The Dubai Financial Services Authority v (1) The Commissioner Of Data Protection (2) Anna Waterhouse [2018] DIFC CFI 051 and CFI 085

Claim No. CFI 051/2018 and CFI 085/2018

THE DUBAI INTERNATIONAL FINANCIAL CENTRE COURTS

THE COURT OF FIRST INSTANCE
BEFORE JUSTICE SIR RICHARD FIELD
IN THE MATTER OF AN APPEAL UNDER ARTICLE 37(1) OF DIFC LAW No. 1 of 2007 (THE DATA PROTECTION LAW) AND JUDICIAL REVIEW UNDER PART 42 OF THE COURT RULES

BETWEEN

THE DUBAI FINANCIAL SERVICES AUTHORITY

Appellant

and

THE COMMISSIONER OF DATA PROTECTION

Respondent

ANNA WATERHOUSE

Interested Party

---

REPLACEMENT JUDGMENT

---

Introduction

1. There are before the Court two sets of related proceedings. First, there is an appeal by the Dubai Financial Services Authority (the “DFSA”) under Article 37 (1) of the Data Protection Law (Law No. 1 of 2007) (the “DPL”) from the decision of the Commissioner of Data Protection (the “Commissioner”) dated 20 June 2018 that the DFSA contravened Article 17 of the DPL by refusing to comply with a Subject Access Request (the “SAR”) served on it by the Interested Party (“Ms Waterhouse”). Second, there is an application by the DFSA for judicial review of the direction the Director made in Ms Waterhouse’s case as to the steps he ordered the DFSA to take in response to Ms Waterhouse’s SAR.

The relevant background

2. The DFSA is established by Article 7 of the Regulatory Law and by Article 8 (3) thereof has as one of its major functions the prevention, detection and restraint through appropriate means including the imposition of sanctions of conduct that causes or may cause damage to the reputation of the DIFC or financial services industry in the DIFC. Under Articles 78 and 90 it has respectively the power to conduct investigations and impose sanctions and make directions.

3. Ms Waterhouse was Head of Legal & Compliance Middle East and North Africa for Deutsche Bank AG (“DB”) from 1 October 2007 to 5 March 2014. She was authorised by the DFSA to perform the Licensed Functions of Compliance Officer, Money Laundering Reporting Officer and Senior Manager. DB was a DFSA Authorised Firm.

4. In 2012 the DFSA began an investigation into DB and certain individuals connected to it. In February 2014, this investigation was expanded to include suspected breaches dating back to 2011 of DFSA administered legislation and certain DB employees, including Ms Waterhouse.

5. In October 2014, the DFSA’s enforcement arm produced a report setting out its investigatory findings so far and pursuant to a Decision Notice dated 29 March 2015 the DFSA took action against DB for contraventions of DFSA administered legislation and breaches of DFSA Rules.

6. On or about 29 April 2015, Ms Waterhouse was given a copy of the report setting out the findings of the investigation together with a copy of the materials referenced in the report. These materials comprised six lever arch files of documents ordered chronologically covering relevant events from 2011 to 2013 and copies of transcripts of all interviews undertaken by the DFSA referred to in the report. The chronological documents in the six files were compiled from a much larger number of documents that were gathered during the investigation. In total, there were approximately 300 lever arch files of documents and information produced to the DFSA during the course of the investigation.

7. On 10 January 2016, the DFSA’s Decision Making Committee (the “DMC”) served on Ms Waterhouse a notice setting out the decision it proposed to make in her case including its proposed findings of fact and sanction. Ms Waterhouse was also given a copy of the materials that the DMC had considered. Pursuant to her right to do so, over the ensuing 15 months Ms Waterhouse made a series of representations designed to persuade the DMC not to issue a final decision to take enforcement action against her. In addition, at the request of Ms Waterhouse’s counsel, DFSA Enforcement provided further information up to the point at which it was felt that the information being sought was beyond the scope of the DFSA’s investigation.

8. On 22 June 2017, the DMC served on Ms Waterhouse a Decision Notice stating that for the breaches of DFSA administered legislation identified in paragraph 10 below it was going to impose a financial penalty of US$100,000 and to restrain her from performing any functions in connection with the provision of financial services in or from the DIFC. The Decision Notice referred to the materials the DMC had considered copies of which had already been disclosed to Ms Waterhouse.

9. The background to the DFSA’s Decision Notice was that DB and its employees within the Private Wealth Management (“PWM”) team serving the Middle East and Africa had breached regulatory requirements in providing the regulated financial services of Advising on Financial Products and Credit and Arranging Credit or Deals in Investments in a way which was undisclosed to the DFSA and which did not comply with the requirements set out in the DFSA Rulebook. Around 40% – 50% of the PWM employees’ emails had involved Advising and/or Arranging and the failure to comply with the DFSA Rulebook extended to approximately 583 PWM clients over the period 1 January 2011 to 30 June 2013.

10. The DFSA’s case against Ms Waterhouse was that she gave false or misleading information to the DFSA on several occasions, with knowledge that it was false or misleading or with recklessness as to whether or not that was the case and she had failed over a substantial period to correct false or misleading information provided by herself or others, and in consequence she had: (i) failed to act with integrity, contrary to GEN Rule 4.4.1, Principle 1, Integrity; (ii) failed to exercise due care and skill, contrary to GEN Rule 4.4.2, Principle 2; (iii) failed to deal with the DFSA in an open and co-operative way and failed to disclose appropriate information, contrary to GEN Rule 4.4.4, Principle 4, Relations with the DFSA; and (iv) had contravened Article 66 of the Regulatory Law which prohibits provision of information which is false, misleading or deceptive to the DFSA.

11. On 23 July 2017, Ms Waterhouse referred the DFSA Decision Notice to the Financial Markets Tribunal (the “FMT”), a body established under the DIFC Regulatory Law that hears and determines references to review decisions of the DFSA. When conducting such references, the FMT conducts a de novo full merits review of the DFSA decision and can take into account any relevant new evidence that comes to light after the DFSA’s original decision. In the ensuing FMT proceedings, Ms Waterhouse denied the factual allegations made against her and advanced the defence that the DFSA investigation was an abuse of process.

12. The FMT’s decision was issued on 12 August 2019. It dismissed the abuse of process defence and found that Ms Waterhouse had failed to be frank and candid with the regulator about serious regulatory issues and was therefore in breach of GEN Rules 4.4.1, 4.4.2 and 4.4.4 as alleged by the DFSA. There was no finding of dishonesty against Ms Waterhouse, rather one of recklessness. Publication of the decision was restrained by an order of this Court until 12 December 2019 which came after the hearing of the instant proceedings. A number of the details that are given in this paragraph and paragraphs 9 to 11 above are derived from the FMT’s decision.

13. By a letter dated 2 August 2017, Ms Waterhouse served the SAR under Article 17 DPL on the DFSA. Article 17 confers on a “Data Subject” the right, inter alia, to obtain from a “Data Controller” upon request: (a) confirmation whether or not “Personal Data” relating to him or her is being Processed and information at least as to the purposes of the Processing, the categories of Personal Data concerned, and the “Recipients” or categories of Recipients to whom the Personal Data are disclosed; (b) communication in an intelligible form of the Personal Data undergoing Processing and of any available information as to its source; and (c) as appropriate, the rectification, erasure or blocking of Personal Data the Processing of which does not comply with the provisions of the Law.

14. It is common ground that Ms Waterhouse was a Data Subject and the DFSA was a Data Controller.

15. In her letter of 2 August 2017, Ms Waterhouse requested in respect of the period 1 October 2011 to the “present date”:

She also stated that any deleted items should be restored and provided to her and requested that once personal data within the scope of the request had been identified she be provided with a hard or electronic copy of the information constituting personal data and (1) a description of the data; (2) an explanation of the purpose for which the data was processed; (3) identification of the source or sources of the data; and (4) identification of to whom the data had been sent or may be disclosed.

16. By letter dated 10 August 2017, the DFSA declined to provide the personal data sought by Ms Waterhouse¹ citing Article 39 (2) DPL which disapplies Articles 11-13 and 17 if the application of those Articles would be likely to prejudice the proper discharge by the entities therein mentioned, including the DFSA, of their powers and functions under any laws they administer. In declining to provide the personal data sought by Ms Waterhouse the DFSA stated that her request for disclosure of information directly concerned the exercise by the DFSA of its powers in relation to her conduct during her former role as Compliance Officer, Money Laundering Reporting Officer and Senior Manager of Deutsche Bank in the DIFC. Accordingly, if the DFSA was to provide the information requested this would prejudice the proper discharge of its regulatory powers and functions.

17. Due to a problem with the email address DFSAdataprotection@dfsa.ae, Ms Waterhouse only received the DFSA’s letter of 10 August 2017 on 24 September 2017.

18. On 14 November 2017, Ms Waterhouse lodged a complaint with the Commissioner citing the rejection of the SAR by the DFSA. As stated in paragraph 1 above, the Commissioner’s decision that the DFSA had contravened Article 17 DPL by refusing to comply with Ms Waterhouse’s SAR was issued on 20 June 2018.

19. It is common ground that the DFSA’s appeal to this Court against the Commissioner’s decision is in the nature of a de novo hearing. It is therefore unnecessary to rehearse the Commissioner’s reasons for his decision beyond the summary that follows below.

1 Save for the data she had provided in respect of her licensed functions.

20. At the time the Commissioner’s decision was issued on 20 June 2018, the FMT proceedings were well under way, there having by then been a CMC on 8 January 2018 and three days of hearings in the period 28 – 30 April 2018. The Commissioner held that the DFSA had failed to establish it would suffer real and substantial prejudice within Article 39(2) if it had to comply with the SAR. The prejudice relied on – diversion of time away from enforcement duties; the potential for creating the impression that the DFSA could be tied up with duties under the DPL and discouraging third parties to give full and frank disclosure — did not amount to real or actual prejudice because: (a) no details of prejudice were provided when the DFSA responded to the SAR; (b) the appearance was given that the DFSA prioritised its duties under the Regulatory Law over those it had under the DPL; and (c) discouragement of full and frank disclosure was not a problem because confidential information from third parties could be redacted. The DFSA had wrongly assumed that for the public good it should not be bogged down with the tedious details of dealing with SARs when it was trying to protect the public from wrongdoers. The specific interest inherent in Article 17 to serve a SAR outweighed the public interest relied on by the DFSA. With regard to the issue of proportionality that arose from the words “without excessive delay or expense” in Article 17, the cost, time and effort for the DFSA to disseminate the data requested was not a sufficient reason to do no search at all. Proportionality was only relevant to how far the search should go to provide relevant information. If there were any possibility (as was the case here) that the DFSA came to enforcement decisions during the DMC process based on misleading, partial or inaccurate data that may not have been brought to light by disclosure in the DMC or FMT proceedings, the requirement to respond properly to the SAR overrides the time, cost and effort that may be required on the part of the DFSA. This is because Ms Waterhouse faced serious lifelong and professional consequences as a consequence of negative enforcement findings against her. The DFSA should have designed its systems to search and produce information requested by data subjects. Further and in any event, the DFSA not having raised the question of proportionality when it responded to the SAR, it could not raise this issue now retrospectively.

21. The Commissioner directed that the DFSA did not have to disclose information disclosed in the DMC and FMT proceedings or deleted emails or search the physical hard drives of the devices of employees or deal with potential future disclosure to recipients or categories of recipients.

22. In regard to the DFSA’s contention that the information it held in Lever Arch Files did not constitute “Personal Data” because it was not held in a “Relevant Filing System,” the Commissioner held that if the DFSA wished to persist with this contention it should do so when responding to the SAR and in this regard should have regard to the ICO Guidance on what constitutes a relevant filing system and Recital 26 of the European Directive 95/46.

23. On 4 July 2018, the DFSA applied to the Commissioner under Article 33 (6) of the DPL, requesting him to review the direction he made in his decision and to review the 300 odd lever arch files of documents assembled during the DFSA’s investigation which included DB and certain individuals including Ms Waterhouse to form a view whether they constituted a “relevant filing system”.

24. On 8 October 2018, the Commissioner issued his decision on the DFSA’s review application declining to conduct the requested review. In the Commissioner’s opinion, the grounds for review were more suited for an appeal or judicial review proceedings and he noted the grounds for review advanced by the DFSA “had also been largely replicated in [the DFSA’s] Grounds of Appeal.”

The legal framework

25. The DPL was closely modelled on the UK Data Protection Act 1998 (the “DPA”) which was enacted to give effect to the European Directive 95/46 (the “European Directive”). The definitions of particular terms are set out in Schedule 1 of the DPL. The DPA was amended by ss. 69 – 72 and Schedule 6 of the UK Freedom of Information Act 2000, these provisions coming into force on 1 January 2015.

26. The DPA was replaced by the UK Data Protection Act 2018 which gave effect to the European General Data Protection Regulation.

27. The provisions contained in the DPL that are of particular relevance to these proceedings are:

28. It is necessary to set out Articles 17 and 39 (1) and (2) verbatim.

with the intention that it should form part of a Relevant Filing System”.

29. The sections in the unamended DPA that are of particular relevance are section 7 (1), (2), (8) and (9) and section 8 (2):

The relevant authorities

30. It was common ground that decisions of the courts of England and Wales on comparable provisions in the DPA to those in the DPL were of persuasive assistance in these proceedings but not binding authority. The following are the principal authorities relied on by the parties.

R (On the Application of Alan Lord) v The Secretary of State for the Home Department [2003] EWHC 2073 (Admin).

31. Here, a Category A prisoner (being the claimant) applied to the English High Court under section 7(9) of the DPA for an order that the Home Secretary be directed to provide him with copies of six Category A reports addressing the question whether he should be moved to a lower category of prisoner. The application was made in response to the Home Secretary having refused the claimant’s request under s.7(1) of the DPA to be supplied with these documents.

32. To the extent relevant to these proceedings, the wording of s. 7(1) of the DPA and the wording of Article 17 of the DPL are in substantially similar terms.

33. The key question to be decided⁴ on the s.7 (9) application was whether s. 7(1) was exempted from application under s. 29(1)⁵ of the DPA which provided in material part:

4 The Court considered whether other limitations on the applicant’s right under s. 7 (1) DPA applied but only its consideration of section 7 (4) is germane to the instant proceedings.
5 The exemption of the application of s.7 (1) DPA where its application would be likely to prejudice regulatory activity is provided for in s. 31 (1) and (2) of the DPA.

34. In paragraph 83 of the judgment, Munby J (the judge) referred to the following passage at [96] in the judgment of Lord Phillips MR in Campbell v MGN Ltd [2002] EWCA Civ 1373 at [96] where the Court of Appeal of England and Wales (“EWCA”) held that, where a data controller is responsible for the publication of hard copies that reproduce data that has previously been processed by means of equipment operating automatically, the publication forms part of the processing and fell within the scope of the DPA.

In interpreting the Act it is appropriate to look to the Directive for assistance. The Act should, if possible, be interpreted in a manner that is consistent with the Directive. Furthermore, because the Act has, in large measure, adopted the wording of the Directive, it is not appropriate to look for the precision in the use of language that is usually to be expected from the parliamentary draftsman. A purposive approach to making sense of the provisions is called for.

35. The judge held in [94] that the words “in any case” in s. 29(1) DPA are to be read as meaning “in any particular case” so that it was for the data controller to show that one of the statutory objectives is likely to be prejudiced in the particular case. (These words do not appear in s. 39(2) DPL.)

36. Turning to the phrase “is likely to be” in s. 29(1) DPA, the judge held at [100] that “likely” connotes a degree of probability where there is a very significant and weighty chance of prejudice to the identified public interests. The degree of risk must be such that there “may very well” be prejudice to those interests, even if the risk falls short of being more probable than not.

37. In [122], the judge made it clear that s. 29 (1) DPA requires that the issue of whether disclosure is likely to prejudice the prevention of crime has to be determined in relation to the particular and individual case in which disclosure is being sought, but he went on to say that this does not mean that one can simply ignore the consequential effect that disclosure in the particular case may have on others.

38. Fairly characterised, the Home Secretary’s case was that the policy of non-disclosure of Category A reports is necessary in every case because anything less would be likely to prejudice the detection and prevention of crime [106]. The Home Secretary had not sought to make good his case by reference to anything peculiar to or specifically referable to the claimant: his claim was based on the asserted need, in order not to prejudice the legitimate section 29(1) DPA objectives, to impose a general policy confining disclosure in effect to what is contained in “gists” prepared in accordance with ex p Duggan [1994] 3 All ER 277 and ex p McAvoy [1998] 1WLR 790. For the reasons submitted by counsel for the claimant, the case advanced on behalf of the Home Secretary that disclosure of Category A reports risked: (i) attacks on the prison staff who produced the reports; (ii) a lack of frankness in reports; and (iii) prejudice to the efficacy of the Category A review system, was unsustainable [125]. Those reasons were as follows.

39. Category A prisoners were not a homogenous group and it was only in respect of one sub–class of the category that disclosure might impact adversely on the detection or prevention of crime: those Category A prisoners whose dangerousness was liable to manifest itself in attacks on, threats to or intimidation of staff. As to this, a targeted form of non–disclosure would properly protect report writers from the risks presented by the sub–class who do pose a threat and equally protect the integrity of the Category A review system. The procedure for parole reviews provided for full disclosure as the general rule, subject to specific, targeted non-disclosure and the same approach should be adopted in the case Category A reviews. In particular cases, information could be withheld such as information relating to security, surveillance and monitory techniques and prisoners would know that such information would not be disclosed.

40. The judge emphasised that he was not saying every Category A prisoner would in every case be entitled to see the full contents of his Category A reports. There would be cases in which the Secretary of State would be able to rely upon section 29 (1) as justifying less than complete disclosure. All the judge was saying was that the Home Secretary’s present policy of blanket non–disclosure could not be justified under section 29 (1) DPA. What section 29 (1) DPA required was a more selective and targeted approach to non–disclosure, based on the circumstances of the particular case [126].

41. The judge then considered the effect of s. 7(4)(a) and (b) and s. 7(5) DPA. Under these provisions (they have no counterpart in the DPL), unless it was “reasonable in all the circumstances” for the Home Secretary to comply with the claimant’s request without the consent of the prison officers and other persons who had made Category A reports, his obligation was to communicate so much of the information sought as can be communicated without disclosing the identity of the other individuals concerned, whether by the omission of names or other identifying particulars or otherwise.

42. In the judge’s view there had to be a balancing of the interests of prisoners that concerned their liberty and the privacy interests of individuals who could be identified from the information sought under s. 7(1) (including the expectation that such individuals might have of confidentiality) and the balance could be held by a system of targeted disclosure [147-148].

Durant v Financial Services Authority [2003] EWCA Civ 1746

43. The data subject in this case (the claimant) sought disclosure from the FSA which at his request had investigated his complaint against Barclays Bank in the FSA’s supervisory role. The claimant had sued Barclays and lost and sought disclosure of information in the belief that it would help re-open his claims against Barclays. The FSA closed its investigation without informing the claimant of the outcome, as it was entitled to do. In response to the claimant’s s. 7(1) DPA request, the FSA disclosed copies of documents held in computerised form but it refused to disclose information held on manual files on the ground that it was neither “personal” nor “data” in the sense of forming part of a “relevant filing system”. This information consisted of the claimant’s letters of complaint to the FSA and the investigation of that complaint. The claimant applied to a District Judge under s.7(9) DPA whose refusal to order the disclosure sought was appealed to a County Court Judge whose dismissal of the appeal was appealed to the EWCA.

44. The lead judgment of the EWCA was given by Auld LJ who said in [26] that the intention of the Directive is to enable an individual to obtain his personal data, that is, information about himself, from a data controller’s filing system.

45. At [27]-[31], Auld LJ said:

Zaw Lin and Wai Phyo v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB)

46. In this case the claimants were Burmese nationals living in Thailand who were charged with the murder of two British tourists in Thailand and faced the possibility of being sentenced to death. With the agreement of the Thai authorities, a Metropolitan police officer, DCI Lyons, went to Thailand and prepared a report on the investigation by the Royal Thai Police (“RTP”) into the murders. The Commissioner of the RTP sought and obtained express agreement from DCI Lyons that his observations and deployment as set out in his report would only be shared with the families of the victims of the murder. The claimants’ subject access requests under s. 7(1) DPA to the Metropolitan Police Commissioner (“MPS”) to be provided with DCI Lyons’ report were refused and they now applied to the High Court under s. 7(9) DPA for an order that the MPS provide them with the report. The MPS contended that the personal data contained in the report had been processed for the purpose of the prevention or detection of crime and/or the apprehension or prosecution of offenders and was exempt from s. 7(1) DPA by reason of s. 29(1) DPA on the ground that disclosure would be likely to prejudice those matters.

47. Green J (the judge) decided that the pursuit of an investigation for the purpose of family liaison was within the scope of s. 29 (at [87]) but held that s.29 and Article 13 of the European Directive required a balancing exercise to be performed between the individual’s right of access under s. 7(1) DPA and the data processor’s right to refuse disclosure under s. 29(1) DPA [78]. The argument to the contrary advanced by counsel for the MPS was not sustainable:

80. … If it were correct then it would in effect reduce to nought the relevant individual’s right to privacy or any other right including the even more fundamental right to life. The argument is inconsistent with (inter alia): (a) the Directive and the plain reference to the fundamental rights of the individual concerned; (b) the raison d’être of the DPA 1998 as a protector of an individual’s fundamental rights; (c) the view taken by the Court of Justice that derogations from the individual’s fundamental rights had to be construed narrowly and in this regard see by way of illustration Case C-473/12 IPI v Englebert et ors [2014] 2 CMLR 9 at paragraph [39] where the Court emphasised that derogations from the fundamental right to privacy “… must apply only insofar as is strictly necessary” (this being the traditional language of the Court of Justice when it is referring to a proportionality exercise); (d) the judgment of Mr Justice Munby in Lord at paragraph [99]: see below at paragraph [84] and with his explanation that because of the importance of the policy of protecting individual rights the burden of proof lay on the State to justify derogation to a high standard of proof; and (e) the judgment of Lord Sumption in Catt at paragraph [8].

48. The judge endorsed Munby J’s observation in Lord that the consequential effect of disclosure in a particular case may have on others can be taken into account when determining whether disclosure is likely to prejudice the prevention or detection of crime. He referred to this as the “chilling effect” of disclosure.

49. In [115] the judge said that the case ultimately turned upon the intrinsic relevance of the personal data to the defence in the criminal proceedings when set against the interests of the MPS in non-disclosure. He had read the report but was not at liberty to disclose its contents. He had reviewed each item of personal data in the report and focussed upon the possible value in question could have for the accused in the trial. His conclusion was that there was nothing in the personal data which could be of any real value to the claimants and in consequence the claimants’ application did not succeed.

Dawson-Damer and others v Taylor Wessing LLP and others [2017] EWCA Civ 74; [2017] 1WLR 3255

50. In this case the claimants, beneficiaries under Bahamian trusts, made data subject access requests of the defendant solicitors who acted for the sole trustee of one of the settlements seeking personal data relating to themselves that was in the defendant’s possession. The solicitors refused the request on the basis that much of the personal data was exempt from disclosure on the ground it was subject to legal professional privilege under paragraph 10 of Schedule 7 to the DPA. The claimants then applied to the High Court under s. 7(9) DPA for an order that the defendant provide the personal data requested but this application was refused on the grounds, inter alia, that: (i) the information sought was covered by legal professional privilege; (ii) to supply the claimants with permanent copies of the information would involve a disproportionate effort for the purposes of s. 8(2) DPA⁶ ; (iii) the subject access requests had been made for the improper purpose of obtaining information to be used in proceedings in the Bahamas.

6 “(2) The obligation imposed by section 7 (1) (c) (i) must be complied with by supplying the data subject with a copy of the information in permanent form unless – (a) the supply of such a copy is not possible or would involve disproportionate effort …”

51. It is the Court of Appeal’s decision on the issues of “proportionate effort” and the relevance (if any) of the purpose of the subject access request that is of relevance to the instant proceedings.

52. The lead judgment was given by Arden LJ who held on the issue of “proportionate effort” that:

53. Arden LJ styled the issue of the relevance (if any) of the purpose of the subject access request as “the no other purpose rule” issue. She accepted the claimants’ contention that what was said in [27] in Durant does not establish a principle that there is no duty under s. 7 DPA to comply with a SAR if the purpose of the request is otherwise than to check the data requested to see if it infringes the data subject’s privacy and if so to take the steps provided for in the DPA. Paragraph [27] in Durant was not to be taken out of context. What was being said in that paragraph was that a person could not claim that data was personal data because it would assist him in obtaining discovery in litigation or complaints against third parties [111]. Recital (10) of the European Directive made it clear that the rights given by the Directive are to protect fundamental rights conferred by EU law. The Court had been shown nothing in the DPA or the Directive which limits the purpose for which a data subject may request his data or provide data controllers with the option of not providing data based solely on the requester’s purpose [107].

Ittihadieh v 5 – 11 Cheyne Gardens RTM Co Ltd et al; Deer v University of Oxford [2017] EWCA Civ 121

54. The judgments in these two appeals are relevant in respect of: (i) the underlying purpose of the right of access to personal data; (ii) the obligation to communicate in intelligible form “the information constituting any personal data of which the individual is the data subject” in s. 7(1)(c ) DPA (cf Art 17 DPL); (iii) the issues of reasonableness and proportionality so far as concerns a data controller’s duty to provide information in response to a subject access request; and (iv) the discretion conferred on the court by s. 7(9) DPA (cf Arts 33(1) and 39(2) DPL) and balance to be struck between the prima facie right of the data subject to have access to his personal data on the one hand and the interests of the data controller on the other.

55. In the first appeal, the appellant (Mr Ittihadieh) had an interest in three flats in a residential building in London. The management of certain parts of the building was in the hands of a right-to-manage company (the “RTM Co”) which was established by a number of non-corporate owners of other flats in the building who became members of RTM Co and were in dispute with the appellant. At a later date, the appellant became a member of RTM Co but his attempts to get representation on RTM Co were blocked. In the belief that residents in the building had been swapping and retaining personal information about him and there was a specific file on him, the appellant served a wide-ranging subject access request on the directors of RTM Co seeking a copy of all personal data which may be held in handwritten notes, meeting and other attendance notes, letters, e-mails, SMS text messages and word-processed documents. In response, the company said through its solicitors that the request was a “fishing expedition” and an abuse of process that would involve the company in wholly unnecessary costs. Later, RTM the company served about 400 documents some of which were redacted. Dissatisfied with this disclosure, the appellant applied under s. 7(9) DPA for an order that the requested information be supplied. The judge who heard that application held that the subject access request had been directed to the company only: the directors and secretary were not data controllers. As to the disclosure made by the company, no attempt had been made to show that the 400 pages of disclosed documents failed to provide the information to which the appellant was entitled and it would be disproportionate to make an order.

56. In the second appeal, the appellant had brought a sex discrimination claim against Oxford University which was compromised. Subsequently she brought five fresh claims against the university alleging that she had been victimised because she had advanced the settled claim and the subsequent claims. She served two subject access requests on the university. In the first she sought a very wide range of documents aimed at obtaining information about a refusal to provide her with a reference. To begin with the university refused the request on the ground that improper use was being made of the DPA and the appellant served a second subject access request. Subsequently, in response to an order by a judge, the university reviewed over 500,000 emails and other documents at a cost of £116,116. Following a review of this material about 300 documents were disclosed. The appellant’s claim to the court came back before a different judge who held that none of the withheld material constituted the appellant’s personal data and even if there had been any errors of taxonomy in his analysis, in the exercise his discretion he would not require the university to take any further steps in compliance as this would serve no useful purpose.

57. The lead judgment was given by Lewison LJ. In paragraphs [82] – [89] he observed that the underlying purpose of the right of access to personal data is for the data subject to check its accuracy to see that they are being processed lawfully. However, a data controller is not entitled to refuse to comply with a request if it is made for a collateral purpose such as to obtain documents for the purposes of litigation:

“ [T]he mere fact that a person has collateral purposes will not invalidate a SAR, or relieve the data controller from his obligations in relation to it, if that person also wishes to achieve one of or more of the purposes the Directive …” [86].

58. In paragraph [93] Lewison LJ dealt with the how a data controller must respond to a SAR.

The obligation under section 7(1)(c) includes an obligation to communicate in intelligible form “the information constituting any personal data of which the individual is the data subject”. This goes further than section 7(1)(b) which requires a description of the personal data. It is an obligation to supply the information itself. Even so, it is not an obligation to supply documents: Dunn v Durham CC [2012] EWCA Civ 1654, [2013] 2 All ER 213 at [16]. It is of critical importance to distinguish between the two. Although it may be more convenient and cheaper in some cases for a data controller to supply copy documents, there is no legal obligation to do so. It is very easy, however, to slip from dealing with personal data into dealing with electronically generated or stored documents in which personal data are recorded. It seems from many of the reported cases (as well as these two appeals) that individuals who make SARs are, in truth, looking for copy documents. They are in my judgment aiming at the wrong target. This ties in with the definition of “personal data”…

59. On the subject of proportionality, Lewison LJ said this in paragraphs [95] – [100] and [103].

60. Lewison LJ said that the discretion conferred on the court by s. 7(9) DPA was not untrammelled. A discretion conferred on a court by legislation was conferred for a purpose in exercising such a discretion the court must act in furtherance of that purpose. The starting point when exercising the discretion conferred by s. 7(9) was that the controller had failed to comply with his obligations under s. 7 [105]. However, that said, in exercising the discretion the court must have regard to the general principle of proportionality which runs through EU law [107]. A balance had to be struck between the rights and interests in question [108]. Amongst the relevant factors that the court may take into account were: is there a more appropriate route to obtaining the requested information; the nature and gravity of the breach; the absence of a legitimate reason for the SAR, even though a collateral purpose of assisting in litigation is not an absolute bar; the application is an abuse of rights e.g. where litigation is pursued merely to impose a burden on the data controller; the application is procedurally abusive, e.g. where it has failed before; and the personal data are of no real value to the data subject.

61. In the Ittihadieh appeal, the judge’s exercise of discretion had been firmly based on proportionality and the judge reached a conclusion which he was entitled to reach [128].

62. In the Deer appeal, the judge had been entitled to: (i) take the view that further disclosure would serve no useful purpose; (ii) take account of the appellant’s relentless pursuit of disclosure not only of personal data but also documents; and (iii) the lack of proportionality in the appellant’s subject access requests.

The parties’ respective cases in the appeal

The DFSA’s case on the appeal

63. The DFSA pleads eight grounds of appeal in its Particulars of Claim which were served before it had been established that the appeal against the Commissioner’s finding that the DFSA had contravened the DPL was by way of a de novo hearing. Unsurprisingly, the argument advanced by Mr Pitt-Payne QC for the DFSA was rather more broadly expressed than the pleaded grounds of appeal. The argument proceeded under the following headings.

The Article 39 exemption (Ground 3)

64. It was submitted that compliance with the SAR would be likely to prejudice the proper discharge of the DFSA’s powers and functions by severely impacting on: (a) the DFSA’s role in the on-going proceedings brought by Ms Waterhouse in the FMT challenging the DFSA’s Decision Notice during which the DFSA had to gather further information; and (b) the DFSA’s wider functions as a Regulator including future investigations. In respect of both (a) and (b), compliance with the SAR would involve the DFSA in having to divert very significant financial and human resources from performance of its regulatory functions; and in respect of (b) alone, there would be the “chilling effect” noted in Zaw Lin at [106] of deterring third parties from sharing confidential information with the DFSA and also the subjects of future investigations could be encouraged to serve SARs with the intention of distracting the DFSA and tying up time and money.

65. The DFSA’s assessment of the quantity of paper records presented during the hearing before the Commissioner was that there were about 280 lever arch files of hardcopy documents that represented evidence gathered during the course of the enforcement investigations. These lever arch files were not ordered by reference to the individuals who were the subject of the investigation and contained a mix of different types of documents. More than 100 of the lever arch files contained documentary evidence in support of the findings contained in the report relating to an independent investigation that was commissioned by Ms Waterhouse’s previous employer in 2014 covering events from the start of 2011. Some of the lever arch files could be excluded as not containing personal data about Ms Waterhouse but in respect of others of the files there was no way to make this determination without individual examination thereof.

66. So far as concerns electronic records, the DFSA put before the Commissioner a report compiled by Mr Matthew Hammond, Senior Manager in the DFSA’s Enforcement Division. Mr Hammond’s conservative estimate of the total DFSA data estate across physical and virtualised servers was between 70 and 80 TB. In addition, there were approximately 140 laptop computers of approximately 40 TB. A review of the whole estate would require the retention of a third party contractor at an estimated cost of between US$500,000 and US$800,000. Mr Hammond had reviewed the following sources of the electronic data with a view to estimating the person hours needed to review the date to comply with the SAR: Regulatory Information System; centralised email server; virtual personal devices; physical hard drives; mobile devices; and SharePoint.

67. The Court has before it a witness statement from Mr Patrick Meaney, the DFSA’s Head of Enforcement dated 13 December 2018. In this statement, Mr Meaney refers to Mr Hammond’s report and brings the Court up to date stating that, since the proceedings before the Commissioner, the DFSA had received a price estimate for the work required to comply with the SAR from Deloitte Professional Services (DIFC) Ltd in the sum of US$300,000 plus AED 15,700⁷ which represents more than double the annual budget for the Legal, Consultancy and other Professional Fees and approximately 9% of the Enforcement Division’s entire annual budget.

7 For the scanning work involved.

68. In the course of the Commissioner’s investigation into Ms Waterhouse’s complaint against the DFSA, the Commissioner sought from Ankura Consulting Group LLC (“Ankura”) a detailed preliminary estimate of the costs it would charge to provide technology services to assess electronic records and lever arch files in the DFSA’s possession for personal data relating to Ms Waterhouse. The Commissioner’s request was for an estimate to be used to answer the DFSA’s arguments relating to the disproportionate cost to respond properly to the SAR. Ankura’s estimated total costs for the engagement were US$ 90,000 – US$ 102,500, assuming a 3 – 6 month duration if the work could be done remotely and US$ 120,000 – US$ 153,000 if the work had to be done on site. These estimates were based on a different approach from that adopted by Deloitte in that data would be culled at source by taking into account likely storage sites and individuals involved and the first estimate assumed that onsite data would be provided on site with remote forensic support. In addition, between US $10,000 and US$ 12,500 per month would be charge under both scenarios for mobile server costs.

69. The Ankura estimates are criticised by Mr Lake in his third witness statement where he says that Ankura has incorrectly assumed that there were defined data collection process and data collection points in a very structured controlled environment and the relevant information in hard copy files will be already stored in electronic format in one of the searchable data bases. Mr Lake also points out that data cullable at source is limited to email data searchable by the DFSA’s IT administrator and searches of this data would not include attachments.

70. Mr Meaney also expresses the view that parties asked to provide information to the DFSA in the course of an investigation, even if they could be compelled to produce it under the Regulatory Law, would be much less willing to co-operate if they knew the subject of the investigation could discover who had provided the information by serving a SAR when otherwise the information would remain confidential pursuant to Article 38 (1) of the Regulatory Law.

71. The DFSA submits that the interest of Ms Waterhouse in the provision of the information she seeks that is to be balanced against the interest of the DFSA in not having to comply with the SAR is the extent to which Ms Waterhouse’s case in the FMT proceedings could be assisted if the SAR were enforced. And given the disclosure that has been made by the DFSA in respect of the DMC proceedings, the Decision Notice and the FMT proceedings, both on the DFSA’s initiative and in response to disclosure applications made by Ms Waterhouse, the weight of her interest is very small as was recognised in paragraph 5 of Ms Waterhouse’s submissions to the Commissioner dated 7 March 2018:

It is correct to point out that any documents disclosed by the DFSA following this complaint that are relevant to her regulatory challenge before the FMT should then be included in the bundle of documents before the Tribunal. However since the DFSA has now given disclosure within those proceedings it is anticipated that there may not be many further documents to include in any event.

72. The DFSA accepted at the hearing that it was under a duty to act fairly to Ms Waterhouse which included a duty to disclose all relevant documents including those that were adverse to its case. The DFSA also submitted that it had made disclosure to Ms Waterhouse in compliance with this duty.

73. Evidence relating to the disclosure provided to Ms Waterhouse during the proceedings referred to in paragraph 71 above is provided by Mr James Lake, the Associate Director in the Legal Department of the DFSA, in his first witness statement dated 13 December 2018. In this statement Mr Lake deposes to the matters related in paragraphs 6 and 7 and in paragraphs 106 -107 to the documents that had been provided to Ms Waterhouse following the Decision Notice as follows:

74. In paragraphs 96 and 97 of his first witness statement, Mr Lake states that in a letter dated 23 December 2017 Ms Waterhouse requested disclosure and listed a number of categories of documents which she wanted disclosed. These were: (i) documents passing between the DFSA and DB relevant and material concerning the investigation by the DFSA into DB or Ms Waterhouse or Chetan Palmar (“CP”); (ii) documents passing between the DFSA and DB relevant and material to the proceedings concerning the settlement of the investigation into or proceeding against DB or CP or any others; (iii) documents passing between the DFSA and Freshfields and the DFSA and DB about the internal investigation by DB and Freshfields into Ms Waterhouse’s alleged actions which are relevant and material to the proceedings and/or any part of the Kansas Report and/or the DFSA’s Investigation Report and supporting documents; (iv) all documents held by the DFSA relating to the subject matter of the Kansas Report (some of the documents are mentioned in the Report but had not been disclosed so far); (v) internal documents held by the DFSA about Ms Waterhouse relating to the investigation by the DFSA against me including all correspondence between the DFSA Enforcement and the DMC members or advisors and between members of the DMC Steering Committee, the DMC and DFSA Enforcement; (vi) documents passing between the DFSA and DB and internal documents held by the DFSA which concerned possible regulatory action to be taken against Ms Waterhouse; (vii) documents passing between the DFSA and Clifford Chance about alleged events and the Skilled Persons Report relevant to the investigation by the DFSA into DB or CP or Ms Waterhouse; and (viii) documents passing between the DFSA and DB concerning the disclosure of the settlement agreement between DB and Ms Waterhouse to the DFSA. The DFSA agreed to review certain of the categories of documents requested but not all of them. The DFSA did not consider it appropriate to review and disclose documents falling within all of the categories requested by Ms Waterhouse as it did not consider all of them relevant or material to any issue in the FMT proceedings.

75. In paragraphs 108 – 114, Mr Lake states as follows. The DFSA responded to Ms Waterhouse’s documentary request in a letter dated 3 January 2018. This letter contained a detailed analysis of the request and sets out the categories of documents which the DFSA was prepared to review to ensure that anything relevant and material to the reference to the FMT had in fact been disclosed and it gave detailed reasons in terms of lack of relevance or prior provision for the refusal to disclose the documents in the other categories sought. Given the DFSA’s offer to undertake the review offered in the 3 January 2018 letter, Ms Waterhouse’ counsel did not make any application for disclosure at the CMC on 8 January 2018 and nor did the FMT make any further order for disclosure.

76. The DFSA completed the disclosure review and the further disclosure was provided to Ms Waterhouse on 22 February 2018. Additionally, as related above, the DFSA provided further disclosure of documents in the FMT proceedings on 8 March 2018, 22 March 2018, 23 March 2018, 2 April 2018 and at other times leading up to and during the FMT hearing from 28 to 30 April 2018.

77. Following the hearing, with the Court’s leave the DFSA served further documents said to evidence the extent that disclosure was made by the DFSA in both the DMC and FMT proceedings and further submissions on the topic of disclosure that focussed on the documents provided by Ms Waterhouse after the hearing. In the view of the DFSA, Ms Waterhouse had made selective disclosure that gave an inaccurate and misleading picture to the Court and was an attempt to relitigate issues that had already been fully considered and resolved in the FMT proceedings. The DFSA also sought to provide further information in respect of the documents disclosed by Ms Waterhouse in part by providing documents that had not been provided by Ms Waterhouse. These additional documents included: (i) a letter to Ms Waterhouse’s counsel, Mr Christopher Sallon QC, dated 23 March 2016, that provided a detailed document setting out supplementary information that had been requested by Ms Waterhouse relating to the minute of the meeting between the DMC and DFSA’s Enforcement arm on 26 November 2015; (ii) correspondence with Mr Sallon in which the DFSA offered to ask DB to provide information in relation to the suspension of certain executives who were the subject of DB’s “Project Dastan” investigation and provided information received from DB; (iii) disclosure by the DFSA in March 2018 of the Deloitte Report and copies of various exhibits to that report; (iv) the DFSA’s letter of 14 December 2017 sent in anticipation of the CMC to be held by the FMT on 8 January 2018 in which the DFSA expressed the view that the only relevant material that remained outstanding was Ms Waterhouse’s medical report referred to in her Statement of Case; (v) the DFSA’s offer to conduct a disclosure review in response to Ms Waterhouse’s letter of 23 December 2017 (see paragraph 74 above) and to consider any reasonable requests for disclosure provided they were accompanied by a proper explanation of the issues to which the documents were said to relate and why discovery was necessary; (vi) the DFSA’s letter dated 22 February 2018 communicating the results of the disclosure review (see paragraph 76 above).

78. The DFSA also referred to the emergence of further disclosure issues in October 2018 in advance of the FMT second hearing that began on 29 October 2018. By her letter dated 2 October 2018 to the FMT, Ms Waterhouse requested the FMT not to conclude the proceedings until the Data Protection appeal had been heard “since to do so would risk a decision being taken in the absence of important documents” and raised, under the heading “Further issues as to documents remain outstanding in relation to the present proceedings”, her challenge to the admissibility of documents obtained by the DFSA from DB under the DFSA’s compulsory powers and her request that the FMT order the DFSA to obtain the 18 categories of documents she had requested the DFSA to obtain from DB that are set out in her letter of 4 April 2018 to the FMT. Ms Waterhouse made no further challenges to disclosure in the letter of 2 October 2018. By letter dated 8 October 2018 to the FMT, the DFSA repeated its willingness to consider exercising its powers to obtain documents from third parties if a more focussed and targeted request was forthcoming that was likely to produce documents relevant to the proceedings. Ms Waterhouse replied by letter dated 11 October 2018 to the FMT with a more focussed request. She also gave examples of her allegation that the DFSA failed to disclose relevant documents as follows: (1) full details of the settlement between DB and the DFSA said to be relevant to why enforcement proceedings against certain individuals were dropped and not pursued against two others; (2) all the exhibits to the Deloitte Report and the earlier drafts thereof on the basis that, after the DFSA appointed Deloitte, the scope of the report was altered by negotiation between the DFSA and DB; (3) the supporting documents relied on by Freshfields in preparing the DB DIFC Internal Investigation Report; (4) the DFSA’s note of the meeting on 19 January 2014 between certain individuals of DB, Clifford Chance and the DFSA; and (5) the full records of the DFSA’s interactions with DB which led to the terms of her settlement with DB being disclosed to the DFSA. In its reply by letter to the FMT dated 18 October 2018, the DFSA noted that, since the CMC, Ms Waterhouse had not sought directions from the FMT for further disclosure. The DFSA also proceeded to provide grounds for concluding that the non-disclosures complained of did not go to relevant issues in the proceedings.

79. On 31 October 2018, in the course of the FMT’s resumed hearing, the Tribunal received submissions on Ms Waterhouse’s contentions. In its ruling, the FMT declined to make a third party order against DB on the ground that, having looked at the categories of documents, the pleadings and what the case was about on the pleadings, the Tribunal was unconvinced that the disclosure of the material sought in addition to the 13,600 documents already disclosed was going to assist by the further delay, further submissions and further documents.

80. The FMT’s decision on Ms Waterhouse’s application to adjourn its proceedings to await the outcome of the instant proceedings herein is related below in paragraph 161 below .

Proportionality and Article 17 (Ground 5)

81. Citing paragraphs [95] – [103] of Lewison LJ’s judgment in Ittihadieh (see paragraph 59 above), the DFSA submits that proportionality is central to the DPA not only because of the wording of s. 8(2) thereof but also because of the European law context and given that the DPL was modelled on the DPA, a similar approach should be applied to the DPL. It follows that, irrespective of Article 39(2), a data controller is not obliged to comply with a SAR if to do so would be disproportionate and this is the situation in the instant case.

82. The DFSA further submits that, as was held in Ittihadieh [107]-[108]⁸ and Dawson-Damer [76]-[77]⁹ , the question of proportionality is essentially a consideration as to what would constitute a fair balance between the interests of the data controller and the data subject. Applying this approach, for the reasons submitted on the question of proportionality in respect of Article 39(2) (see paragraphs 71 -75 above) it would be disproportionate to require the DFSA to comply with the SAR.

8 See paragraph (60) above.
9 See paragraph (52) above.

Nature of the Request: documents, not information (Ground 1)

83. The DFSA submits that the SAR is in any event misconceived because it seeks the disclosure of documents whereas under Article 17 DPL (cf s. 7(1)(a) – (c) DPA), a data subject has the right only to obtain his or her personal data in intelligible form. In support of this submission, the DFSA cited Ittihadieh at [92] – [93].

84. The DFSA argued that it was plain from the following wording of the SAR that what was being requested were documents.

85. The DFSA also relied on the following statements (with italicised emphasis supplied) in letters sent by Ms Waterhouse to the FMT in the course of requesting the FMT to delay making a decision until the proceedings now before the Court had been concluded.

Preconditions for making a complaint (Ground 4)

86. The DFSA submits that the Commissioner did not become seised of Ms Waterhouse’s complaint concerning the DFSA’s refusal to provide the requested personal data because Ms Waterhouse did not believe on reasonable grounds that she had been adversely affected by a contravention of the Law as regards her Article 17 rights as required by Article 34 (1) DPL. That provision reads:

A Data Subject who believes on reasonable grounds that he has been adversely affected by a contravention of the Law in respect of the Processing of his Personal Data and as regards the exercise of his rights under Articles 17 and 18 may lodge a complaint with the Commissioner of Data Protection.

87. The DFSA contends that Ms Waterhouse was not adversely affected by its refusal to comply with the SAR because her purpose was to obtain documents helpful to her in the FMT proceedings and she could equally achieve this purpose through making an application for disclosure of relevant documents in those proceedings. It follows that Ms Waterhouse cannot have believed on reasonable grounds that she was adversely affected by the DFSA rejection of the SAR.

88. In the proceedings before the Commissioner, in addition to contending that she had been adversely affected by the DFSA’s refusal to comply with the SAR because her right to be provided with her personal data had been wrongly denied by the DFSA, Ms Waterhouse cited the following examples of personal data having been inaccurately and/or misleadingly the processed by the DFSA:

89. Ms Waterhouse also contended that following the refusal by the DFSA to comply with the SAR she had spent considerable time and incurred expenditure pursuing her complaint about the refusal.

90. The DFSA‘s response to (1) and (2) above is that Ms Waterhouse raised the issue of DB disciplinary proceedings against her and her grievance against DB in the course of her representations to the DMC. To understand these claims the DFSA requested and were provided with information and copies of relevant documents by DB. In the course of the FMT proceedings, Ms Waterhouse again raised the allegations she made against her former line manager and following a CMC (partly held in private) the FMT ordered that the DFSA may disclose information about Ms Waterhouse’s allegations to DB and the line manager to enable the DFSA to investigate the allegations and to respond thereto in the FMT proceedings. Early in January 2018, the DFSA asked DB to provide copies of all documents relating to the grievance filed by Ms Waterhouse and just over a week later DB provided documents and information regarding Ms Waterhouse’s grievance. DB then provided further information and relevant documents on 25 January 2018. Prior to receiving this information, in January 2018, the DFSA had only limited information regarding Ms Waterhouse’s grievance against DB and the former line manager. In the light of this explanatory background, Ms Waterhouse’s assertion that the DFSA had “processed some but by no means all” of the relevant data about her grievance is not understood and is rejected.

91. As to (3) above, the DFSA was provided with details of Ms Waterhouse’s salary in the period 2011-2014 by DB in October 2014 in response to a notice under Article 80 of the Regulatory Law. That information was held only within the DFSA Enforcement Division and it was not used or relied on for the purposes of the ongoing investigation. Accordingly, in the submission of the DFSA, Ms Waterhouse’s claim that this information was partial and inaccurate makes no sense and is denied.

92. As to (4), the DFSA accepts that it disclosed the existence of the settlement agreement between Ms Waterhouse and DB to the FMT. The DFSA also informed the FMT that Ms Waterhouse had received a very significant payment from DB in compensation for loss of employment. This disclosure was initially in the context of her application for the FMT to waive the filing fee for her reference to the FMT. DFSA Enforcement required DB to provide details of the settlement for the purposes of responding to representations made by Ms Waterhouse to the DMC. The settlement agreement was also referred to in correspondence during the FMT proceedings. Save aforesaid, the DFSA avers that it has not disclosed the settlement agreement to any other parties including internally to the DMC or to the FMT and it submits that there is no basis for Ms Waterhouse’s allegation that it partially and inaccurately processed this information.

93. As to (5), the DFSA maintains that it only obtained Ms Waterhouse’s medical records in December 2017 after her subsequent complaint to the Commissioner. In her Statement of Case Ms Waterhouse referred to a medical report she had obtained which she claimed was relevant to the FMT proceedings. The medical report was first seen on 17 December 2017 when Ms Waterhouse provided it to the DFSA with various other documents including some of her previous medical records which were referred to in the report. The report focused on a particular factual event in email correspondence involving Ms Waterhouse dated 30 October 2011. These were matters in dispute in the FMT proceedings.

94. When she provided the DFSA with a copy of the report, Ms Waterhouse stated that it contained confidential medical information and she did not give her consent for the report to be disclosed to any third parties. The extent to which Ms Waterhouse was able to rely on the report and the DFSA’s ability to respond to the issues it raised was considered by the FMT at the CMC on 8 January 2 018. Prior to that, the DFSA and Ms Waterhouse exchanged correspondence on the issues to be discussed at the CMC. In a letter to the DFSA dated 23 December 2017, copied to the FMT, Ms Waterhouse stated that “it will assist case preparation if you inform me before the CMC if you intend to instruct your own expert to give evidence.” Subsequently, by letter dated 3 January 2018, the DFSA informed Ms Waterhouse that if the FMT were to grant permission for her to rely on the medical evidence she had disclosed, the DFSA intended to ask that an expert attend the FMT hearing for cross-examination and that the DFSA be given permission to produce its own expert evidence. Ms Waterhouse was therefore informed before the CMC that if the FMT granted permission for her to rely on the report, the DFSA intended to produce its own expert evidence. The DFSA proceeded to instruct a medical expert who was provided with a copy of Ms Waterhouse’s medical report and supporting documents. The expert subsequently provided the DFSA with a written assessment and opinion on Ms Waterhouse’s medical report which was shared with Ms Waterhouse on 8 March 2018. Ms Waterhouse then asked the DFSA to explain how it had obtained her consent to her confidential medical information including her medical records being provided to a third-party. It was Ms Waterhouse’s view that having explicitly withheld her consent to her medical records being disclosed to a third-party, the DFSA ought not to have provided the report to the expert. The DFSA explained in a letter to Ms Waterhouse dated 23 March 2018 that having informed Ms Waterhouse that it would be instructing an expert and Ms Waterhouse having consented to this, the DFSA had understood that she did not object to her medical report being provided to the expert. The DFSA apologised if they had misunderstood her intentions.

95. Prior to becoming aware that the DFSA had provided the medical report and medical records to the medical expert, Ms Waterhouse had no basis on which to believe that the DFSA had somehow been processing her personal data relating to her medical information against her wishes. The DFSA’s instruction of a medical expert had been necessary for the purposes of the ongoing FMT proceedings and disclosure of confidential information by the DFSA is permissible under Article 38(3) of the Regulatory Law and had been impliedly consented to by Ms Waterhouse when she was told and consented to the instruction of a medical an expert by the DFSA.

The DFSA’s paper records (Ground 6)

96. In the course of the proceedings conducted by the Commissioner, the DFSA contended for the first time that the 280 odd lever arch files containing hard copy documents it had compiled during the investigations into DB and Ms Waterhouse did not constitute a “Relevant Filing System” for the purposes of the definition of “Data” in the DPL and therefore cannot constitute “personal data” and hence cannot come within the scope of the SAR.

97. “Data” is defined in the DPL as:

Any information which: (a) is being processed by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should be processed by means of such equipment; or (c) is recorded as part of a Relevant Filing System or with the intention that it should form part of a Relevant Filing System.

98. “Relevant Filing System” is defined as:

Any set of information relating to an identifiable natural person to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.

99. As recorded in paragraph 22 above, the Commissioner declined to decide whether the lever arch files were a Relevant Filing System but instead directed that when the DFSA came to comply with the SAR in compliance with Commissioner’s direction that it should do so, the DFSA could contend that the lever arch files were beyond the scope of the SAR and the issue whether this was so could then be decided.

100. The DFSA submits that, pursuant to Article 33(2) DPL which provides that when issuing a direction, the Commissioner “shall carry out, as a minimum, due process by means of undertaking all the reasonable and necessary inspections and investigations to be adequately satisfied to be adequately satisfied to establish the Data Controller’s contravention …”, the Commissioner should have inspected the lever arch files and found that they were a not a Relevant Filing System. Accordingly, even if (which is denied), the DFSA was obliged to comply with the SAR to the extent that Ms Waterhouse’s personal data was electronically stored, the Commissioner should have held that the lever arch files were beyond the scope of the SAR.

The Commissioner’s case on appeal

101. To begin with I shall deal with the Commissioner’s contentions of an over-arching nature and I shall then summarise his specific submissions in response to the DFSA’s case.

102. Mr Russell QC for the Commissioner argued that if the SAR was a valid request (which it was), then the DFSA was obliged, as a minimum, to scrutinise the personal data of Ms Waterhouse that it held and to inform her, as a minimum, what personal data of hers it held that could be provided without prejudicing it in the discharge of its powers and functions under any law it administered. The DFSA had failed to undertake any such scrutiny and thus, as of 10 August 2017, when it rejected the SAR, the DFSA was in contravention of the DPL and that breach had continued ever since. Anything that the Commissioner or the DFSA did subsequently was accordingly nothing to the point.

103. This submission prompted the Court to observe that it would have serious reservations about ordering the DFSA to comply with the SAR in its entirety if it was of the view that certain of the data requested ought to be withheld on grounds of confidentiality or to avoid the risk of the flow of information from third parties drying up if such parties knew that their identity might be revealed through compliance with a SAR. Mr Russell then took instructions from the Commissioner and informed the Court that the Commissioner accepted that the direction given in his decision does not preclude the DFSA from raising, in respect of any particular item or category held by it in relation to Ms Waterhouse, any objection to its provision which is based on Article 39(2) or that any material which it holds is not personal data.

104. Citing p. 46 of the SAR Code of Practice issued by the UK Information Commissioner’s Office (“ICO”), Mr Russell noted that even if a data controller does not have to supply information in a permanent form in response to a SAR, the data subject still has the right to be given a description of the recipients of the data and it appeared that the DFSA had declined to inform Ms Waterhouse of the persons or categories of persons to whom her personal data had been disclosed and no reason had been advanced why this prima facie breach of the DPL was excused by Article 39 (2). In particular, the DFSA had provided no evidence whether it had considered this aspect of the SAR which, since it required merely a review of the DFSA’s outgoing communications, would have been a much less extensive than a search of the DFSA’s whole data base. On this ground alone, the finding of the Commissioner could be supported.

105. The Commissioner further contended that the burden was on the DFSA to identify the basis upon which its refusal to provide requested information was lawful (see Dawson-Damer at [73]) and where the effort involved in compliance with a SAR is relied on as an aspect of proportionality, a mere assertion that it is too difficult to search through voluminous papers is not sufficient (see Dawson-Damer at [74]).

The Article 39 exemption (Ground 3)

106. Mr Russell submitted that, unlike Article 39(1) DPL, Article 39(2) DPL does not confer a general exemption on the DFSA from the provisions of Article 17 DPL. Instead, Article 39(2) is expressly limited in scope and thus there must be many cases where the DFSA could respond positively to a SAR where doing so would have no effect whatsoever on the performance of its statutory duties.

107. Mr Russell next argued that the Article 39 (2) DPL “likely to prejudice” test must be satisfied by reference to the “specific request” and the boundary of the exemption conferred by that provision does not extend to information in the possession of the DFSA which could be disclosed without risk of prejudice to its statutory duties. Thus, the “likely to prejudice test” must be applied to the specific pieces of information held by the data controller which means that the data controller will have had to scrutinise all the information that might contain personal data relating to the data subject before he can lawfully resist a SAR under Article 39(2). In support of this contention, Mr Russell relied on the following parts of the Subject Access Code of Practice version 1.2 (“V 1.2”) and the original version (“OV”) issued by the Office of the UK Information Commissioner (ICO): (a) information systems should facilitate dealing with SARs (V 1.2, p 21); (b) a data controller should be prepared to make extensive efforts to find and retrieve the requested information (V 1.2, p 28); (c) the DPA does not permit you to exclude information from a response to a SAR merely because it is difficult to access (OV, p 22); (d) rely on the disproportionate effort exception only in the most exceptional of cases and respond in a cooperative way (OV, p 37); (e) s. 31 of the DPA (exemption) does not operate as a blanket exception (V 1.2, p 4) of [the Code of Practice] as to how data controllers should respond to a SAR.

108. It was further submitted that specific evidence is required to support the DFSA’s contention that the performance of the DFSA’s powers and functions would be prejudiced by compliance with the SAR. No such specific evidence had been adduced by the DFSA which has simply relied on a generalised assertion that its powers and functions would be prejudiced if it had to comply with the SAR. For this reason alone, this ground of appeal fails. In addition, citing page 22 of the original version of the ICO’s SAR Code of Practice, Mr Russell contended that in any event, cost per se cannot be a defence since it is simply a cost of compliance with the law as a data controller.

109. It was contended that instead of proceeding on the basis that it was necessary to search throughout the whole of the information it held in respect of Ms Waterhouse in order to comply with the SAR, the DFSA, after consulting with Ms Waterhouse, should have adopted a targeted disclosure approach of the sort canvassed in Lord which could have eliminated certain categories of information from disclosure, for instance disclosure which would have involved revealing the source of information received in confidence.

110. Mr Russell styled the DFSA’s argument that it would be very severely hampered in carrying out its regulatory functions in respect of its investigation of Ms Waterhouse as “the sky will fall in” argument. In responding to this part of the DFSA’s case, the Commissioner relied on an affidavit sworn by Ms Lori Baker who, in her capacity as Director of Data Protection, has assisted the Commissioner in respect of the proceedings presently before the Court. In her 2nd affidavit, Ms Baker deposes to a conference call attended by individuals representing the UK Financial Conduct Authority (FCA) led by Mr Choyce which was attended, inter alios, by the Commissioner, Mr Russell and herself. Ms Baker says that Mr Choyce stated during the conference that the FCA handles SARs in the manner required of any data controller. The ICO guidance in relation to SARs is not controversial and is not challenged by the FCA, and the FCA applies it accordingly. The cost of handling SARs is part of the requirements to comply with the DPA. In responding to SARs the FCA has to assess the requirements clearly in light of any exemptions, the data subject’s interests and the public interest, and respond appropriately, regardless of the cost. The FCA has only applied exemptions in very rare and limited circumstances as prescribed by the DPA. The FCA and the ICO cooperate to ensure appropriate application of the DPA. Any necessary tests for exemptions are applied on a case-by-case basis; the FCA does not rely on any sort of blanket application of exemptions afforded to it by the DPA. The FCA applies the “prejudice test” as applied by the UK Data Commissioner in his Decision Notices. There is nothing on the record that an order by the ICO has been opposed or challenged by the FCA. There have been no appeals of an ICO decision. The FCA and the ICO are well aligned regarding policy in this area of the law. The FCA estimates that prior to the introduction of the European General Data Protection Regulation (the “GDPR”) there were approximately 120 SARs per year made to it. After the GDPR there have been approximately 80 per year.

111. Responding to the DFSA’s submission based on the cost of implementing the SAR, Mr Russell maintained that what lay behind this contention was the DFSA’s failure to have the systems in place necessary to comply as data controller with the requirements set out in Article 8 DPL and its duty to comply with SARs under Article 17 DPL. Mr Russell also pointed out that among the estimates of the costs of implementing the SAR that were before the Court there was only one which included the instructions in respect of the work to be done, and that was the Ankura estimate obtained by the Commissioner.

Proportionality and Article 17 (Ground 5)

112. It was argued by Mr Russell that there is no warrant for subordinating the clear right conferred on a data subject by Article 17 DPL to considerations of proportionality. In his submission, the reliance by the DFSA on the words “without excessive delay or expense” in the opening sentence of Article 17 for one of the two bases for its proportionality contention was misconceived. He submitted that those words simply give effect to sections 7(2) and 7(8) of the DPA and when the UK cases refer to proportionality, they are referring to section 8(2)(a) of the DPA which has no counterpart in the DPL.

113. Referring to statements made by the DFSA to Ms Waterhouse during the DMC proceedings that, pursuant to paragraphs 4 and 5 of Schedule 3 of the Regulatory Law¹⁰ , it was not obliged to disclose documents adverse to its case but only those documents that were relied on when the DMC made its decision, Mr Russell further argued, in a set of post hearing submissions dated 14 February 2020, that the DFSA had not acted in compliance with the duty to act fairly which it had accepted it owed and which obliged it to disclose documents that were adverse to its case. It followed, submitted Mr Russell, that the DFSA’s disproportionality argument, founded as it was on its duty to make disclosure in the FMT proceedings, was bound to fail because without the enforcement of the SAR Ms Waterhouse could not be sure that the DFSA had provided all relevant documents including in particular those that could potentially have assisted her in pursuing her FMT case. In short, Ms Waterhouse had not been afforded a fair trial and the Court should conclude that a real benefit – the disclosure of adverse documents held by the DFSA which contained personal data of Ms Waterhouse – could be obtained by the SAR.

10 Paragraph 4 (c) requires the DFSA when giving a person a preliminary notice to give them “a copy of the relevant materials which were considered in making the proposed decision.” Paragraph 5 (2) states that a Decision Notice issued by the DFSA must contain “a copy of the relevant materials which were considered in making the decision.”

114. Mr Russell additionally submitted that, in any event, the further material served post hearing by Ms Waterhouse and the DFSA was potentially relevant only to the Judicial Review application because the DFSA had unquestionably contravened the DPL by refusing to conduct any search or analysis of its material at all. And so far as the Judicial Review was concerned, the Court should conclude that the further material (viz the documents showing the DFSA’s stance in the DMC proceedings that it was not obliged to disclose documents adverse to its case) strongly supported the position taken by the Commissioner in his direction.

Nature of Request: documents, not information (Ground 1).

115. In support of the Commissioner’s contention that the SAR was in respect of personal data and not documents, Mr Russell laid emphasis on: (a) the words “personal data” in the second sentence of the SAR letter; (b) the words “personal data” and “the following data” in the opening words of the section of the letter entitled “The scope of my request;” (c) the words “personal data” in the opening sentence under the heading “Information to Supply”; (d) the word “data” in each of the four categories listed in the heading “Information to Supply;” and (e) the words “the data” in the concluding sentence of the letter.

Preconditions for making a complaint (Ground 4)

116. Mr Russell submitted that the Commissioner’s Decision that the DFSA was in contravention of the DPL resulted from a request from Ms Waterhouse that he undertake an inspection and investigation under Article 33 of the DPL and that provision is not subject to the precondition that the applicant believes on reasonable grounds that he or she has been adversely affected by a contravention of the DPL as regards his or her rights under Article 17, as is the case in respect of a complaint lodged under Article 34 DPL. This submission was founded on the wording of Ms Waterhouse’s letter to the Commissioner dated 14 November 2017 which reads in relevant part:

117. Mr Russell argued that a complaint made under Article 34 is intended by that provision to be dealt with by mediation whereas an appropriate inspection and investigation by the Controller pursuant to Article 33 is a free standing course of action which does not have to be undertaken as part of the process of mediation.

The DFSA’s paper records (Ground 6)

118. The Commissioner submits that this ground concerns the process of the Commissioner’s decision making. These processes occurred after the contravention of the DPL started on 10 August 2017 and are irrelevant in the context of the appeal: the DFSA was either entitled to refuse to comply with the SAR or it was not. Further, since the DFSA admitted in its response dated 10 August 2017 to the SAR that it holds personal data relating to Ms Waterhouse, the “lever arch file” issue is not determinative of whether the DFSA contravened the DPL.

Ms Waterhouse’s submissions in the appeal

119. Ms Waterhouse said that in the course of the proceedings leading to the Decision Notice issued by the DMC the question of the effect of the non-disclosure by the DFSA of particular pieces of information on her ability to achieve a fair outcome was raised a number of times.

120. Next, Ms Waterhouse responded to Mr Lake’s statement in paragraph 16 of his 6th witness statement that the DFSA had been concerned one of Ms Waterhouse’s primary purposes in issuing the SAR was to frustrate the FMT proceedings. Ms Waterhouse told the Court that the SAR had two purposes: (1) to rectify any data concerning herself that was not fully accurate; and (2) to assist in her challenge before the FMT. It had never been her intention in issuing the SAR to frustrate the due process of the FMT and there was no evidence that that had been her intention. Ms Waterhouse also expressed the view that it was to be inferred from Mr Lake’s paragraph 16 that the DFSA did not consider the SAR on its merits when it was received.

121. Ms Waterhouse next reminded the Court that the FMT had not acceded to her application to postpone reaching and issuing a final decision until the present proceedings before the Court had been determined. In denying the application, the FMT had said that if any document emerged as a result of the SAR that materially undermined the FMT’s decision there was the possibility of a reconsideration of the result. The SAR had therefore not delayed the outcome of the FMT proceedings and so, even if one of the purposes of the SAR had been to delay those proceedings (which was not the case), that purpose had failed.

122. Ms Waterhouse then sought to contextualise a statement made by Mr Pitt-Payne, Counsel for the DFSA, regarding the position adopted by one of Ms Waterhouse’s counsel in the FMT interlocutory proceedings, when it was said that whilst documents produced by the DFSA under the DPL would have to be added to the bundle, since the DFSA had now given disclosure within the FMT proceedings, it was anticipated that there may not be many further documents to include in any event. Ms Waterhouse said that the anticipation of her then counsel was that disclosure in the FMT proceedings was beginning to roll.

123. In answer to a question from the Court, Ms Waterhouse said that she had made various applications for disclosure by email, including communications within the DFSA, which she could provide given time to retrieve them. She told the Court that following a CMC in the FMT proceedings, certain documents had been provided by the DFSA but on scrutinising them, it could be seen that some of these documents were not complete and/or referred to other documents that had not been disclosed. These “referred to” documents had not been disclosed which meant that she was quite comfortable in saying she believed that further relevant documents had not been disclosed.

124. Ms Waterhouse accepted that following communications with Mr Lake, some further documents were disclosed and she believed that an application for further disclosure had been made to the FMT. She had not attended the April 2018 FMT hearing in Dubai because she was unwell and the transcript reveals that her counsel raised issues about non-disclosure and he put certain questions about these issues to Mr Bock in cross-examination. Documents had emerged at the hearing itself and her counsel complained that they ought to have been produced at an earlier stage.

125. Ms Waterhouse then submitted that there would not be significant cost involved in the DFSA reviewing the materials in the 280 lever arch files the DFSA had spoken of. She went on to say that it had emerged from the cross-examination of Mr Adrian Bock in the FMT proceedings that the overall investigation including herself was commenced in 2012, whereas she had only been notified that she was being investigated in February 2014.

126. Ms Waterhouse also was at pains to point out that delay in her receiving the DFSA’s response to the SAR had an adverse practical impact on her because she was having to get on with the FMT proceedings at the same time. She added that when she received a response from the DFSA it came not from the DFSA’s data protection officer but from DFSA Enforcement and she was surprised that no witness statement from the DFSA data protection officer had been served in these proceedings.

127. At the conclusion of the hearing the Court gave Ms Waterhouse leave to serve copies of documents evidencing applications for the disclosure of documents in the FMT proceedings and the DFSA’s and the FMT’s responses thereto within 16 days, and the DFSA was given leave to provide copies of transcripts of the FMT proceedings that covered questions of disclosure and to serve a response to Ms Waterhouse’s documents within 10 days after receipt of Ms Waterhouse’s documents. Ms Waterhouse was also given leave to reply to the submissions made by the DFSA on the documents she provided after the hearing.

128. The documents provided by Ms Waterhouse after the hearing covered both the period when she was contesting the decision that the DMC was proposing to make (10 January 2016 to 22 June 2017) and the period of the FMT proceedings (23 July 2017 to 31 January 2019 [the date of the last hearing]). Included in the documents created in the first period was correspondence between Ms Waterhouse’s counsel, Mr Christopher Sallon QC, and the DFSA in which Mr Sallon expressed the view that the DFSA should disclose documents constituting “unused material” that in the opinion of the DFSA might undermine its case or support Ms Waterhouse’s case in the like manner that the Financial Conduct Authority was obliged to do under section 394 of the UK Financial Services and Markets Act 2000 (the “FSMA”). In reply, the DFSA pointed out that the Regulatory Law contained no equivalent to s. 394 of the FSMA and stated that its disclosure obligation was limited under Schedule 3 of the Regulatory Law to providing the documents that were provided to the DMC. When dealing with disclosure in its written submissions to the DMC, the DFSA, cited Schedule 3 of the Regulatory Law and submitted that there was no requirement to disclose material which might undermine the DFSA’s case or assist Ms Waterhouse’s case. Rather, the process of allowing Ms Waterhouse to make representations on the proposed action was sufficient and appropriate to ensure the DMC was provided with all material information that was required for the DMC to make the relevant decision including that which, in Ms Waterhouse’s view, might undermine the allegations.

129. In reply to this submission, Mr Sallon argued that, inter alia, the DFSA’s position was contrary to the burden of proof, unrealistically required Ms Waterhouse to identify material known to the DFSA and encouraged Enforcement to suppress material in its possession which could undermine its case or assist the affected person.

130. The documents provided by Ms Waterhouse relating to the FMT proceedings included: (i) her request for a copy of the Deloitte Skilled Persons Report and the provision of this report by the DFSA; (ii) her request dated 22 September 2027 for a copy of the Decision Notice against Mr Chetan Palmar and the settlement agreement between the DFSA and DB and the provision of the former report on 24 September 2017 and the refusal to provide the latter document on the ground this document had not been provided to the DMC and thus had had no bearing on the DMC’s decision; (iii) Ms Waterhouse’s Statement of Case in the FMT proceedings dated 8 October 2017 in which she pleaded that not all relevant disclosures had been made and additional disclosure should be made in respect of various exculpatory interviews with relevant individuals, the note of the meeting with, inter alios, Mr Steven Glynn and Mr Plews, all internal DFSA meeting notes, correspondence and memos about the investigation concerning herself and notes of meetings and correspondence between the DFSA, DB, Clifford Chance and Freshfields concerning that investigation; (iv) her letter dated 23 December 2017 containing an extensive disclosure request dated 23 January 2017 that is referred to in considerable detail in paragraph 74 above; (v) the DFSA’s letter to Ms Waterhouse and her counsel, Mr Wright, dated 22 February 2018, providing a link to be used to download further disclosure being made by the DFSA following a disclosure review subsequent to a CMC in January 2018; and (vi) a letter dated 2 April 2018 sent to Mrs Waterhouse by the DFSA’s head of legal affairs providing correspondence between Ms Serene El-Masri and Mr Ashok Aram between 2011 and 2013.

131. In her submissions dated 23 February 2020 responding to the DFSA’s post hearing submissions dated 15 January 2020, Ms Waterhouse rejected the DFSA’s criticism of her post hearing disclosure maintaining that she understood that she had leave only to provide documents showing her disclosure applications. She rejected the criticism that she was trying to re-litigate the FMT process and endorsed the Commissioner’s submissions dated 14 February 2020. She submitted in addition that certain documents that had been disclosed by the DFSA referred to other documents that also should have, but had not, been disclosed.

Discussion and decision

132. The issue in the appeal is whether the Commissioner’s finding that the DFSA contravened the DPL in refusing to produce any of the personal data Ms Waterhouse sought in the SAR should stand or be set aside.

133. In consequence of the appeal being a de novo proceeding, the DFSA do not have to challenge any particular aspects of the Commissioner’s reasoning other than his conclusion that the DFSA contravened the DPL; and neither side is restricted to the contentions or the evidence it presented in the proceedings heard by the Commissioner. Evidence as to events occurring after the date of the Commissioner’s decision (20 June 2018) must be relevant to the state of affairs existing at that date, although I regard it as legitimate and appropriate to have regard to evidence of subsequent events when stepping back to look at matters in the round when coming to a final view on the issue of proportionality.

The Article 39 exemption (Ground 3)

134. The broad categories of information arising out of the investigation into Ms Waterhouse and the DMC and FMT proceedings that were identified by the DFSA at the hearing as being relevant to this ground of appeal were: (1) Information sought from third parties and/or information received by the DFSA from third parties. (2) Information contained in documents that reveal the internal thinking of the DFSA as the investigation proceeded and the DMC and FMT regulatory proceedings were continuing. (3) Information that is “neither here nor there” i.e. not sensitive or confidential.

135. It is for the DFSA to establish that it is entitled to be exempted from providing the information sought by Ms Waterhouse in accordance with the terms of Article 39 (2) (see Lord at [94]). In my judgment, this means that the DFSA must satisfy the Court that if Article 17 were to apply to the SAR the disclosure of each of the above categories would very well prejudice the proper discharge of the DFSA’s powers and functions under the Regulatory Law, without necessarily reaching the threshold of “more probable or not” (see Lord at [97]).

136. These categories of information are held in part electronically and in part in 280 lever arch files that are not ordered by reference to individuals who were the subject of the investigation involving Ms Waterhouse. Some only of these files could be excluded as not containing Ms Waterhouse’s personal data but all the others would have to be scrutinised to see if they contained information within the terms of the SAR. I reject Mr Russell’s submission that all the DFSA had to do to make available one significant part of the information required by the SAR, was to look at its outgoing correspondence to see which items referred to Ms Waterhouse and what of her personal data they included. As well as looking at the outgoing correspondence, the DFSA would have had to look at its incoming and internal correspondence because that might include material that indicated that personal data had been disclosed otherwise than in writing, for example in oral meetings or over the telephone.

137. As noted above, the DFSA submits that the scrutiny of the information it holds as a result of its investigation into Ms Waterhouse and the regulatory proceedings against her that would be necessary to comply with the SAR would involve the very heavy use of manpower and financial resources which would seriously impede the efficient discharge of its powers and functions both generally and in respect of its continuing involvement in the FMT proceedings initiated by Ms Waterhouse. As already noted above, the different estimates of the costs for outside firms to scrutinise the information held by the DFSA relating to Ms Waterhouse are: US$ 500,000 – US $800,000 (Mr Hammond’s estimate); US$ 300,000 + AED 15,700 (Deloitte); and Ankura’s estimate: US$90,000 – US$102,500 (on-site), US$120,000 – US$153,000 (off-site).

138. The DFSA further argues that if it had to provide the information required by Ms Waterhouse this would get into the public domain and others whom the DFSA investigates would issue SARs in attempts to distract and frustrate the investigations in which they were involved.

139. In addition to the general contentions related in paragraphs 137 and 138 above, the DFSA submits that: (a) the disclosure of information in category (1) would involve revealing the sources of the information in question and this would impede the gathering of information from third parties in the course of investigations as deposed to by Mr Meaney in his witness statement; and (b) the information within category (2) is highly confidential and its disclosure would inhibit those involved in investigations from expressing and recording views as an investigation progresses which would be very detrimental to the investigation process.

140. In my judgment, it would be likely that if the information within categories (1) and (2) were disclosed pursuant to the SAR, the proper discharge of the DFSA’s powers and functions under the Regulatory Law would be prejudiced for the reasons contended for by the DFSA. The disclosure would have the “chilling effect” referred to by Haddon-Cave J in Zaw Lin [104] – [106].

141. However, for two reasons, I do not find that the powers and functions of the DFSA would be likely prejudiced if the information within category (3) were disclosed pursuant to the SAR. Firstly, I am not satisfied that it is likely that disclosure of this category of information would likely lead to others who are being investigated by the DFSA to use SARs for the collateral purpose of harassing and distracting the DFSA. Secondly, I do not think it likely that if the DFSA had to carry out the necessary scrutiny of all its information relating to Ms Waterhouse in order to determine which information is within which category, the DFSA’s powers and functions under the Regulatory Law would be prejudiced. In my view, the use of DFSA personnel to carry out the necessary scrutiny could be avoided by engaging an outside agency to conduct the necessary scrutiny and, doing the best I can, having reviewed the costs estimates put before the Court, I find that the money required would likely be of the order of US$250,000. Would having to find this sum likely prejudice the DFSA in the discharge of its functions? In my judgment, it would not. In the first instance, the money would be met from the DFSA’s budget and to the extent necessary it would be met by additional funds provided by the Dubai Government. It is unthinkable in my opinion that the Government of Dubai would not provide the necessary additional funds when to refuse to do so would leave the DFSA, a vital DIFC body, in plain breach of the DPL.

142. For these reasons, this ground of appeal succeeds only to the extent of the information contained in categories (1) and (2) which is an insufficient outcome for the setting aside of the Commissioner’s finding that the DFSA was in contravention of the DPL.

Proportionality and Article 17 (Ground 5)

143. In my judgment, a data subject’s right to access to his or her personal data under Article 17 DPL is subject to the doctrine of proportionality. This is so for two reasons. First, proportionality is expressly incorporated into Article 17 DPL by the words “at reasonable intervals and without excessive delay or expense” in the opening sentence. I reject Mr Russell’s submission that these words are there simply to give effect to sections 7(2) and 7(8) of the DPA. As Mr Pitt-Payne submitted, the reference to “expense” cannot be a reference to a cost to the data subject because, unlike the DPA, the DPL makes no provision that allows a data controller to charge a data subject.

144. Secondly, I agree with Lewison LJ’s view in Ittihadieh that the implied obligation to search for personal data in response to a SAR is limited to a reasonable and proportionate search for the first three reasons he gives for reaching this conclusion, namely: (i) the indications in recitals (15) and (27) of the European Directive that the EU legislature did not intend to impose excessive burdens on data controllers; (ii) the application of the principle of proportionality by the ECJ in Rotterdam v Rijkeboer [Case C-553/07] as to the time limits for the retention of data; (iii) the fact that proportionality is a general principle of European law, see Omega Air Ltd v Secretary of State for the Environment [2002][ ECR 1-2569. I accept Mr Pitt-Payne’s contention that in modelling the DPL on the DPA, which in turn was the product of the European Directive, it was intended that the DPL should march in step not only with UK law but also with EU law. As Mr Pitt-Payne pointed out, the first DIFC Data Protection Law enacted in 2004 contains in Schedule 2 a list of pronouncements that were taken into account in the Law’s drafting and included in this list is the European Directive.

145. In Ittihadieh, Lewison LJ applied the doctrine of proportionality in the context of exercising the discretion conferred on a court by section 7 (9) DPA but what he had to say on proportionality is also applicable to this ground of appeal. I agree with his observation in [108] that a balance has to be struck between the prima facie right of the data subject to have access to his or her personal data on the one hand, and the interests of the data controller on the other. I also note that amongst the relevant factors in this balancing assessment that Lewison LJ identifies in [110] are: (1) whether there is a more appropriate route to obtaining the requested information, such as by disclosure in legal proceedings; and (2) the reason for having made the SAR. In regard to the second factor, Lewison LJ said:

While the absence of a stated reason does not in itself invalidate the SAR, the absence of a legitimate reason has a bearing on the exercise of the court’s discretion (DB v The General Medical Council at [59]) even though a collateral purpose of assisting in litigation is not an absolute bar: Dawson-Damer at [112]. … Whether the real quest is for documents rather than personal data is also relevant … Dawson-Damer at [77] confirms that the “potential benefit” to the data subject is relevant to the question whether a proportionate search has been carried out and, by parity of reasoning, the same must be true of the court’s exercise of its discretion …

146. In Ittihadieh at [100], Lewison LJ, adopting the observations of Arden LJ in Dawson-Damer, expressed the view that proportionality cannot justify a blanket refusal to comply with a SAR. With respect, I do not accept this conclusion if it was intended to lay down a hard and fast rule regardless of the particular circumstances of the case. In my judgment, it is inherent in the concept of proportionality and the balancing exercise it involves that there may be exceptional cases where an outright refusal can be justified on proportionality grounds.

147. It is beyond argument that Ms Waterhouse’s principal and overriding purpose in issuing the SAR was and remains to obtain information contained in documents stored by the DFSA that assists her case in the FMT proceedings.

148. I agree with Lewison LJ’s observation in Ittihadieh at [82] that the underlying purpose of the right to personal data is for the data subject to check the accuracy of the data and to see that they are being processed lawfully. Despite this being the underlying purpose of the right, it has been held in England that the fact a data subject may have a purpose collateral to the purpose of checking his or her personal data for its accuracy does not necessarily mean that he or she loses the prima facie right to be provided with his or her personal data. Thus, if a data subject wants to check the accuracy of his personal data held by a data controller, it has been held that the fact that he or she also wishes to use the information to obtain documents relevant to litigation does not of itself mean that it would be disproportionate to enforce the data subject’s prima facie right conferred by Article 7 DPA¹¹ . However, this does not mean, in my view, that the real, predominant purpose of the issuance of a SAR cannot be taken into account in appropriate circumstances when the question of proportionality is being considered generally, as it is in this case where the Court is concerned to weigh the practical impact on Ms Waterhouse of not having access to her personal data against the burden that would have to be borne by the DFSA if the SAR were enforced.

11 Ittihadieh [86]

149. Vital to the weighing process at the heart of the DFSA’s proportionality argument is the extent of the duty on the DFSA to give discovery of documents in the FMT proceedings. In the course of the second day of the hearing Mr Russell agreed with my suggestion that the disclosure obligations prescribed in Schedule 3 to the Regulatory Law should be treated as a statutory minimum over and above which there rested a duty on the DFSA to conduct regulatory proceedings fairly which would require it to disclose any information which would be of assistance to the interested party. Later, Mr Pitt-Payne told the Court that the DFSA accepted that it was under an implied duty as a matter of procedural fairness to make sure that it disclosed to Ms Waterhouse what she needed to know in order for the proceedings to be fair.

150. As noted above, relying on the DFSA’s refusal in the course of the DMC proceedings to accept Mr Sallon QC’s contention that the DFSA was obliged to disclose any material that might undermine its case or support Ms Waterhouse’s, Mr Russell contended in the Commissioner’s post hearing submissions that this refusal indicated the actual approach of the DFSA to discovery which meant that Ms Waterhouse did not know whether the DFSA retained material helpful to her defence which had not been disclosed.

151. With respect, I decline to accept Mr Russell’s argument because it relies simply on the position taken by the DFSA in the DMC proceedings and ignores the fact that the FMT proceedings were wholly distinct from the earlier proceedings, being in effect a de novo hearing of the process that led to the Decision Notice¹², and were the proceedings in respect of which Ms Waterhouse issued the SAR. Indeed, when dealing with the DFSA’s discovery obligations at the hearing, Mr Pitt-Payne was careful to distinguish between the DMC proceedings and the FMT proceedings. As to the latter, Mr Pitt-Payne pointed out that under Article 31 (5) (d) of the Regulatory Law, the FMT can require a person to give evidence and produce any item, record or document in his possession. He also drew the Court’s attention to the relevant parts of Rules 41 and 42 of the FMT Rules that provide:

12 See para 16 of the FMT Decision

152. In my judgment it is plain on the documents before the Court in respect of the FMT proceedings exhibited by Mr Lake and produced post hearing by the DFSA and Ms Waterhouse that the FMT, the DFSA and Ms Waterhouse all proceeded on the basis that the DFSA’s discovery obligation was effectively the equivalent of the obligation laid down in Compagnie Financière v Peruvian Guano [1882] 11 QBD 55 at 63, namely, to disclose documents that related to the matters in question which contained information which may directly or indirectly enable the opposing party to advance his or her own case or to damage the case of his or her adversary.

153. In seeking to achieve her principal and predominant purpose by issuing the SAR, Ms Waterhouse is seeking to oblige the DFSA to scrutinise essentially all of the information it has gathered in the period 1 October 2011 to 2 August 2017 that related to herself, when at the same time the DFSA was and had been under a duty in the lead up to the DMC Decision Notice to disclose all relevant documents whether in paper of electronic form that were relevant to the regulatory offences the DFSA alleged against her.

154. I am in no doubt that the task of scrutinising the information held by the DFSA to determine what of Ms Waterhouse’s personal data it had acquired in the period 1 October 2011 to 2 August 2017 would be an extremely onerous one in terms of manpower and particularly money. This is amply borne out by Mr Hammond’s report exhibited to Mr Meaney’s witness statement and, as I have already concluded, if the scrutiny were to be done by a private contractor the cost would likely be of the order of US$250,000, which on any view is a large sum of money. Even if a private contractor were engaged, there would still have to be the involvement of already busy DFSA officials in supervising the contractor’s work and making the ultimate decision as to what information falls within which category: (1), (2) or (3).

155. I turn to ask myself what would be the practical impact on Ms Waterhouse if the DFSA was relieved of the obligation of doing the work and spending the money to comply with the SAR. As I have already observed, at the same time as the DFSA was being requested to comply with the SAR it was under a duty to disclose all documents that assisted Ms Waterhouse or undermined its own case whether in paper or electronic form that were relevant to in the FMT proceedings. This duty of disclosure was an aspect of the overall implied duty that lay on the DFSA to conduct the investigation into Ms Waterhouse fairly. Unlike in prosecutions brought to trial in the UK, where the practice is that a police officer or a team of officers is appointed with the sole task of ensuring that all proper disclosure is made to the defendant, the DFSA officials with overall responsibility for disclosure were always likely to be and in fact were the DFSA’s lead investigator, Mr Adrian Block, who gave evidence in the FMT proceedings and was found to be an entirely straightforward and honest witness and, in addition, a member of the DFSA’s legal team, who turned out to be Mr Lake.

156. It was also foreseeable as at 10 August 2017 and at all times during the proceedings before the Commissioner that, as happened, the DFSA would be represented by experienced and responsible counsel¹³ who would well appreciate the duty on the DFSA to disclose relevant documents and that Ms Waterhouse would have access to legal advice and representation at different times during the FMT proceedings. In addition, it was clearly foreseeable, again as turned out to be the case, that it would be open to Ms Waterhouse to apply to the FMT for orders for disclosure of specified classes or particular documents. Thus, whilst Ms Waterhouse represented herself for parts of the FMT proceedings, she was represented by counsel on a number of occasions who advised her on disclosure, mounted applications for disclosure and also made detailed submissions in support of Ms Waterhouse’s case.

157. In my judgment, given the matters referred to in paragraphs 155 and 156 above, it was well foreseeable at the time both when the DFSA rejected the SAR and when the Commissioner made his Decision that the chances that a piece of personal data helpful to Ms Waterhouse’s case would not be disclosed in the course of the FMT proceedings but would be disclosed if the SAR were given effect to were extremely remote.

158. This conclusion is in accord with the evidence as to how disclosure was in fact dealt with by the DFSA and the FMT in the period subsequent to 10 August 2017 deposed to Mr Lake and contained in the additional documents provided post hearing by the DFSA and Ms Waterhouse. The clear picture that emerges from all this material is that on occasion the DFSA provided disclosure of its own motion without being faced with an application by Ms Waterhouse and that Ms Waterhouse made numbers of requests for documents some of which were met and several of which were justifiably declined on the ground that they went to peripheral matters and were simply not relevant. Ms Waterhouse also complained to the FMT about non-disclosure of documents and on occasion applied for disclosure orders.

13 Mr Andrew George QC and Mr Tom Cleaver.

159. As noted in paragraphs 78 and 80 above, on 2 October 2018, Ms Waterhouse requested the FMT not to conclude the present proceedings until the outcome of the cases now before the Court.

160. Responding to the application, the DFSA observed that there was no suggestion of missing documents relevant to the real issues in the October 2018 hearing or in closing submissions submitted to the FMT.

161. The FMT’s decision given on 15 May 2019 on Ms Waterhouse’s application was in the following terms:

162. In my judgment, when, in light of the process of disclosure to which the DFSA was subject under the supervision of the FMT, one weighs the real interest that Ms Waterhouse had in seeking to enforce her prima facie right under Article 17 against the very heavy burden that would have fallen on the DFSA if it had to comply with the SAR, it would be grossly disproportionate to order the DFSA to comply with the SAR. It follows that the DFSA succeeds on Ground 5 and that the Commissioner’s Decision should be set aside.

Nature of the Request: documents, not information (Ground 1)

163. I reject this ground of appeal. In my opinion, whether a request expressed to be a SAR made under Article 17 DPL is a request for personal data for the purposes of that Article depends on wording of the request. Looking at Ms Waterhouse’s SAR, I conclude for the textual grounds advanced by the Commissioner that it is a request within the Article and not a request for documents which would be outwith the Article. The fact that Ms Waterhouse may have contemplated, or indeed desired, that her request would be met by the provision of copies of documents is neither here nor there.

Preconditions for making a complaint (Ground 4)

164. This ground of appeal I also reject.

165. I agree with Mr Russell’s submission that the proceedings before the Commissioner were proceedings sanctioned by Article 33 and not Article 34, notwithstanding that the Commissioner appears to have thought the opposite to be the case. It is true that in her letter to the Commissioner dated 14 November 2017 Ms Waterhouse asked both for an investigation under Article 33 and complained under Article 34, but I am satisfied that on its proper construction Article 34 contemplates a complaint that will be considered within mediation proceedings and this was not the nature of the action taken by the Commissioner who undoubtedly conducted an investigation.

166. Even if the proceedings conducted by the Commissioner included a consideration of a complaint under Article 34 and was therefore not exclusively an investigation under Article 33, I reject the DFSA’s argument that Ms Waterhouse was not adversely affected by the DFSA’s refusal to comply with the SAR because her purpose was to obtain documents. As I have held, Ms Waterhouse’s principal and predominant purpose in issuing the SAR was indeed to obtain documents but the means by which she hoped to achieve this was through the SAR and accordingly, when the DFSA refused to comply with the SAR, it cannot be gainsaid that she believed on reasonable grounds that she had been adversely affected by what she believed to be a contravention of the Law as regards the exercise of her Article 17 rights.

The DFSA’s paper records (Ground 6)

167. The Court was not asked to decide for itself whether the paper records were a relevant filing system. This is because this ground of appeal asserts that the Commissioner made an error of law in declining to decide for himself whether the paper records were or were not a relevant filing system and in consequence the entirety of his decision that the DFSA contravened the DPL is vitiated and must be set aside.

168. In my judgment, in light of the fact that: (i) the issue before the Commissioner was whether the DFSA’s refusal to comply with the SAR for the reasons given in its letter of 10 August 2017 constituted a breach of the DPL; and (ii) the DFSA only raised the relevant filing system issue when serving its clarificatory submissions, those submissions having been sought by the Commissioner for clarification of the DFSA’s case based on Article 39 (2) DPL, I do not think the Commissioner can be faulted for the approach he took. This ground of appeal is therefore rejected.

The DFSA’s judicial review case

169. The DFSA’s judicial review case is predicated on the dismissal of its appeal. Given my decision to allow the appeal it is not necessary to determine the judicial review application and I have decided not to extend this already very long judgment by doing so.

Conclusion

170. For the reasons given above, the DFSA’s appeal is allowed and the Commissioner’s Decision dated 20 June 2018 is set aside.

Post Script

171. With the agreement of all three parties to the Appeal, this judgment replaces the judgment issued in these proceedings on 1 June 2020 (the “First Judgment”). Following the issue of the First Judgment it emerged that by a regrettable oversight on my part it had been written in ignorance of the post hearing submissions of the Commissioner dated 14 February 2020 and Ms Waterhouse dated 23 February 2020 (the “Missed Submissions”). Having been informed of the situation, the DFSA, the Commissioner and Ms Waterhouse accepted the Court’s proposal that the First Judgment should be treated as a draft judgment and the Court’s treatment of the DFSA’s proportionality ground of appeal in paragraphs 132 – 142 and 155 in that judgment should be revisited in a replacement judgment written in the light of the Missed Submissions which would be assessed against all the evidential material that was put before the Court for the hearing and provided afterwards down to 24 February 2020, plus the transcript of the hearing.

Issued by:
Nour Hineidi
Deputy Registrar
Date of issue: 12 August 2020
At: 10.00am