Data Protection Case – Leave to Appeal Refused

Mr Michael John Durant, who lost a landmark data protection case in the Court of Appeal, has been refused permission to appeal to the House of Lords.

The Data Protection Act 1998 (DPA) applies to ‘personal data’ held on computer and held manually, provided the manual data is organised into a ‘relevant filing system’.

Mr Durant had been involved in a dispute with Barclays Bank plc. Following unsuccessful litigation, he continued to try to get hold of documents which he evidently believed would help back up his claim. He sought information from the Financial Services Authority (FSA), which had carried out an investigation into his complaint against the bank, making two subject access requests. The FSA provided some computerised documents but refused access to all manual files on the grounds that the information held was not personal, nor did it form part of a relevant filing system.

In deciding whether information relating to the FSA’s investigation into Mr Durant’s complaint constituted personal data, the Court of Appeal found that the purpose of the DPA is to enable individuals to check whether a data controller’s processing of personal information held about them infringes their privacy and, if it does, to enable them to take steps to protect it. The right of access is not an automatic right to any information, readily accessible or not, in which the individual may be named or involved, nor is it a right to information that may assist in litigation or complaints against third parties.

Therefore, the mere mention of the data subject in a document held by a data controller does not mean it is necessarily personal data. For example, details of someone’s medical history, their tax affairs or their spending preferences would be personal data, whereas recording a person’s attendance at a meeting in the minutes of the meeting would not.

The Court of Appeal also ruled that a relevant filing system, for the purposes of the DPA, only covers manual files if they are organised in such a way as to provide the same or similar ease of access to data as a computerised system. A system which requires the searcher to trawl through the files trying to find data on an individual, and then to determine whether the data is personal, does not qualify as a relevant filing system. If files are not organised or indexed in such a way as to enable easy location of specific information on the data subject, then the system does not qualify. Even though the FSA file was labelled ‘Mr Durant’, the contents were structured in date order and so locating specific information would have required a lengthy search.

For businesses not subject to the Freedom of Information Act, the Court of Appeal’s decision effectively reinstated the privacy standards as laid down in the previous Data Protection Act 1984, which applied to computerised records only.

This may not be the end of the matter however. The European Commission has expressed concerns that UK law does not implement the EC Data Protection Directive and is believed to have written to the Government outlining its concerns and raising the possibility of legal proceedings in the European Court of Justice.