'Legal privilege'

Background 
A member of the public made a ‘data subject access request’ to an organisation she believed had some information about her. When she did not receive a response, she sent a follow up to the organisation. When she still did not receive any response, she made a complaint to the ODPA. 

The ODPA approached the organisation to attempt to resolve the matter. The organisation was evasive and uncooperative in their response and said they would not give the woman any of the information about her as they believed it was exempt from data subject access rules as the information about her was covered by ‘legal professional privilege’. 

After numerous communications, the organisation revised its view that all of the information was subject to legal privilege. The woman subsequently received the information she was entitled to.

Learning points

• The right of access is one of the most important rights and organisations should have policies and procedures in place to respond to any requests made.
• There are statutory requirements to respond to requests within a certain time. Even where exemptions are used, a response must be sent.
• Exemptions must be applied narrowly, to specific personal data in specific circumstances. There should be no ‘blanket’ use of exemptions – if an exemption applies to only some of the personal data the rest that the exemption does not apply to should not be withheld too. 
• Consideration should be on a case-by-case basis taking into account the type of personal data, the purpose of the processing and any adverse impact of the application of the exemption on the individual concerned.
• Cooperation is key – the Authority has wide-reaching legal powers and is bound by confidentiality in all matters relating to its casework – you have a legal obligation to cooperate with the ODPA if you are under investigation, and you can be legally compelled to take certain action. Early engagement with the Authority benefits all parties and expedites a conclusion