Legal professional privilege, the protection of confidential communications between a solicitor and their client, is a fundamental principle of English law. Privileged documentation does not need to be disclosed in response to a Data Subject Access Request.
Employers are finding that it is becoming common, in the early stages of a dispute with an employee, for the employee to request information from the employer under their GDPR rights of access to information. This request can be informal, in most situations a fee cannot be demanded, and the response is required without undue delay (in most situations within one month). Employers are finding the pressure on them to respond quickly, to numerous and sometimes complex requests, has increased. Further, the issue of legal professional privilege is not straightforward. At its simplest, if data held by an employer contains legal advice from solicitors to the business, which has not been widely circulated, this information is likely to be privileged (Advice Privilege). Also, if a claim has been, or is likely to be, made by the employee any communications or documents, whose dominant purpose is to defend a claim, are also privileged (Litigation Privilege).
This combination of speed and complexity can cause mistakes to be made.
So, what if privileged information is accidently shared?
The recent case of Kasongo v Humanscale UK Ltd considered the application of legal privilege when information is shared with former employees.
If a privileged document is disclosed a view may be taken that privilege has been waived in relation to that document. More worryingly still it is then open to the employee to argue that privilege is lost on other connected information, and the employer should disclose all the advice received, discussed or produced. The case confirmed the position that, if documents have been disclosed by mistake, it is open to the employer to argue that privilege has not been waived. However, if the information released looks like it has been deliberately selected the employer may be ordered to disclose all connected information to give a full picture of the situation or advice received. The courts emphasised the employer cannot “cherry pick” disclosed information. If privileged information is provided accidently, and a view is taken that the information gives a biased impression, a court may order that all the privileged information relating to the issue should be revealed.
The Solution
Employers need to be careful that, in their haste, they are not disclosing information which is privileged. Any information collated in relation to responding to the employee’s request should be carefully checked and privileged information removed or reference to it obscured.
If you have received a Data Subject Access Request from an employee and require assistance to ensure that you are not accidently “oversharing” information, please contact us to discuss how we can help.
