THE DUBAI FINANCIAL SERVICES AUTHORITY v THE COMMISSIONER OF DATA PROTECTION [2020] DIFC CFI 051 — Regulatory investigation and subject access request disclosure obligations (01 June 2020)

This judgment addresses the intersection of regulatory enforcement powers and individual data rights, specifically whether the Dubai Financial Services Authority (DFSA) must comply with a Subject Access Request (SAR) regarding documents generated during a disciplinary investigation into a former compliance officer.

How does the DFSA dispute the Commissioner of Data Protection’s ruling on Ms Anna Waterhouse’s Subject Access Request?

The dispute arises from the DFSA’s refusal to comply with a Subject Access Request (SAR) submitted by Ms Anna Waterhouse, a former Head of Legal & Compliance at Deutsche Bank. Following a lengthy investigation into regulatory breaches within the bank’s Private Wealth Management team, the DFSA issued a Decision Notice against Ms Waterhouse, imposing a US$100,000 penalty and a prohibition from performing financial services in the DIFC. Ms Waterhouse subsequently sought broader disclosure of the DFSA’s internal investigative files, leading to a decision by the Commissioner of Data Protection that the DFSA had contravened Article 17 of the Data Protection Law (DPL) by failing to fulfill the SAR.

The DFSA challenges this decision on the basis that its regulatory functions, established under the Regulatory Law, necessitate the protection of investigative materials. The authority argues that the disclosure of such files would prejudice its ability to conduct effective enforcement actions and maintain the integrity of its supervisory role. As noted in the court's framing of the parties' status:

It is common ground that Ms Waterhouse was a Data Subject and the DFSA was a Data Controller.

The case is currently before the court to determine if the Commissioner’s direction to the DFSA was legally sound or if the DFSA’s regulatory mandate provides a sufficient basis to withhold the requested data. Further details can be found at the DIFC Courts Judgment Portal.

Which judge presided over the DFSA v Commissioner of Data Protection proceedings in the Court of First Instance?

The proceedings, comprising both an appeal under Article 37(1) of the Data Protection Law and an application for judicial review, were heard before Justice Sir Richard Field in the DIFC Court of First Instance. The judgment, which outlines the background and legal framework of the dispute, was issued on 1 June 2020.

What specific legal arguments did the DFSA and the Commissioner of Data Protection advance regarding the scope of the SAR?

The DFSA contends that its investigative files are exempt from standard SAR obligations because the disclosure of such information would undermine its statutory duties under Article 7 of the Regulatory Law. The DFSA argues that the materials gathered during its investigation into Deutsche Bank and Ms Waterhouse are sensitive, and that the existing disclosure provided to Ms Waterhouse—which included the findings of the investigation and the materials relied upon by the Decision Making Committee—was sufficient. They maintain that the Commissioner’s order to provide further access is an overreach that threatens the efficacy of the DFSA’s enforcement arm.

Conversely, the Commissioner of Data Protection argues that the DFSA, as a Data Controller, is subject to the requirements of the DPL and that the SAR submitted by Ms Waterhouse is a valid exercise of her rights as a Data Subject. The Commissioner asserts that the DFSA has not demonstrated a valid legal exemption that would allow it to withhold the requested information, and that the regulatory nature of the DFSA does not grant it a blanket immunity from the transparency requirements imposed by the DPL.

What is the nature of the court's review of the Commissioner’s decision under Article 37(1) of the Data Protection Law?

The court is tasked with determining the extent to which the DFSA’s regulatory investigative files are subject to the disclosure requirements of the DPL. The legal question centers on whether the DFSA’s internal investigative processes are shielded from SARs by virtue of its regulatory mandate, or if the Commissioner of Data Protection has the authority to compel disclosure of these files. The court must balance the individual’s right to access personal data against the public interest in the DFSA’s ability to conduct confidential regulatory investigations. Regarding the nature of the appeal, the court noted:

It is common ground that the DFSA’s appeal to this Court against the Commissioner’s decision is in the nature of a de novo hearing.

How did Justice Sir Richard Field approach the interpretation of the Data Protection Law in the context of regulatory investigations?

Justice Sir Richard Field’s reasoning involves a careful examination of the statutory duties of the DFSA versus the rights of the individual under the DPL. The court is evaluating whether the DFSA’s investigative files constitute "personal data" that must be disclosed, or if they fall under specific exemptions related to regulatory functions. The court is also considering the precedent set by English law regarding the disclosure of investigative materials, particularly in cases where the data subject seeks to challenge regulatory findings. The court’s analysis is guided by the principle that while the DFSA has broad powers, these powers must be exercised within the framework of the DPL.

Which statutes and regulatory provisions are central to the court's analysis of the DFSA’s disclosure obligations?

The primary legislation governing this dispute is DIFC Law No. 1 of 2007 (The Data Protection Law), specifically Article 37(1), which provides the right of appeal against the Commissioner’s decisions. Additionally, the court is considering Article 7 of the Regulatory Law, which establishes the DFSA and defines its functions, including the prevention and detection of conduct damaging to the DIFC’s reputation. The court is also applying Part 42 of the Court Rules regarding the judicial review of the Commissioner’s directions.

How did the court utilize English case law to interpret the scope of Subject Access Requests?

The court referenced several English authorities to provide context for the interpretation of SARs in the context of regulatory and administrative investigations. These include R (On the Application of Alan Lord) v The Secretary of State for the Home Department [2003] EWHC 2073 (Admin), which dealt with the disclosure of Category A prisoner reports, and Durant v Financial Services Authority [2003] EWCA Civ 1746, which addressed the definition of personal data in the context of an FSA investigation. The court used these cases to illustrate the tension between the right to access information and the need for confidentiality in investigative processes. As noted in the court's review of Durant:

The data subject in this case (the claimant) sought disclosure from the FSA which at his request had investigated his complaint against Barclays Bank in the FSA’s supervisory role.

The court also highlighted the limitations of SARs in Durant, noting:

In response to the claimant’s s. 7(1) DPA request, the FSA disclosed copies of documents held in computerised form but it refused to disclose information held on manual files on the ground that it was neither “personal” nor “data” in the sense of forming part of a “relevant filing system”.

What is the current disposition of the proceedings between the DFSA and the Commissioner of Data Protection?

The document provided is an introductory judgment setting out the background and legal framework of the dispute. As of the date of this judgment, the court has not yet issued a final disposition or order regarding the merits of the appeal or the judicial review. The court has established the factual background and the legal issues at stake, but the final determination on whether the DFSA must comply with the SAR remains pending.

What are the wider implications of this case for DIFC-regulated entities and data protection compliance?

This case is significant for all DIFC-regulated entities, as it clarifies the extent to which regulatory investigative files are subject to the Data Protection Law. Practitioners should anticipate that the court’s final ruling will define the boundaries of the "regulatory exemption" when responding to SARs. If the court finds that the DFSA must disclose more information than it currently provides, it may force a shift in how regulatory bodies document their investigations and manage internal files. Conversely, if the court upholds the DFSA’s position, it will provide a clear precedent that regulatory investigative files are largely shielded from the standard disclosure requirements of the DPL, provided they are handled within the scope of the regulator's statutory functions.

Where can I read the full judgment in The Dubai Financial Services Authority v The Commissioner of Data Protection [2020] DIFC CFI 051?

The full judgment can be accessed via the DIFC Courts website: https://www.difccourts.ae/rules-decisions/judgments-orders/court-first-instance/cfi-0512018-and-cfi-0852018-dubai-financial-services-authority-v-1-commissioner-data-protection-2-anna-waterhouse or via the CDN link: https://littdb.sfo2.cdn.digitaloceanspaces.com/litt/AE/DIFC/judgments/court-first-instance/DIFC_CFI-051-2018_20200601.txt.

Cases referred to in this judgment:

Legislation referenced:

• DIFC Law No. 1 of 2007 (The Data Protection Law), Article 37(1)
• Regulatory Law, Article 7, 8(3), 78, 90