A SAR is where an individual asks a company or organisation for a copy of all of their “personal data” (in short, information) held about them. They may be seeking premature disclosure of documents or they may be hoping to find the “smoking gun” that they believe will support their claim. If you receive a SAR and there is anticipated litigation or ongoing litigation you should be aware of the following:
- SARs are generally motive blind - you cannot ignore a SAR on the basis that there is already anticipated litigation/ongoing litigation. To ignore could give the individual a further (and possibly good) claim under the data protection legislation which could be added to the wider claim. This may also make any settlement discussions more difficult and protracted.
- Timeframe - requests must be complied without undue delay and at the latest within one month of receipt of the request (this can be extended by a further two months in certain circumstances). The effect is that the litigant is likely to get the SAR response before disclosure in the litigation takes place. However, a requestor is only entitled to receive their own personal data within documents, rather than documents in their entirety.
- Disclosure obligations in the litigation - clearly it is unhelpful to disclose documents as part of disclosure that were not provided in response to the SAR. For this reason, when considering your SAR response you should also consider how it would appear if a certain document was not provided as part of the SAR and is later formally disclosed in the litigation. You should document carefully any decision taken not to disclose an important document so that you have a record of your decision-making process that can be relied on if that decision is later challenged.