england-and-wales gdpr data-ownership
Can legal/ pre-action correspondence with a business be subject to a SAR?
<p>Bob has been harmed by a business ACME inc. He sends them a letter before claiming damages as under the pre action protocol. They send him a reply.</p>
<p>Bob loses his copy of both of these articles of correspondence, but would like to refer back to them. Can he request them from ACME Inc. Under the DPA 2018?</p>

<p>Maybe not. <a href="https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-should-we-supply-information-to-the-requester/#format" rel="nofollow noreferrer">The ICO says</a> that</p>
<blockquote>
<p>The right of access enables individuals to obtain their personal data rather than giving them a right to see copies of documents containing their personal data.</p>
</blockquote>
<p>It might be valid to interpret the DPA / UKGDPR in a way that the relevant personal data undergoing processing in their system is the <em>existence</em> of the letters, but that you are not entitled to a <em>copy</em> of the letters. This is in line with the purpose of the right to access, that you can check what data they are processing about you and whether it is correct. If that argument holds and the data subject insists on receiving a copy of the letters, it might be legitimate to charge them a fee for these copies.</p>
<p>But in practice:</p>
<ul>
<li>The data controller might not make this argument and just hand over the copies. It is worth a try.</li>
<li>A right to access founded in data protection might not be the only way to receive a copy of these materials. If the letters are relevant for legal proceedings, they could perhaps be requested during the disclosure process.</li>
</ul>
