Disclosure and data protection
Increasing awareness by individuals of their data protection rights, such as your own right to access your personal data, has led to greater recognition that the litigation process carries significant risk where disclosure involves personal data. UK GDPR permits the processing of personal data where necessary to comply with a legal obligation. Additional legal bases for processing are available where special category data is involved due to its sensitive or personal nature. Although such processing is allowed, an organisation is still obliged to comply with data protection principles when disclosing personal data for use as evidence in legal proceedings.
The need for evidence v. protection of data subjects
In the recent case of Norra Stockholm Bygg AB v Per Nycander AB, joined parties: Entral AB (Case C‑268/21) EU:C:2022:755, the Court of Justice of the European Union was asked to consider a court order for disclosure of a staff register for use as evidence in civil proceedings. This would entail the processing of personal data.
The register had been collected to record the presence of staff on a construction site. A dispute arose about compensation for the work carried out. Disclosure of the register was requested to evidence the time spent on the work. The Claimant refused to disclose the register, saying that the data had been collected for another purpose and that allowing the Defendant access would unduly infringe the data subjects' interests.
The Advocate General's opinion makes it clear that the rules applying to court proceedings must be applied in conformity with the GDPR. Although procedural rules requiring disclosure of evidence provide a lawful basis for processing personal data, this on its own is not enough to conform with GDPR. The court must balance the interests of the litigants who wish to obtain evidence, against the interests of the data subjects whose personal data is being processed. To do this any disclosure must be proportionate. A data subject will usually have an interest in restricting processing so a court ordering disclosure must justify why this interest should be interfered with. The principle of data minimisation – only processing the minimum personal data necessary to achieve the intended aim – was highlighted.
Simply put, parties to litigation and advisers must ensure their disclosure processes include the redaction of irrelevant personal data before disclosure. Of course, balance is required, and organisations should be ready to provide an explanation for any redactions made. Overzealous redaction may result in challenge to the adequacy of any disclosure and potentially increase litigation costs.
On the other hand, disclosure of extraneous material may result in complaints by data subjects, either to the disclosing organisation itself, or to the Information Commissioner. Data subjects may also seek compensation via the courts for any distress caused by disclosure. All claims, whether valid or unfounded, take up significant amounts of time and resources, so it is important that care is taken during disclosure.
Data protection specialists can be consulted throughout the disclosure process and will be able to advise on options where the balance is difficult to achieve.
Our content explained
Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.