Full case report
Durant v Financial Services Authority
Reference  EWCA Civ 1746;  FSR 28; The Times, 2 Jan 2004
Court Court of Appeal
Judge Auld, Mummery & Buxton LJJ
Date of Judgment 8 Dec 2003
Data Protection – Manual Filing System – Subject Access Requests – Definition of “Data” – Data Protection Act 1998, ss.1 & 7 – EC Data Protection Directive 95/46/EC
The Appellant had made a subject access request under the Data Protection Act 1998 to the Respondent for it to provide him with information they held about him. The Respondent did provide the Appellant with some copy documents but refused to provide any information held on manual files on the ground that the information sought did not fall within the definition of “personal data” in s.1(1) of the Act because it was not part of a structured filing system.
(1) the proper interpretation of “personal data” and in particular the proper construction of “relevant filing system”
(2) the approach to be adopted by a Data Controller when deciding whether to disclose information relating to a third party in response to a subject access request.
(1) Not all information retrieved from a computer against an individual’s name was personal data within the Act. The mere mention of the data subject in a document did not make that information personal data of the data subject. To be personal data the information had to be significantly biographical and/or such that the data subject was the focus of attention. (2) The purpose of the relevant legislation was to apply the same standard of accessibility to personal data in manual filing systems as to computerised records, and the protection was aimed at the data and not the documents. The insistence in the Act that the data had to be part of a structured filing system was to ensure that the information was readily accessible. It would be disproportionate to force data controllers to search for information through unstructured filing systems. (3) The fact that a document could be retrieved using the Appellant’s name was not sufficient to make the information contained therein “personal da
Sir Humphrey would have been delighted with this decision. The definition given by the Court of Appeal to personal data is so restrictive in relation to manual filing systems, as to constitute a serious obstacle to any citizen seeking to verify the accuracy of information held about him/her by the state. It is surprising that such a wide exclusion of “data” from the Act should be found consistent with the Data Protection Directive or Article 8.
Masons for the Appellant; Treasury Solicitor for the Respondent
More from 5RB
“known for its indisputable quality in the areas of defamation, privacy, contempt and data protection.” Get the lowdown here.
New 3rd Edition of The Law of Privacy and the Media, published by OUP. Further details here.