Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Harrison v Cameron and ACL [2024] EWHC 1377 (KB) concerned a Claimant (C) who threatened the First Defendant (D1) in telephone calls which, unbeknownst to him, were recorded. D1 (the Director of D2) shared these with employees, friends, and family. C sought their identities in two subject access requests (SARs). The Defendants refused, relying on the ‘rights of others’ exemption in Article15(4) and schedule 2, paragraph 16 of the Data Protection Act 2018 (see B v General Medical Council [2019] 1 W.L.R. 4044). The High Court dismissed C’s claim for an order requiring compliance with the SARs and offered useful guidance on several key principles.
The Court did not accept that the sharing to family and friends fell under the ‘personal/household’ exemption, holding that D1 made the recordings as Director of D2 and had shared personal data held by D2 in respect of its business. However, the claim was dismissed against D1 because he acted as an agent for D2, who remained the data controller. D1 did not become a data controller because he decided the means and purposes for which the personal data was processed, nor was he acting in an unauthorised way (Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd [2018] Q.B. 256 followed; Oakley Smith v Information Officer [2014] Ch. 426 considered).
As to D2, in line with the CJEU’s decision in the ‘Austrian Post’ case (RW v Österreichische Post AG, C-154/21), the starting point was that D2 should disclose the names. However, Steyn J held that it was reasonable to invoke the ‘rights of others’ exemption where the recipients had refused consent due to C’s menacing behaviour and threats of hostile litigation and C had offered no reassurance by way of undertakings. While there is no basis for a blanket refusal to provide third-party names, the data controller is the primary decision maker and enjoys a wide margin of discretion in deciding what is reasonable.
Further reading: Harrison v Cameron and ACL [2024] EWHC 1377 (KB)
https://www.bailii.org/ew/cases/EWHC/KB/2024/1377.html
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
