Data Protection & Subject Access – A Changing Landscape

Could a UK law firm be compelled to provide personal data which it held by reason of it having advised the trustee of a Bahamian Trust? The Court of Appeal of England and Wales has held – quite emphatically – that the answer is "yes" in Dawson - Damer & Ors v Taylor Wessing LLP [2017] EWCA Civ 74.

The Data Protection Act 1998 (the "DPA") (which transposes the EU Data Protection Directive (95/46/EC) into UK law) contains a right (known as subject access) for data subjects to be able to access their own personal data where it is held and processed by a data controller (section 7 of the DPA).

This right has a certain degree of tension with trust law in many jurisdictions, which do not impose an absolute duty on trustees to disclose information to beneficiaries. In particular, trustees are normally entitled to withhold the reasons for the decisions they have made.