ODPA orders Collas Crill to disclose withheld personal data

In this case the Complainant had donated funds, via a gift letter, to a third party (“the clients”) for the purchase of a property. The Complainant did not retain a copy of the letter at the time. The clients then disclosed this letter to Collas Crill (a Law firm) who were acting on their behalf in the purchase of the property.

A legal dispute later arose between the Complainant and the clients regarding the provision of the funds.

In July 2025, the Complainant submitted a Data Subject Access Request (“DSAR”) to Collas Crill, seeking a copy of the gift letter.

Collas Crill responded to the DSAR providing a limited summary of the Complainant’s personal data, confirming their full name, residential address, bank account details and email address. The response did not include the gift letter nor most of its contents. 

As a result, the Complainant submitted a complaint to the Authority. 

Before initiating a formal investigation, the Authority engaged with Collas Crill to explore whether the matter could be resolved informally. During this process, the Controller provided the Authority with a copy of the gift letter for review.

During this period, Collas Crill informed the Authority that it was withholding the gift letter on the basis that it was legally privileged, pursuant to the “Privileged items” exemption. 

Collas Crill also stated that it had considered section 16 of the Law, which can allow a requestor’s personal data to be withheld when it overlaps with that of a third party. In this case the third-party data related to the clients, and Collas Crill asserted that section 16 supported its decision to withhold the gift letter.

It is important to note that neither exemption nor exception had been communicated to the Complainant or the Authority prior to this point. As a result, the Authority had concerns and initiated a formal investigation into the matter. 

In its earlier correspondence (including its response to the DSAR), Collas Crill had not contended that the gift letter was subject to Legal privilege. Previous statements made by Collas Crill to both the Complainant and the Authority showed that the gift letter had been provided to Collas Crill to corroborate the source and status of the funds, rather than for the purpose of obtaining legal advice. 

Additionally, Collas Crill did not demonstrate to the Authority that any communications containing legal advice relating to the gift letter existed or had been provided to the clients.

The Authority noted that Collas Crill’s earlier communications to both the Complainant and the Authority were inconsistent with, and appeared to contradict, its later position.

As a result, the Authority concluded that the gift letter was not covered by legal privilege.

With regards to section 16, the Authority identified multiple factors supporting the disclosure of the Complainant’s personal data, despite overlapping with the clients’ personal data, including:

• The gift letter was written and signed by the Complainant for the benefit of the clients. The Complainant was, therefore, fully aware of the circumstances of the property purchase and the nature of the third-party personal data contained within the letter. 
• Considering the Complainant is the source of the gift letter, there is a reasonable expectation that the same information being returned to them would not impact any of the relevant parties.
• The gift letter is almost entirely the Complainant’s personal data and is written in the first person as a statement/declaration.
• The gift letter contains minimal personal data relating to the clients, none of which is sensitive or special category.

Additionally, Collas Crill asserted that legal action on the part of the Complainant was sufficiently adverse to the significant interests of their clients to justify the application of section 16. 

However, the Authority assessed that the perceived adversity had not been evidenced by Collas Crill. The Authority, therefore, concluded that the fact the Complainant’s interests were not aligned with those of the clients, did not support the application of section 16.

Why was that a problem?

Section 15 of the Law gives individuals the right to receive one copy of their personal data. Controllers should take reasonable steps to comply with this right, while taking into account any other relevant provisions of the Law, such as the exemptions in Schedule 8. This is an important part of ensuring individuals can exercise their data protection rights effectively.

Collas Crill did not apply an appropriate exemption to the information contained in the gift letter. By withholding this personal data from the Complainant, Collas Crill prevented them from accessing information they were entitled to receive.

What has happened as a result?

Following the investigation, the Authority found Collas Crill’s application of the Privileged items exemption and section 16 did not comply with the Law.

The Authority, therefore, determined that Collas Crill had failed to comply with the Complainant’s right of access by unlawfully withholding personal data within the scope of the original DSAR. This breached the Law.

The Authority issued an Enforcement Order requiring Collas Crill to provide the Complainant with a copy of the gift letter.

Further details of the Authority’s findings and the action taken can be found in the attached public determination.

What can be learned from this?

When withholding personal data captured by a DSAR, controllers must apply an appropriate corresponding exemption/exception under the Data Protection (Bailiwick of Guernsey) Law, 2017 to support their decision. The Law usually also requires the controller to explain this decision to the requestor by the statutory deadline. 

Failing to do so risks non-compliance and a lack of transparency. It may also indicate that insufficient consideration has been given to data protection requirements, which can be an aggravating factor if the Authority investigates the matter. The Authority’s guidance on exemptions can be found here: Exemptions | ODPA.

While legal privilege is a common consideration for law firms, organisations should remain cautious when responding to DSARs and deciding whether the Privileged items exemption applies. Privilege does not automatically attach to documents simply because they were provided to a lawyer. The documents themselves must meet the requirements for legal privilege to apply.

“Access to one’s personal information is a foundational data protection right, and organisations should ensure that openness and transparency are core considerations when handling any access request. Exemptions, including legal privilege, must be considered carefully and applied properly. They should not be used in a way that unnecessarily frustrates an individual’s right of access,” said Commissioner Homan.

Read the full determination