knowledge 27 February 2018 |

High Court Orders Defendant to Make Data Subject Access Request to Satisfy Plaintiff’s Discovery Request

The decision¹  concerned a motion for discovery brought by the plaintiff, Susquehanna International Group (“SIG”), against the defendant, in proceedings seeking an injunction and damages for breach of the defendant’s employment contract. He had left the plaintiff’s employment for employment with a foreign competitor. The plaintiff alleged that the defendant had assisted that competitor with the recruitment of other SIG employees, and had supplied confidential information about SIG’s business to that competitor in advance of it setting up in Dublin and operating in a similar field.

Neither the competitor nor the recruitment agency engaged by it to recruit the defendant were parties to the proceedings. The plaintiff’s discovery motion requested that the defendant disclose various documents which included information held by those non-parties “that the defendant can obtain on foot of data protection requests”. The court noted that this might include documents relating to any interview process engaged in by an employer with a prospective employee. The issue for the court to consider was the “novel question of whether a court should order a person to make discovery of documents that he or she can obtain on foot of a data subject protection request”.

The decision

Documents are discoverable where they are relevant and necessary to the fair disposal of the matter in dispute. A party to legal proceedings must disclose all such documents within its “possession, power or procurement”. SIG argued that documents available to the defendant by way of a data subject access request were within the defendant’s “power”. Baker J ultimately accepted this argument and quoted from Clarke J’s judgment in the Thema ²  case where he said:

“A party either has documents in its possession or has the legal entitlement to require possession. In those circumstances the document must be discovered.”

Typically, where a party to litigation seeks documents from a non-party, this is by way of an application for non-party discovery. Here, the defendant argued that this was the route which the plaintiff should have taken, and that the plaintiff was, in effect, attempting to bypass the judicial process by seeking to compel the defendant to exercise his rights under data protection legislation.

While the court did accept the defendant’s argument that the fundamental aim of this legislation is to protect an individual’s right to privacy, Baker J held that ultimately the question for the court should be determined according to the established principles on discovery, namely were the documents relevant and necessary and was the request proportionate and not unduly oppressive? If so, she held that documents which could be obtained by way of data subject access request were within the defendant’s power, and were therefore discoverable.

Disclosing party must take “reasonable steps”

While the discovery order sought was granted, Baker J did note that requests of this nature could not be used as a “tool of oppression”, and recognised that there may be cases where non-party discovery is more appropriate. She also acknowledged that the non-party here might refuse the defendant’s data subject access request in the first instance, which could potentially necessitate a challenge before the Data Protection Commissioner or the courts to obtain the documents. Therefore, she directed the defendant to make discovery only of such documents as were “reasonably available” to him and to take “reasonable steps” to procure documents by such means. Baker J also granted the defendant liberty to apply to court to seek further direction or clarification if he was unable to obtain the documents after taking reasonable steps.

Comment

Following Baker J’s judgment, it now appears that a party has a prima facie entitlement to request an individual counter-party to make a data subject access request in respect of relevant and necessary documents, in appropriate cases. Such requests are likely to be of use where the discovery sought involves a significant amount of personal data (such as in employment disputes), so that such requests will not be appropriate in all cases. Additionally, in practical terms, material provided under data subject access requests is generally much more heavily redacted than documents provided on discovery so, while such requests are potentially very useful, there may be limits to the scope of the material ultimately provided.

Nonetheless, this case is significant for parties in litigation against an individual counter-party, particularly in light of the typically high costs of seeking non-party discovery. The Rules of the Superior Courts provide that the costs of non-party discovery are to be borne by the party seeking that discovery. As noted in Baker J’s judgment, this process is frequently “cumbersome and costly”.  However, the small fee for a data subject access request is borne by the individual data subject. The court therefore cautioned against a “rush to seek non-party discovery” when there may be an alternative “straightforward, less costly process” available.