circumstances, acceding to the SAR and breaching the tipping off provisions under POCA would constitute a criminal offence for those conducting the corporate investigation. This is a point which will need to be clarified in subsequent authority. Meanwhile, companies conducting an internal investigation should, wherever possible, set out a clear statement of purpose at the start of such an investigation, specifying which activities are carried out for the purposes of the detection and prevention of crime, and those which are not. To the extent practicable, companies should avoid conducting investigations with mixed purposes. Where this is not practicable, companies should be aware that personal data processed in the context of an investigation, for purposes other than the detection and prevention of crime, may be subject to disclosure in response to a SAR. It should, however, be noted that Gurieva does provide a few positives for companies conducting corporate investigations.

First, the court confirmed that the exemption for the detection or prevention of crime is available to private organisations (albeit not on the facts of Gurieva). Second, as recently confirmed by the European Court of Justice, a company in receipt of a SAR is not obliged to disclose all documents that are responsive to the SAR. The disclosure of the requested personal data (extracted from documents that may contain other information) would be sufficient. Going forward, it is important for any company that is conducting corporate investigations, and that receives a SAR, to carefully consider whether it is obliged to comply with the SAR, in light of Gurieva.

Where it is necessary to comply with a SAR, organisations should ensure that they provide the requested information within the 40-day deadline specified in the Act. White & Case LLP 5 Old Broad Street London EC2N 1DW United Kingdom T +44 20 7532 1000 In this publication, White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities. This publication is prepared for the general information of our clients and other interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice. Client Alert White & Case 3 .