Johnson v Medical Defence Union Ltd
Reference:  EWHC 2509 (Ch)
Court: Chancery Division
Judge: Laddie J
Date of judgment: 9 Nov 2004
Summary: Data Protection - Subject Access request - s.7 Data Protection Act - Disclosure - CPR Part 31
Download: Download this judgment
Instructing Solicitors: Charles Russell for the Applicant; Fladgate Fielder for the Respondent
Mr Johnson (‘J’) is pursuing an action for compensation for improper processing of personal data under s.13 DPA 1998. MDU decided not to renew J’s membership of the MDU. J made a subject access request under s.7 DPA 1998 to ascertain the basis of this decision. MDU disclosed certain documents, some of them redacted. J challenged the adequacy of MDU’s disclosure applying under s.7(9) of the Act for an order that MDU provide further documents and unredacted versions of the documents already disclosed. J’s application was rejected by Laddie J. J then made an application for specific disclosure in his compensation claim to obtain disclosure of the same documents he had been refused sight of earlier. MDU argued that this application was an impermissible attempt to circumvent the subject access provisions of the DPA.
Whether ordering specific disclosure under the Civil Procedure Rules would undermine the balance between the interests of the data controller, the data subject and third parties struck by the DPA.
Allowing the application: (1) s.15(2) DPA 1998 has no direct effect on a claimant’s right to CPR disclosure where his claim is based on breaches of the data protection principles; the provision does not prevent a data subject obtaining disclosure in the ordinary way. s.15(2) and orders for disclosure serve different ends. s. 15(2) is concerned with whether subject access requests under s.7 are properly considered and complied with, whereas disclosure under the CPR is an ordinary incident of civil proceedings. (2) s.15 has an indirect influence on disclosure under the CPR: “s.15(2), like s.7(4) to (6), emphasises the concern of the legislature that confidential information relating to third parties should not be disclosed to a data subject. When a court exercises its discretion to order specific disclosure, this concern must be borne in mind”.
This is the first authority on the interrelation between the right to disclosure under the subject access provisions of the Data Protection Act and under the CPR.