English High Court rules on data subjects’ right to know the identity of data recipients

On 7 June 2024, the High Court issued its judgment in the case of Harrison v Cameron & Another

In this case, the claimant hired the defendant to do some landscaping work on his property. A dispute arose, during which the defendant recorded phone calls, which they then shared with several individuals.

The claimant made a subject access request, asking for confirmation of the individuals with whom the recordings had been shared. The defendant refused on the basis that the recordings were purely personal and alternatively that sharing the names of the individuals would involve sharing personal data that they had not consented to share.

The court rejected the defendant’s claim that the recordings were purely personal in nature and held that under Article 15(1)(c) of UK GDPR, a data subject is entitled to know the identity of the recipients not merely the categories. This follows the reasoning in the ruling of the CJEU in RW v Osterreichische Post AG reported on in the DPO Digest last year. Being post Brexit, this case was not binding on the court, but the judge was entitled to have regard to it and did so.

However, the Court further acknowledged that controllers may withhold the identities of recipients who are individuals if disclosure would adversely affect the rights and interests of the individuals. The judge considered that in this case, to expose the identities of the individuals would put them at risk of harassment, intimidation, hostile legal correspondence and litigation in relation to the main dispute.

The court also found that the first defendant, the director of the second defendant, was not a controller as he was acting in his capacity as the director of the second defendant.

The full judgment can be found here.

If you are interested in advice on how to manage data subject rights requests in your organisation, please get in touch with your usual contact or email hello@hellodpo.com


Don't just take our word for it