Court of Appeal comments on interplay between Data Protection Act and CPR disclosure

In a recent decision, the Court of Appeal has commented on the interplay between Civil Procedure Rule 31, which governs the disclosure and inspection of documents in litigation, and the provisions of the Data Protection Act 1998 which govern access to personal data: Durham County Council v Dunn [2012] EWCA Civ 1654.

In a claim relating to alleged assaults by staff at a residential centre in the early 1980s, the Court of Appeal upheld an order requiring the defendant council to allow inspection of staff personnel files without redacting the names of other residents of the centre.

The court referred to the potential for confusion as to whether a duty of disclosure arises primarily under the DPA or the CPR. It noted that a request for information under the DPA may be useful before proceedings have begun, and is likely to be less costly than an application for pre-action disclosure. However, once proceedings are on foot the parties' rights to disclosure are governed by CPR 31. This allows the court to excuse disclosure on public interest grounds, including protection of the privacy rights of others.

In such circumstances, the court must balance the fair trial rights of the party seeking disclosure against the privacy rights in question. The Court of Appeal emphasised that disclosure will be denied or restricted on public interest grounds only where this satisfies the test of strict necessity.

Background

The DPA contains various provisions relating to the protection of, and access to, personal data relating to individuals, including the following:

• Under section 7, an individual is entitled "to have communicated to him in an intelligible form" information containing any personal data about them. This is known as a subject access request. Where the information is not provided, the individual can apply for a court order.
• Under section 35, personal data is exempt from the DPA non-disclosure provisions where disclosure is necessary for the purpose of any legal proceedings, obtaining legal advice, or otherwise establishing, exercising or defending legal rights.

CPR 31.19 provides that a person may apply, without notice, for an order permitting him to withhold disclosure on the ground that it would damage the public interest.

The claimant's letter before action requested various documents, referring to the DPA. Some documents were provided, but the defendant refused to provide full copies of personnel files of various staff on the basis that these could only be disclosed with their permission or a court order. The claim was subsequently issued and the defendant objected to inspection of the personnel files for the reason referred to above. The question was whether the files should be redacted in respect of the names of other residents of the centre (who might be useful witnesses to the claimant) or provided in full.

Decision

The Court of Appeal held that the files should be provided in unredacted form. The court described it as "unfortunate" that the dispute about disclosure in this case had been "prolonged and distorted" by references to the DPA. This was a common law action for damages, not a subject access request under the DPA, and so was governed by the CPR.

The court said that it was misleading to refer to a duty to protect data as if it were a category of exemption from disclosure or inspection. CPR 31, read as a whole, enables and requires the court to excuse disclosure or inspection on public interest grounds. Here the relevant balancing exercise was between a party's right to a fair trial and the privacy rights of others. It was a distraction to start with the DPA: section 35 provides an exemption to the non-disclosure provisions where disclosure is required in the context of litigation, in effect leaving the court to determine the issue by the application of the appropriate balancing exercise under the umbrella of the CPR. 

The Court of Appeal said the proper approach was as follows:

1. Obligations in relation to disclosure and inspection arise only when the relevance test is satisfied. Relevance can include "train of inquiry" points which are not merely fishing expeditions. This is a matter of fact, degree and proportionality.
2. If the relevance test is satisfied, it is for the party or person in possession of the document or who would be adversely affected by its disclosure or inspection to assert exemption from disclosure or inspection.
3. Any ensuing dispute falls to be determined ultimately by a balancing exercise, having regard to the fair trial rights of the party seeking disclosure or inspection and the privacy or confidentiality rights of the other party and any person whose rights may require protection. It will generally involve a consideration of competing European Convention of Human Rights (ECHR) rights.
4. The denial of disclosure or inspection is limited to circumstances where such denial is strictly necessary.
5. In some cases the balance may need to be struck by a limited or restricted order which respects a protected interest by such things as redaction, confidentiality rings, anonymity in the proceedings or other such order. Again, the limitation or restriction must satisfy the test of strict necessity

Comment

It is interesting to compare the court's approach in this case with the recent Supreme Court decision on whether to grant Norwich Pharmacal relief to protect a party's intellectual property rights in the face of competing data protection rights (Rugby Football Union v Consolidation Information Systems Ltd (formerly Viagogo Ltd) (in liquidation) [2012] UKSC 55 - see post). In that context, the Supreme Court approved the following test for proportionality when evaluating competing rights under the ECHR  in the Norwich Pharmacal context: neither right has precedence over the other; the importance of the specific rights being claimed in the individual case must be compared; the justifications for interfering with or restricting each right must be taken into account; and the proportionality test – or "ultimate balancing test" – must be applied to each.

In contrast, in the context of disclosure in support of a damages claim rather than an application for Norwich Pharmacal relief, the Court of Appeal in the present case appears to give clear precedence to the right to disclosure of relevant documents as part of the ECHR right to a fair trial, emphasising that disclosure will be denied or restricted on public interest grounds only where strictly necessary.

The court's approach is however consistent with the trend of the case law relating to exemptions from disclosure on grounds of public interest immunity, where the courts have moved steadily away from a blanket application of immunity to particular categories of document, toward a much stricter approach whereby the court will carefully consider the competing rights and risks.

The judgment in this case contains an interesting discussion of public interest immunity and the extent to which it applies to social work records. Maurice Kay LJ, who gave the leading judgment, said that in a case such as the present one it "may be misleading to describe the issue as one of public interest immunity" and that it was wrong to treat all cases in which a public authority seeks exemption from disclosure on public interest grounds as being cases of public interest immunity "in the strict sense". The decision of Munby LJ reviews the authorities regarding public interest immunity in the context of social work records, illustrating the move away from a blanket approach toward a balancing of the relevant ECHR rights.