This Week In Data/Cyber/Tech: A Significant English Court Judgment On The Scope Of Data Subject Access Requests

There's rarely a quiet week in data protection — and this one was no exception.

Besides the publication of the election manifestos by the UK's main political parties, a good deal of my time has been spent speaking with clients about a judgment issued last Friday by the High Court that will have big implications for the information that organisations have to provide in response to data subject access requests made under the UK GDPR. (The judgment also discusses the important question of the extent to which the purpose/motive of a DSAR can be factored into a controller's response, which I will write about separately.)

*****

Harrison v Cameron clarifies that the reference in Article 15(1)(c) of the UK GDPR to the controller providing an individual with information about "the recipients or categories of recipient to whom the personal have been or will be disclosed" is a choice for the requester — i.e., not the controller — to make. Although this has been the