The case focuses on a right in the Data Protection Act of 1998
that generally lets an individual access personal information held
by an organisation that relates to him. After a dispute with his
bank, which involved the bank successfully applying an exemption
from the right of access, Mr Durant complained to the Financial
Services Authority.
The FSA investigated, but did not reveal detailed information
about its investigation to Mr Durant. So he tried to use the Act's
right of access in relation to the FSA. The FSA refused, and Mr
Durant embarked on a lengthy court process.
Mr Durant lost his case in the Court of Appeal in November 2003.
The Court ruled that merely mentioning a person in a document does
not make that whole document available as "personal data" in the
event of such a request.
In making this ruling, it narrowed the scope of personal data
and also concluded that paper-based personal information was
subject to the Act but only if the information was contained in a
very well-structured filing system. The Court had in mind a manual
system with the quality of a relational database, where specific
information about a particular individual could be readily
pinpointed within the system.
Businesses welcomed the judgment, believing it could make their
obligations under the Act easier to fulfil. The judgment
effectively reinstated the privacy standards set by the previous
Data Protection Act of 1984, by limiting the application of the
1998 Act to automatic processing of personal data which directly
referred to identifiable individuals.
Privacy advocates were furious, however – and found an ally in
the European Commission.
The Commission is believed to have cited the ruling as one
reason to suggest that the UK's Data Protection Act is a defective
implementation of the Commission's original Directive. It sent a
20-page letter to the UK Government last year, setting out its
concerns and raising the prospect of legal proceedings.
Although the Government has formally responded to the
Commission's letter, the exchange of correspondence has not been
published despite various requests under the European and UK
Freedom of Information legislation. The Government claims that the
release of this information about data protection would cause
"prejudice to international relations". Parliament has also been
told that the Government believes that the Court's interpretation
of personal data is correct but no foundation for this belief has
been provided.
A source close to the Commission has told OUT-LAW that a
decision on whether or not to start formal proceedings is likely to
be taken within the next two months.
Meanwhile, Mr Durant is hoping to challenge the Court of Appeal
ruling against him.
When the judgment was delivered by the Court of Appeal, there
were two main points against him.
The first was the Court's view about the accessibility of manual
personal information and the second was the meaning of "personal
data" within the Act. To succeed in getting the information he
wanted, Mr Durant would have had to go to the House of Lords and
convince the Lords that the Court of Appeal was wrong on both
counts.
Changes to the law on paper-based personal data
One obstacle to Mr Durant was removed with the Freedom of
Information Act coming into force in January.
One of FOIA's important provisions was to change the meaning of
"data" in the Data Protection Act, so that any paper-based personal
information, recorded by a public authority, is now personal data
irrespective of the structure of the filing system. This
legislation, which applies to public sector bodies, means that
paper files held by public authorities are available on an access
request. Mr Durant now has the possibility of an appeal to obtain
personal data from paper files held by the FSA because the FSA is a
public authority.
The meaning of "personal data"
The Court of Appeal had decided that to be personal data,
information had to "relate to" a particular individual in a
significant way. For example, the content of personal information
must focus on that individual, or the information has to have
biographical significance for that individual.
Subsequent court cases have used the narrow view of "relate to"
and Dr. Chris Pounder of Pinsent Masons, the law firm behind
OUT-LAW.COM, and Editor of Data Protection and Privacy Practice,
says this is beginning to expose some curiosities.
Dr. Pounder explained: "Suppose an individual complains to a
company about, say, the servicing of a washing machine under a
contract. The individual cannot rely on the right of access granted
in the Data Protection Act to find out whether that complaint has
been accurately recorded or has been properly dealt with, because
most of the recorded data will have the complaint about the washing
machine as its focus".
He continued: "This consequence of the Durant ruling contrasts
with the approach taken by the European Court of Human Rights when
interpreting the European Convention on Human Rights – where
information relating to private life is construed broadly to
include any information relating to an identified or identifiable
individual."
Now that Mr Durant is focusing on one point rather than two, he
may have a chance. Unfortunately, he is now outside the time limit
for appeals, so he would need to be given special permission to
appeal, out of time, by the House of Lords.
If this application is successful, then there is a possibility
that the Court of Appeal decision will be overturned – and the wide
meaning of personal data under the Data Protection Act 1998 will be
established.
