This is another subject access case where the courts have refused to support a claimant who tried to use the Data Protection Act 1998 as a means of pursuing other proceedings. In Ezsias, Judge Hickinbottom sitting as a Judge of the High Court, closely followed Durant v Financial Services Authority  EWCA Civ 1746, concluding that information held about complaints that Mr Ezsias had made did not amount to his personal data. The case is interesting in that Hickinbottom J also suggested that a data controller is only obliged to carry out “reasonable and proportionate” steps to identify and disclose personal data. Although this comment will be welcomed by data controllers, it may prove controversial.
Mr Ezsias had been a consultant surgeon employed by the North Glamorgan NHS Trust between July 1998 and February 2005 when he was summarily dismissed. Mr Ezsias brought Tribunal proceedings against his former employer and also alleged that he was dismissed because he was a whistle-blower. Whilst the employment case continued, Mr Ezsias wrote to the National Assembly of Wales to raise concerns about the way in which the NHS Trust was dealing with his case. He entered into correspondence with a number of individuals on numerous occasions creating a large volume of documents. Between 2003 to 2006 he made a number of subject access requests. The National Assembly released 1,000 pages to Mr Ezsias. It supplied a further 100 pages of redacted material, but withheld a further 1,400 pages. Mr Ezsias sought disclosure of these additional documents and claimed that the Assembly may hold yet further information about him which it was obliged to disclose as it had failed to carry out adequate searches. Mr Ezsias sought damages as a result of the Assembly’s failure to comply with his access request.
Hickinbottom J noted that the Assembly had failed to comply with the Act in that it had failed to provide Mr Ezsias’s data to him within the 40 day period allowed by the Act. However, on all other points, Hickinbottom J concluded that the Assembly had complied with its obligations under the Act.
Data not documents
Hickinbottom followed Durant (paragraph 27) in noting that the Act gives individuals rights of access to data, not to access all documents in which there may be a passing reference to them:
“There is a fundamental distinction between the right of access to data in the hands of another person for the purposes of protecting privacy, and the right to disclosure of documents. Mr Ezsias actually wishes to have disclosure of documents to assist his employment claim: and he labours under the misunderstanding that the right of access to data is necessarily co-terminus with the right to disclosure of documents. It is not.” (para 53).
Complaints files are unlikely to include personal data
The information held by the National Assembly were records of Mr Ezsias’s complaints and the Assembly’s subsequent investigation into these complaints. Hickinbottom J noted that, indeed, the documents related to second, third or even fourth generation complaints. Hickinbottom J followed Durant in noting that information of this nature would “relate to” the investigation of a complaint rather than the complainant him or herself. The Act would only be engaged:
“if and insofar as, in the course of investigating the complaint, any opinion had been expressed about Mr Ezsias personally as opposed to his complaint”. (para 66).
Searches need only be proportionate
Hickinbottom states that:
“Under the 1998 Act, upon receipt of a request for data, a data controller must take reasonable and proportionate steps to identify and disclose the data he is about to disclose.” (para 93).
He also references Section 8(2) which provides that there is no obligation to provide an individual with a copy of the information held in permanent form if this would involve “disproportionate effort”. In this case, the Judge considered that the Authority had taken reasonable and proportionate steps to identify the material.
The Act does not state that a search need only be “reasonable and proportionate” and the exemption in Section 8(2) is not a general exemption from subject access. Rather, it is only an exemption from the obligation to provide information in permanent form. The Information Commissioner certainly takes the view that the “disproportionate effort” exemption is limited in this way. So, for example, in the Supplementary Guidance to the Employment Practices Code, the Commissioner notes that:
“The employer must provide a copy of the subject access information in permanent form unless providing it in that form would involve disproportionate effort. Even if disproportionate effort would be involved in providing a copy, the employer must still give access to the record, perhaps by allowing the worker to inspect it. … Given the significance of employment records, an employer should only rely on the disproportionate effort exemption when providing a copy in exceptional circumstances.”
Hickinbottom J refers to paragraph 45 of Auld LJ’s decision Durant in considering what is “reasonable and proportionate”. However, these sections of the Durant judgment relate to the definition of a “relevant filing system” and the need for this to be indexed in a relatively sophisticated way so that searches of paper records are reasonable. Durant does not go so far as stating that there is a general exemption from subject access where searching would involve the data controller in disproportionate effort.
The Court’s discretion
Hickinbottom J also makes clear that the court has a discretion as to whether or not to make an order in relation to subject access and the Judge felt this to be clearly inappropriate in this case. The Judge laid a particular emphasis on the fact that Mr Ezsias’s clear aim was to further his employment claim. Given this, it would be inappropriate for the Court to order disclosure of documents under the Data Protection Act: “The proper form for deciding what documents ought to be disclosed in relation to the employment claim is the Employment Tribunal itself”. (para 102).Hickinbottom J also notes that the sheer volume of correspondence generated by Mr Ezsias, as a result of the way in which he pursued his complaint, made the Assembly’s task under the Act extremely difficult and this is a factor that the Judge would take into account in deciding whether or not to order further searches or disclosure. (para 101). This is a comment which data controllers may also find useful when dealing with serial complainants.
*  All ER (D) 65 (Dec)