Companies and other business organisations are increasingly coming under attack for the documents and information they hold. Litigants are no longer restricted to formal litigation disclosure as a means of obtaining documents from their opposition. Indeed, since the introduction of the CPR in 1999, pre-action disclosure requests have become a relatively common tactic used to obtain potentially helpful material before litigation has even commenced. In addition, there have recently been other significant shifts in the disclosure landscape. The Data Protection Act 1998 ("DPA") has given individuals the right to challenge organisations about the information they are processing about them and even to request copies. Most recently, the Freedom of Information Act 2000 ("FOIA") and the Environmental Information Regulations ("EIRs") 2004 which have come into force in the last few months have given individuals the "right to know" what information public authorities hold and consequently request copies of that information.
It is easy to see the potential for litigants and would-be litigants to use these various methods tactically to obtain material and put pressure on their intended opposition.
Historically, the significant route for parties to attack each other for documents and information was via the litigation disclosure process. Disclosure remains a key stage in litigation as it not only enables a party to evaluate the merits of its case, but also the strengths and weaknesses of its opponent's case. Broadly, by this process each party to litigation is required to disclose documents on which it relies, which adversely affect its case or another party's case and/ or which support another party's case. The disclosure obligation extends to documents that are or have been in a party's control, of which a party has, or has had possession or a right to possession or a right to inspect or take copies. "Document" is not limited to paper documents and will include anything in which information of any description is recorded including computer databases, electronic mail, file servers, tape recordings, photographs etc.
If you are party to litigation there is, broadly speaking, no escape from your disclosure obligations. Importantly however, and unlike disclosure under the DPA, FOIA or EIRs, a disclosing party is only required to make a "reasonable" search for documents. The "reasonableness" test is based on factors such as the number of documents involved, the nature and complexity of the claim, the difficulty of the search and the significance of any document likely to be located. A key element in deciding the reasonableness of a search is the concept of proportionality. This means that it is open to a party not to search for a particular document on the basis that it would be too time consuming or expensive.
Litigation disclosure was extended by pre-action disclosure which was introduced in the CPR. It is, as its name suggests, disclosure prior to proceedings being issued, given by an individual or organisation likely to be a party to future litigation. It will only be ordered where such disclosure is necessary to dispose fairly of anticipated proceedings, assist in the resolution of the dispute without proceedings or save costs. Pre-action disclosure will not be permitted to be used by parties as a fishing expedition and a party seeking pre-action disclosure must specify the documents or classes of document which he seeks. The concepts of reasonableness and proportionality will likewise apply to any pre-action requests.
Distinct from these CPR disclosure processes, litigants or would be litigants can now obtain documents and information under the DPA, FOIA and EIRs regimes.
Disclosure under DPA
The DPA consolidated a number of rights previously held by individuals as well as significantly increasing many of them. Individuals may now use subject access requests effectively to gain disclosure of documents and information from organisations. An individual can ask any organisation to tell them whether it is processing information about them, and if it is, the individual is entitled to ask why and what for. Of importance to many individuals will be the right to then request a copy of that information. Organisations should be alert to receiving subject access requests as there is no requirement under the DPA that they should be in a particular format or even mention the DPA as such. Despite this, the time limit for compliance with a request is tight, 40 days being the general rule. During this time frame the organisation must:-
- search for and collate the requested information;
- consider whether the requested information comes within the meaning of "personal data";
- seek the consent of third parties whose information is included in the requested information, if appropriate;
- consider whether any of the exemptions in the DPA apply; and
- provide the requested information.
Subject access searches can be onerous and time consuming, there is no concept of reasonableness or proportionality here. Organisations often have to search all their databases, including current, archived and back-up files. Plainly such searches may produce copious amounts of data.
What if an organisation fails to comply? At first sight an organisation may think that non-compliance is affordable. The tangible risks include being reported to the Information Commissioner, a possible consequent investigation and fine, or a claim by the requesting individual for damages suffered as a result of the failure to comply. More persuasive however is likely to be the possibility of bad publicity and damage to reputation which surrounds an organisation's breach of privacy laws.
And now FOIA and EIRs
A further potential route to disclosure has been opened with the enactment of the FOIA and EIRs, although this will only apply primarily to information held by or on behalf of public sector bodies. Broadly, the FOIA entitles individuals anywhere in the world to request that public sector bodies provide them with any recorded information which is held by them or on their behalf (other than information to which they would be entitled under the DPA). Again, the FOIA imposes a tight timescale (in this case, 20 working days) within which the organisation must collate relevant information, consider the application of any exemptions, consult any affected third parties (as appropriate) and comply with the request. As with the DPA there is no concept of proportionality or reasonableness. The EIRs have introduced a regime very similar to the FOIA which relates specifically to environmental information. Any requests made to a public sector body (or bodies with certain public functions, such as the utilities) for environmental information will not be handled under the FOIA but under the EIRs instead.
One of the obvious concerns for organisations prompted by the introduction of these regimes is the cost of dealing with requests and the time taken to locate the information and then assess whether or not it should be released. It is no surprise that the vast majority of requests are made by disgruntled individuals (such as employees or customers) and that certain pressure groups and politically motivated organisations encourage individuals to submit requests which aim to cause as much impact as possible.
An additional concern for organisations is that they may be required to disclose potentially damaging information under the DPA, FOIA or EIRs which, in contrast to CPR disclosure, the receiving party is not required to keep confidential. Documents disclosed in the course of CPR disclosure will remain confidential to the parties and no subsequent use of a document will generally be permitted unless and until that document has been read to or by the court. This is not so with disclosure under the DPA, FOIA or EIRs.
If litigation is on foot between the individual and the organisation and the disclosure process has commenced, there may well be a large overlap between litigation disclosure and any "disclosure" under these regimes. Indeed, it is easy to see the scope for criticism of an organisation if for example, a subject access request search under the DPA produced material not previously disclosed in litigation. If litigation is not underway, individuals could potentially use the subject access procedure to request documents relevant to the claim that he/ she may be thinking about bringing or defending. Such a DPA request could therefore potentially assist in the formulation of an individual's case. Interestingly, however, in the infamous case of Durant v. Financial Services Authority (Disclosure of Information) [2003] EWCA Civ 1746 the court expressed disapproval of use of the DPA "to obtain discovery of documents that may assist [an individual] in litigation or complaints against third parties", despite the fact that motive is irrelevant under the DPA.
An exception which is common to both CPR disclosure and requests under the DPA, FOIA and EIRs is of course legal professional privilege. This means that organisations are not required, and indeed should not, hand over material that was either produced with the dominant purpose of being used in current or potential litigation, or with a view to obtaining legal advice from a solicitor or barrister. In addition, under the DPA if organisations are in negotiations with the individual at the time when the subject access request is made, they are not required to reveal documents relating to or recording those negotiations.
Practical tips
- Ensure contracts with suppliers require their prompt assistance and provision of information needed to comply with requests under the DPA, FOIA and EIRs;
- Ensure good records management so you know what information you have, and where and for how long you retain it;
- Extra time for complying with requests for information can be won by requiring payment of a fee (there are different rules for fees under the DPA, FOIA and EIRs) and, where requests are drafted broadly, requesting detail necessary to identify and locate requested information. The time limit for responding will only start once both the fee and information necessary to locate the data are received.
- Very few manual records will be caught by the DPA unless highly structured by reference to individuals. Organisations may consider filing manual information in such a way that it falls outside the Act.
- If compliance with the time limits under the DPA, FOIA or EIRs looks particularly difficult, be upfront with the individual – give them what you can with the time limit and explain why it is taking longer to provide the rest (assuming you have a legitimate reason, such as waiting for third parties to grant or refuse consent).
As individuals become more familiar with their rights under these different regimes, organisations can expect increasingly to come under attack for requests for documents and information. Organisations should ensure that their staff are properly trained and fully aware of the potentially wide reaching effect of these regimes. Staff should understand that flippant, but potentially damaging remarks made in writing may become disclosable. An organisation's best defence is to be prepared and to deal with any requests promptly and efficiently, complying with obligations whilst being aware of the limitations on such requests.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
