The Data Protection Act 1998 covers the use by "data controllers" of "personal data" held in manual files which are organised into a "relevant filing system". Everything from employee files to customer lists may be covered by this law. The Act also includes a right for individuals, subject to conditions, to receive a copy of "the information constituting the personal data of which that individual is the data subject".
December's ruling concerned a Mr Michael Durant, who wanted access to personal information held by the Financial Services Authority. The FSA withheld certain information on the grounds that it was not covered by the Act.
Mr Durant took the matter to court, but was thwarted when the Court of Appeal ruled that merely mentioning a person in a document does not necessarily amount to "personal data" under the Data Protection Act. In addition, only paper files which are so highly organised and structured as to resemble computerised information will be covered under ther Act. Accordingly Durant was not entitled to see the information held by the FSA. (More detail on the case can be found at the link below.)
Following the ruling, Information Commissioner Richard Thomas announced that his office would be reviewing existing guidance on the Data Protection Act. This has now been published.
The guidance, "The Durant case and its impact on the interpretation of the Data Protection Act 1998", focuses on two key issues considered by the Court:
What makes 'data' 'personal' within the meaning of personal data?
What is meant by a 'relevant filing system'?
If data is not 'personal', then it is not covered by the Act and therefore individuals have no automatic right to have access to it. The 1998 Act contains a definition of 'personal data', which forms a two strand test. First, a living individual must be able to be identified from or using the data in question. In the Durant case, the Court of Appeal did not focus on this element of the definition. Second, the data must 'relate to' the individual identified. It is this issue with which the Court was most concerned. In this respect, the Court of Appeal defined 'personal data' as meaning "information that is biographical nature, focuses on the individual and affects [a person's] privacy, whether in his personal or family life, business or professional capacity".
The Commissioner has interpreted this as meaning that "you should take into account whether or not the information in question is capable of having an adverse impact on the individual". What is important,then, is whether the data "affects the named individual's privacy".
The guidance says:
"Simply because an individual's name appears on a document, the information contained in that document will not necessarily be personal data about the named individual. It is more likely that an individual's name will be 'personal data' where the name appears together with other information about the named individual such as address, telephone number or information regarding his hobbies."
'Relevant filing system'
To fall under the Act personal data held manually must be organised into a 'relevant filing system'. The Court of Appeal considered that manual files would only be held in 'a relevant filing system' if "they are of sufficient sophistication to provide the same or similar ready accessibility as a computerised filing system".
The guidance discusses the definition in some detail, but in general, to come under the scope of the Act, the manual files must be organised so that:
"the content will either be so sub-divided as to allow the searcher to go straight to the correct category and retrieve the information requested without a manual search, or will be so indexed as to allow a searcher to go directly to the relevant page/s."
In the Commissioner's opinion, the majority of manual files are unlikely to fall within the rules of the Act, and chronological filing systems were given as a specific example of a file which would not be a "relevant filing system". However, public sector bodies must be aware that the introduction of new rules next year (under Freedom of Information legislation) will mean that most manual files will in fact fall within the ambit of the Act.
The Commissioner has issued specific guidance relating to the effect of the Durant decision on CCTV users.