Erring on side of caution not always right thing to do – Steven Smart

Ignoring a court order on releasing data could be costly, says Steven Smart

Steven Smart is a Partner, Horwich Farrelly.

The introduction of laws tightening regulation of the processing of data, coupled with the significant penalties imposed for breaches, have rendered it inevitable that many choose to err on the side of caution when asked to provide information. Fines of nearly 70 million euros levied throughout Europe in 2020 to date and record-breaking penalties of 315 million euros proposed against two companies in the UK illustrate how costly mistakes can be.

Is it possible, however, to be too cautious? If so, what might the consequences be? What should one do in Scotland if a “Specification of Documents” is received requiring the production of sensitive or confidential data? These issues arose in a Glasgow Sheriff Court judgment published recently

A mother sought to recover social work records for her two children from a local authority. She initially made a subject access request one month before proof. Having not received the records, a court order was obtained on the evening before proof for them to be produced, which they swiftly were.

Some of the documents were heavily redacted. Sheriff Cubie noted at least 39 instances of redaction which ranged from a few words to entire pages. He observed that a serious issue arose, as the actions of the local authority may amount to a contempt of court. The Court of Session had held that failure to provide a document which a court has ordered must be produced can constitute contempt. Sheriff Cubie considered that by extension, the adulteration or redaction of a document which it had been ordered must be produced may also constitute contempt.

This is not something to be taken lightly. Beyond the reputational concerns and potential impact of such a finding, the penalties applicable are up to two years imprisonment, a fine of up to level 4 on the standard scale (currently £2,500), or both. Sheriff Cubie therefore invited a senior officer from the relevant department of the local authority and a member of the legal services department to attend a hearing, so he could investigate the circumstances before making a determination.

Having listened to the concerns of the Sheriff, the local authority apologised unreservedly. An internal investigation had commenced immediately. The mother’s original subject access request sought records that contained data relating to other parties, including children. The local authority assessed that releasing the full records would have breached data protection laws. Redacted records were prepared to respond within the statutory timescale. This had been a time-consuming exercise. When the court order seeking recovery of the same documents was received, the already-redacted records were simply provided.

The local authority accepted this was wrong. They required to comply with the rules for production of documents under a court order, not a subject access request. Sheriff Cubie said the full unredacted records should have been lodged with the court in a confidential envelope. This would have allowed the court to maintain control of the procedure and be the final arbiter on issues including confidentiality or potential breach of data protection provisions.

It was also observed that any party complying with a court order will not fall foul of the General Data Protection Regulations by virtue of the exemption found in Article 6(1)(c), which provides a lawful basis for processing where it is necessary for compliance with a legal obligation.

Returning to the issue of contempt of court, Sheriff Cubie noted that it must be proved beyond reasonable doubt that the conduct involved was wilful and showed a disregard or lack of respect for the court. In light of the explanation provided, he was satisfied that the incorrect actions taken were a genuine error and did not constitute contempt.

Although data protection responsibilities are paramount, a working knowledge of the procedures applicable (depending upon the basis for the request, or as in this case, order for information to be produced) is also required. Otherwise, an overabundance of caution as a blanket approach may result in a costly visit to court. A genuine error might be excused; a conscious decision to ignore the import of a court order might not.

Steven Smart is a Partner, Horwich Farrelly.