigation is contemplated?  The regulator (the ICO) recognises that if an individual issues a SAR, where litigation is contemplated or has begun, and the data controller refuses to provide the data asked for, a court may (or may refuse to) order disclosure, either under the DPA, or under the civil procedure rules. Either way, a data controller should think long and hard about not disclosing personal data to the data subject in response to a SAR: the DPA requires disclosure, with limited exemptions, and simply being involved in litigation is not one of those.