High Court makes first decision on the ‘judicial exemption’ to subject access rights in UK GDPR and Data Protection Act 2018

The High Court decision of X v The Transcription Agency (1), Master James (2) [09.05.2023] is the first detailed consideration of the scope of the judicial exemption to the right to access to personal data under the UK GDPR (General Data Protection Regulation) and Data Protection Act 2018 (the DPA 2018). As such, it is of interest to all data protection practitioners.

The decision also provides a useful guide to court procedure to be adopted when considering withheld material and the timing of responses to Data Subject Access Requests (DSAR).

Background

The claimant brought proceedings against the first defendant (a provider of court transcription services) and Master James (a costs judge) for disclosure of his personal data pursuant to Article 15 of the DPA 2018.

The proceedings were defended primarily on the basis that the data was exempt from disclosure under the judicial exemption found in paragraph 14 of Part 2 of Schedule 2 to the DPA 2018. The judicial exemption excludes, from the scope of data protection, information processed by an individual or a court or tribunal acting in its judicial capacity.

Decision

Farbey J considered the scope of the judicial exemption and held that the tasks undertaken by Master James in relation to the production of transcripts of proceedings, and the data processed for the purposes of those tasks, are judicial tasks performed as part of a judge’s judicial functions.

She also held that the scope of the judicial exemption was wide and was apt to encompass all judicial functions. On the facts, the withheld material was covered by the judicial exemption and was not disclosable to the claimant.

Farbey J further conducted a careful analysis of the procedure to be adopted in relation to withheld material to ensure a fair balance of the parties’ respective rights. As part of this analysis, she noted that there was “no explained reason” for the omission from the DPA 2018 of an equivalent provision to section 15(2) DPA 1998 which permitted the court to consider the data and determine whether an exemption applied without the data subject being present.

The Judge concluded that it would defeat the purpose of the legislation if a data subject could have sight of the withheld material to challenge the application of an exemption.

This aspect of the judgment will be of general relevance to many disputes under the DPA 2018/UK GDPR.

Farbey J established that both defendants could rely on the judicial exemption on the grounds that Master James was acting in a judicial capacity. Additionally, the first defendant was a data processor in any event.

In relation to the timing of a DSAR response, Farbey J adopted the approach that the one month period for responding to a DSAR ends on the corresponding calendar date of the next month. The Judge considered that Master James could not respond to a DSAR before she was in physical possession of the request (which was addressed to her personally). Further, the claimant failed to prove that Master James had responded outside the one month period.

Comment

This decision arrives as the Data Protection and Digital information (No.2) Bill continues its Parliamentary journey. The proposed Bill is intended to:

• Unlock £4.7 million in savings.
• Remove pointless paperwork.
• Be easier to understand, easier comply with whilst ensuring that the new regime maintains data adequacy with the EU.

Nonetheless, the Bill in its present form does not overhaul the current data protection regime and the UK government claims to recognise the need to preserve data adequacy with the EU.

John Lambert and Beth Ashton of Kennedys acted for the successful first defendant. Dan Stacey of Hailsham Chambers acted as counsel.

Related item: Data Protection and Digital Information Bill: briefing note