Legal Professional Privilege and the Data Protection Bill 2018

PUBLISHED: 13th February 2018

This article will explore the impact of the Data Protection Bill 2018 on legal professional privilege in Ireland.

The Data Protection Bill 2018, published on 1 February, will implement, or give further effect to, the General Data Protection Regulation (GDPR) and the related Directive in Irish law.  It will also replace the Data Protection Commissioner with a body to be known as the Data Protection Commission (DPC).

The Bill introduces greater investigative powers for authorised officers of the DPC.  However, these powers – for example the power to take documents and records from data controllers/processors – will still be subject to legal privilege.  

A draft version of this Bill, known as the “General Scheme” was published in May 2017 and the provisions relating to legal privilege that were in the General Scheme have not been changed.

Protection of privileged material

The Bill provides that specified rights of data subjects, and obligations of data controllers, under the GDPR will not apply to the circumstances listed below.

1. Personal data that is processed for the purpose of seeking, receiving or giving legal advice (i.e. legal advice privilege).
2. Personal data in respect of which a claim of privilege could be made for the purpose of or in the course of legal proceedings, including personal data consisting of communications between a client and his or her legal advisers or between those advisers (i.e. litigation privilege).
3. Where the exercise of such rights or performance of such obligations would constitute a contempt of court.

The explanatory note to the General Scheme stated that these exclusions are intended "to protect legal privilege to the extent necessary and proportionate in a democratic society."  This is an important acknowledgement of the need to ensure that certain communications are not disclosed unless absolutely necessary.  It reflects the principle enshrined in Recital 4 of the GDPR itself, which flags that the right to the protection of personal data is “not an absolute right” and must be balanced against other fundamental rights. 

It will be of comfort to clients who receive data access requests to know that privileged communications will not have to be produced to a data subject.  Of course, such communications will still have to satisfy the stringent tests applicable to both legal advice privilege and litigation privilege.  Given that claims to privilege are increasingly challenged before the courts in the context of discovery exercises in court proceedings, we expect that claims to privilege in relation to personal data will be contested just as often.

DPC right to apply to High Court

The Bill allows for the fact that a data controller or data processor may refuse to produce information to the DPC, or provide access to it, on the grounds that the information contains privileged legal material.  In such cases, the DPC or an authorised officer may apply to the High Court for a determination as to whether the information is privileged legal material.  In making this court application, the DPC or authorised officer must have reasonable grounds for believing the information does not contain privileged material, and reasonable grounds to suspect the information contains evidence relating to an infringement of the GDPR.

UK Bill

Under the equivalent UK draft legislation, the Data Protection Bill, there will be (if the Bill becomes law there) an obligation on the UK equivalent of the DPC to produce and publish guidance around how privilege may affect that office in the carrying on of its functions.  That guidance is subject to consultation with the Secretary of State and must be laid before Parliament.  The Bill also defines both “privileged communications” and “legal advice privilege”, a point of contrast with the Irish Bill.

Appointment of independent legally qualified person

The ability to challenge claims to privilege through the courts is not new, and LK Shields has acted and advised in relation to many such challenges.  However, a new development introduced by the General Scheme and reflected in the Bill is the court’s ability to appoint an independent, legally qualified person to assist it with challenges to claims to privilege.  

The Bill provides that the High Court may give directions regarding the appointment of a “person with suitable legal qualifications possessing the level of experience and independence from any interest falling to be determined between the parties concerned” to examine the information and prepare a report for the court to assist it in determining whether the information is privileged legal material.

Conclusion

It is not yet clear whether the courts will appoint solicitors or barristers to carry out such tasks and it remains to be seen how widely this provision will be used.  What is clear, is that the legislature acknowledges that the issue of legal professional privilege will continue to be an important one in the era of GDPR.