gdpr england-and-wales civil-procedure subject-access-request pre-action-protocol
SAR before claim: tactical and legal considerations
<p>A claimant C intends to sue a business B, which is also a data controller. Independently of the prospect of any civil action, C is entitled to make a SAR (Subject Access Request) to B under the Data Protection Act 2018, and may be tempted to do so in order to have all available information at his disposal for maximum perspective and advantage in proceedings.</p>
<p>Is there any way in which a SAR to a data controller with whom one has had no dealings for some years could disadvantage C in subsequent proceedings? For example, could either B or a judge draw any inference from C’s decision to submit a SAR?</p>

<p>I can't comment on tactical considerations, but legally there is nothing preventing submitting a Subject Access Request to support litigation.</p>
<p>The case law has developed (and been somewhat inconsistent) over the years, culminating with the &quot;no other purpose&quot; rule being clarified by the Court of Appeal in <a href="http://www.bailii.org/ew/cases/EWCA/Civ/2017/74.html" rel="nofollow noreferrer">Dawson-Damer v. Taylor Wessing LLP, [2017] EWCA Civ 74</a> by saying that...</p>
<blockquote>
<p>...<strong>a SAR would not be invalid if it had been made with the collateral purpose of assisting with litigation.</strong> Delivering the leading judgment, Arden LJ noted (at paragraph 107) that the EC Data Protection Directive “makes it clear that the rights given by the Directive are to protect fundamental rights conferred by EU law. We have been shown nothing in the DPA or the Directive which limits the purpose for which a data subject may request his data, or provides data controllers with the option of not providing data based solely on the requester’s purpose”.</p>
<p><a href="https://www.stewartslaw.com/news/litigators-guide-galaxy-subject-access-requests/" rel="nofollow noreferrer"><em>Source</em></a> <em>and further reading</em></p>
</blockquote>
