1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar

Schrems v. Irish Data Protection Commissioner: some further thoughts

As the dust begins to settle after the headline-grabbing Advocate General opinion in the Schrems v. Irish Data Protection Commissioner it may be worth considering some of the other potential implications arising from that opinion.

Of course, the AG opinion is not the final word on this matter. That will rest with the judgement of the Court of Justice of the European Union (CJEU). And the CJEU is not bound to follow this opinion. So there may well be life left in Safe Harbor (or Safe Harbor 2.0) yet. But if the CJEU follows suit, what else could this mean? (more…)

Schrems v. Irish Data Protection Commissioner: some further thoughts

Subject Access Request risk: limits in sight?

A recent High Court case took a very robust stance on the issue of DSARs (Data Subject Access Requests) being used to fuel litigation.

An individual can make a DSAR to request access to any of his/her personal information. In Dawson-Damer v Taylor Wessing (2015), the Court refused to order compliance with a DSAR against the law firm. The real purpose of the request was to obtain access to documents and information to assist with the applicants’ ongoing litigation. “Context is everything”, said Counsel for Taylor Wessing. There was no suggestion that the applicants wanted to use the DSAR to check the accuracy of the personal data held about them. The Judge was of the opinion that the DSAR would not have been made had it not been for the legal proceedings. This, in light of previous case law (Durant v FSA), was clearly not a proper purpose, he said.

Of course, this doesn’t mean that the ICO takes this view (we know they don’t!). And individuals are still  free to complain to the ICO, as well as to the Court, for breaches of DSAR provisions. However, it will be interesting to see if in due course the ICO adjusts its approach. That being said, the Judge himself indicated that the Court of Appeal, where the case is going next, may take a different viewpoint. Watch this space!

Subject Access Request risk: limits in sight?