Durant v Financial Services Authority

Reference: [2003] EWCA Civ 1746; [2004] FSR 28; The Times, 2 Jan 2004

Court: Court of Appeal

Judge: Auld, Mummery & Buxton LJJ

Date of judgment: 8 Dec 2003

Summary: Data Protection - Manual Filing System - Subject Access Requests - Definition of "Data" - Data Protection Act 1998, ss.1 & 7 - EC Data Protection Directive 95/46/EC

Download: Download this judgment

Instructing Solicitors: Masons for the Appellant; Treasury Solicitor for the Respondent

Facts

The Appellant had made a subject access request under the Data Protection Act 1998 to the Respondent for it to provide him with information they held about him. The Respondent did provide the Appellant with some copy documents but refused to provide any information held on manual files on the ground that the information sought did not fall within the definition of “personal data” in s.1(1) of the Act because it was not part of a structured filing system.

Issue

(1) the proper interpretation of “personal data” and in particular the proper construction of “relevant filing system”
(2) the approach to be adopted by a Data Controller when deciding whether to disclose information relating to a third party in response to a subject access request.

Held

(1) Not all information retrieved from a computer against an individual’s name was personal data within the Act. The mere mention of the data subject in a document did not make that information personal data of the data subject. To be personal data the information had to be significantly biographical and/or such that the data subject was the focus of attention. (2) The purpose of the relevant legislation was to apply the same standard of accessibility to personal data in manual filing systems as to computerised records, and the protection was aimed at the data and not the documents. The insistence in the Act that the data had to be part of a structured filing system was to ensure that the information was readily accessible. It would be disproportionate to force data controllers to search for information through unstructured filing systems. (3) The fact that a document could be retrieved using the Appellant’s name was not sufficient to make the information contained therein “personal da

Comment

Sir Humphrey would have been delighted with this decision. The definition given by the Court of Appeal to personal data is so restrictive in relation to manual filing systems, as to constitute a serious obstacle to any citizen seeking to verify the accuracy of information held about him/her by the state. It is surprising that such a wide exclusion of “data” from the Act should be found consistent with the Data Protection Directive or Article 8.