Ittihadieh v 5-11 Cheyne Gardens RTM Company Ltd& Ors

Factual and Procedural Background

This opinion concerns two appeals relating to the Data Protection Act 1998 ("the DPA"). The appeals raise several issues regarding the interpretation and application of the DPA, particularly around the scope of "personal data," the identity of a "data controller," the nature of a subject access request ("SAR"), and the court's discretion in ordering compliance with such requests.

The first appeal involves the Plaintiff, a long-term resident and leaseholder in a residential building managed by a right-to-manage company ("the RTM company"). The Plaintiff suspected that the RTM company and some of its directors were improperly processing his personal data and made a SAR on 3 November 2014 via solicitors. The RTM company and associated respondents resisted full disclosure, citing exemptions and procedural objections. The Plaintiff commenced proceedings seeking an injunction and damages, including an order compelling compliance with the SAR. The trial judge refused to order further disclosure, finding that the SAR was directed only to the RTM company, that other respondents were not data controllers, and that the duty to comply did not require disproportionate effort. The Plaintiff appealed.

The second appeal concerns the Appellant, a former student and employee of The University, who made two SARs relating to personal data held by The University in the context of ongoing and past litigation concerning alleged discrimination and victimisation. The University initially refused to comply fully with the SARs, citing improper use of the DPA as a disclosure proxy, legal professional privilege, and other exemptions. Following litigation and a court order directing further searches, The University conducted extensive searches and disclosed some material. The trial judge found that much of the withheld material was not personal data or was exempt and exercised discretion not to order further disclosure. The Appellant and The University cross-appealed.

The Information Commissioner intervened in both appeals due to the wider significance of the legal issues raised.

Legal Issues Presented

1. The scope of the definition of "personal data" under section 1 of the DPA.
2. Who qualifies as a "data controller" under the DPA.
3. What constitutes a valid subject access request ("SAR").
4. Whether the duty to comply with a SAR requires only a reasonable and proportionate search.
5. The extent of the exemption for data processed solely for personal, family, or household affairs.
6. The scope of the court's discretion under section 7(9) of the DPA to order or refuse compliance with a SAR.

Arguments of the Parties

Appellant (Plaintiff in first appeal) Arguments

• The SAR was addressed not only to the RTM company but also to individual directors and the company secretary personally, who should be considered data controllers.
• The refusal to disclose the so-called "Alireza file" was improper and should be reviewed.
• The judge applied an unduly narrow test in determining the scope of the SAR and the identity of data controllers.

Respondents (RTM Company and others) Arguments

• The SAR was properly directed only to the RTM company as the data controller, not to individual directors or the company secretary.
• Any personal data processed by individuals in a personal capacity were exempt under the personal and household exemption.
• Compliance with the SAR had been reasonable and proportionate, and further disclosure would be disproportionate and impose undue burdens.

Appellant (Former Student of The University) Arguments

• The SARs were wide-ranging but sought personal data to which the Appellant was entitled under the DPA.
• The University failed to conduct adequate searches for personal data in response to the SARs.
• The University improperly relied on the collateral purpose of litigation and legal professional privilege to withhold information.
• The judge erred in his narrow interpretation of "personal data" and in exercising discretion to refuse further disclosure.

Respondent (The University) Arguments

• The SARs were being used improperly as a proxy for disclosure in litigation, contrary to established authority.
• Much of the requested information was not personal data or was exempt due to legal professional privilege.
• The searches conducted were reasonable and proportionate, including reliance on individuals to search their own email accounts.
• The judge correctly exercised discretion to refuse further disclosure as it would serve no useful purpose and was disproportionate.

Information Commissioner

• Intervened due to the wider significance of the legal issues concerning the interpretation and application of the DPA.

Table of Precedents Cited

Precedent	Rule or Principle Cited For	Application by the Court
Durant v Financial Services Authority [2003] EWCA Civ 1746	Scope of "personal data" and limits on use of SARs as disclosure proxies.	Clarified that "personal data" requires relevance to the individual beyond mere mention; collateral purpose does not invalidate SAR.
Edem v The Information Commissioner [2014] EWCA Civ 92	Names and job-related information constitute personal data; distinction from Durant explained.	Supported a broad interpretation of personal data where information is obviously about an individual.
Dawson-Damer v Taylor Wessing [2017] EWCA Civ 74	Exercise of court's discretion under section 7(9) and limits on obligation to search for personal data.	Confirmed that the obligation to search is for reasonable and proportionate efforts, excluding privileged material.
Marleasing SA v La Comercial Internacional de Alimentación SA [1992] 1 CMLR 305	Interpretation of national law in conformity with EU Directive 95/46/EC.	Established that the DPA must be interpreted consistently with the Directive.
College van burgemeester en wethouders van Rotterdam v Rijkeboer [2009] 3 CMLR 28	Purpose of Directive to protect privacy; right of access to personal data.	Emphasised privacy as fundamental and right of access to data for accuracy and lawful processing.
YS v Minister voor Immigratie [2015] 1 WLR 609	Definition of personal data; exclusion of legal analysis from personal data.	Clarified limits of personal data, excluding legal analysis that does not serve privacy protection.
Johnson v Medical Defence Union [2007] EWCA Civ 282	Privacy as central mission of the Directive.	Confirmed privacy protection as the primary purpose of the Directive and DPA.
Iesini v Westrip Holdings Ltd [2009] EWHC 2526 (Ch)	Collateral purpose does not invalidate SAR if it also serves Directive's purpose.	Supported the principle that SARs made in connection with litigation are not automatically invalid.
Ezsias v Welsh Ministers [2007] EWHC B15 (QB)	Reasonable and proportionate search obligation in response to SAR.	Confirmed that data controllers must take reasonable steps to identify and disclose relevant data.
Zaw Lin v Commissioner of Police of the Metropolis [2015] EWHC 2484 (QB)	Exercise of discretion under section 7(9) and relevance of SAR's value.	Outlined factors relevant to court discretion, including proportionality and value of data to data subject.
Roberts v Nottinghamshire Healthcare NHS Trust [2008] EWHC 1934 (QB)	Exercise of discretion under section 7(9).	Supported a cautious and purposive approach to discretion in enforcing SAR compliance.
Jameel v Dow Jones & Co Inc [2005] EWCA Civ 75	Costs proportionality and court's role in managing litigation resources.	Allowed courts to consider proportionality in costs orders, reflecting conduct and litigation value.

Court's Reasoning and Analysis

The court began by affirming that the DPA must be interpreted consistently with EU Directive 95/46/EC, which prioritises the protection of individuals' fundamental rights, notably privacy.

On the definition of "personal data," the court identified two limbs: (i) the data must "relate to" a living individual, and (ii) the individual must be identifiable from the data. The court relied on EU and domestic case law, particularly Durant and Edem, to clarify that mere mention of an individual in a document does not necessarily constitute personal data; rather, the data must be biographical or have the individual as its focus.

Regarding the identity of a "data controller," the court held that a data controller is a person or entity who determines the purposes and means of processing personal data. Individuals processing data as agents of a company are not data controllers for such data, but may be if processing on their own behalf. The court rejected the argument that the SAR to the RTM company was also a SAR to individual directors and the company secretary, concluding that the SAR was directed solely to the RTM company as the data controller.

The court analysed the scope of the personal and household exemption, concluding that activities related to managing a private block of flats, including processing neighbours' personal data for management purposes, fall within the exemption. This balances the privacy rights of both data subjects and data controllers and avoids criminalising ordinary activities.

On the form and validity of a SAR, the court held that a SAR must be a written request that calls upon the recipient to comply with the statutory duty as data controller. The payment of a fee is not a pre-condition to making a valid SAR; rather, the data controller may require a fee after receiving the request.

The court emphasised the purpose of a SAR as enabling the data subject to verify the accuracy and lawful processing of personal data, not as a general tool for obtaining documents. It distinguished between the obligation to provide information constituting personal data and the absence of an obligation to provide documents themselves.

Regarding the duty to search, the court held that while an obligation to carry out a reasonable and proportionate search is implied, it does not require exhaustive or disproportionate efforts. Searches must exclude material covered by legal professional privilege and be guided by proportionality principles.

The court rejected the notion that the court's discretion under section 7(9) of the DPA is "general and untrammelled," instead holding that discretion must be exercised purposively, balancing the breach of duty by the data controller against the interests of all parties, including proportionality and potential abuse of process.

Applying these principles to the facts, the court found that the SAR to the RTM company was valid but did not extend to individual directors or the company secretary personally. The refusal to order further disclosure was justified on grounds of proportionality and the personal and household exemption. The court found no procedural unfairness in the trial judge's handling of the "Alireza file."

In the second appeal, the court found that The University’s initial refusal based on collateral purpose was incorrect, but that the University’s limited searches for certain categories of data were not justified. However, the court accepted that the judge's exercise of discretion to refuse further disclosure was within the permissible range, given the limited personal data involved, the proportionality considerations, and the Appellant's conduct.

The court upheld the costs order, holding that the judge was entitled to consider the Appellant's motive and conduct in the litigation when making a costs deduction.

Holding and Implications

The court dismissed both appeals.

The court held that the Plaintiff’s SAR was properly directed only to the RTM company and not to individual directors or the company secretary, and that the trial judge did not err in refusing further disclosure or in exercising discretion under section 7(9) of the DPA. The transfer of the remaining claim to the county court was appropriate.

Regarding the Appellant’s appeal against The University, the court found no error in the trial judge’s refusal to order further disclosure, concluding that the judge’s exercise of discretion was within the permissible range. The court also dismissed The University’s cross-appeal against the declaration and costs order.

The decision clarifies key aspects of the DPA, including the scope of "personal data," the identity of data controllers, the nature and validity of SARs, the limits of the duty to search, and the exercise of judicial discretion under section 7(9). While no new precedent was established, the judgment provides authoritative guidance on these issues, balancing data subject rights with proportionality and privacy considerations.