Johnson v Medical Defence Union Ltd (No 2)
Reference:  EWHC 321 (Ch); (2006) 89 BMLR 43; The Times 4 April 2006
Court: Chancery Division
Judge: Rimer J
Date of judgment: 3 Mar 2006
Summary: s.13 Data protection Act 1998 - compensation - processing of personal data - fairness and compliance with data protection principles
Download: Download this judgment
Instructing Solicitors: Withers for the Claimant; Fladgate Fielder for the Defendant
The Claimant brought an action against his old insurer for compensation under s.13 of the Data Protection Act 1998 for unfair processing of his personal data. The processing in question had been the risk review of the Claimant’s professional indemnity arrangements which resulted in his cover being terminated. His case against the risk manager was that the materials prepared for consideration by the risk assessment group had been unfairly selected and that the decision to terminate cover had caused great damage to his professional reputation.
(1) Whether the risk assessment review involved any processing of the Claimant’s personal data; (2) if it did, whether the processing was unfair; (3) if it was unfair, whether it could be shown that, if the processing had been fair, the termination decision would probably not have been made; (4) whether J was entitled to any compensation
(1) The preparation of a summary by the risk manager for consideration by the risk assessment group, by selecting information from files and microfiche amounted to ‘processing’ as within s.1(1) of DPA 1998. (2) Compliance with the requirement that processing be ‘fair’ did not extend to the Defendant having to contact the data subject, who had consented, after the processing. (3) Overall the risk summary had not been unfairly drafted, in spite of the fact that certain constituent (non-lead) files had been unfairly processed. The Court could not pass judgment on the insurer’s risk management policy. (4) The unfair processing element identified had not caused the mutual society to terminate the Claimant’s membership.
Compensation for distress in a data protection claim is for the distress occasioned by the processing that gives rise to a breach of the act. Compensation cannot be made for alleged general harm to reputation.