Privacy chief to revisit Data Protection guidance after Durant

In the wake of a landmark Court of Appeal ruling earlier this month, the Information Commissioner yesterday confirmed that he will be reviewing his Data Protection guidance to reflect a more restrictive balancing of data protection and privacy rights.

The Data Protection Act of 1998 covers the use by "data controllers" of "personal data" held in a "relevant filing system". Everything from employee files to customer lists are covered by this law. It also includes a right for individuals, subject to conditions, to receive a copy of "the information constituting the personal data of which that individual is the data subject".

This month's ruling concerned Michael Durant who wanted access to personal information held by the Financial Services Authority. The FSA refused.

Mr Durant took the matter to court, but was thwarted last week when the Court of Appeal ruled that merely mentioning a person in a document does not amount to "personal data" under the Data Protection Act. Accordingly Durant was not entitled to see the information held by the FSA.

In a statement published yesterday, Information Commissioner Richard Thomas welcomed the guidance provided by the ruling. He wrote:

"The Commissioner particularly welcomes the fact that the Court has reiterated the fundamental link between data protection and privacy rights."

His statement continued:

"The Commissioner recognises that the interpretation suggested by Lord Justice Auld is more restrictive than the approach adopted by the Commissioner to date. In the New Year the guidance issued by the Commissioner's office will be reviewed and amended to reflect this difference of approach. All the Commissioner's responsibilities, including existing and future casework, will be carried out in accordance with this judgment."

William Malcolm, a data protection law specialist with Masons, the firm behind OUT-LAW.COM, commented:

"The Durant decision cuts across legal guidance already issued by the Information Commissioner's office. The Commissioner will have to consider the long term impact this decision has in all areas, not just subject access. Privacy advocates and businesses across the country will await the modified guidance with interest."