The Office of the Data Protection Authority found that Collas Crill broke the law by refusing to release a gift letter, written and signed by the complainant, after a subject access request in July last year.
‘Exemptions, including legal privilege, must be considered carefully and applied properly,’ said data protection commissioner Brent Homan.
‘They should not be used in a way that unnecessarily frustrates an individual’s right of access.’
The complainant had given money to clients of the firm towards a property purchase but did not keep a copy of the gift letter, which was addressed to the clients’ bank for the mortgage process. The clients passed the letter to Collas Crill, which certified a copy in June 2023.
A dispute, which is now going through the civil courts, later arose between the complainant and the clients over the money.
When the complainant asked for the letter, Collas Crill supplied only their name, address, bank details and email address. It later told the complainant's representative that it was only required to provide information, not documents.
It was not until October last year, after the authority became involved, that the firm said the letter was legally privileged and that releasing it would disclose its clients’ personal data.
The authority rejected both arguments. It pointed to the firm’s own emails, which said it ‘did not facilitate or act in any way’ in relation to the letter and had received it only to confirm the source of the funds.
It described the firm’s handling of privilege as ‘concerning and aggravated by the fact they are a law firm’. It added that the company’s shifting position on how much of the letter it would release undermined its claims of confidentiality.
The letter was almost entirely the complainant’s own personal data, with minimal, non-sensitive information about the clients, the authority found.
The ODPA has warned that privilege does not automatically apply to documents simply because they have been given to a lawyer.
‘Access to one’s personal information is a foundational data protection right, and organisations should ensure that openness and transparency are core considerations when handling any access request,’ he said.
Collas Crill did not object to the sanction. The enforcement order required the firm to give the complainant a redacted copy of the letter within seven days and confirm to the authority that it has done so.
You need to be logged in to comment.