The case focuses on a right in the Data Protection Act of 1998 that generally lets an individual access personal information held by an organisation that relates to him. After a dispute with his bank, which involved the bank successfully applying an exemption from the right of access, Mr Durant complained to the Financial Services Authority.
The FSA investigated, but did not reveal detailed information about its investigation to Mr Durant. So he tried to use the Act's right of access in relation to the FSA. The FSA refused, and Mr Durant embarked on a lengthy court process.
Mr Durant lost his case in the Court of Appeal in November 2003. The Court ruled that merely mentioning a person in a document does not make that whole document available as "personal data" in the event of such a request.
In making this ruling, it narrowed the scope of personal data and also concluded that paper-based personal information was subject to the Act but only if the information was contained in a very well-structured filing system. The Court had in mind a manual system with the quality of a relational database, where specific information about a particular individual could be readily pinpointed within the system.
Businesses welcomed the judgment, believing it could make their obligations under the Act easier to fulfil. The judgment effectively reinstated the privacy standards set by the previous Data Protection Act of 1984, by limiting the application of the 1998 Act to automatic processing of personal data which directly referred to identifiable individuals.
Privacy advocates were furious, however – and found an ally in the European Commission.
The Commission is believed to have cited the ruling as one reason to suggest that the UK's Data Protection Act is a defective implementation of the Commission's original Directive. It sent a 20-page letter to the UK Government last year, setting out its concerns and raising the prospect of legal proceedings.
Although the Government has formally responded to the Commission's letter, the exchange of correspondence has not been published despite various requests under the European and UK Freedom of Information legislation. The Government claims that the release of this information about data protection would cause "prejudice to international relations". Parliament has also been told that the Government believes that the Court's interpretation of personal data is correct but no foundation for this belief has been provided.
A source close to the Commission has told OUT-LAW that a decision on whether or not to start formal proceedings is likely to be taken within the next two months.
Meanwhile, Mr Durant is hoping to challenge the Court of Appeal ruling against him.
When the judgment was delivered by the Court of Appeal, there were two main points against him.
The first was the Court's view about the accessibility of manual personal information and the second was the meaning of "personal data" within the Act. To succeed in getting the information he wanted, Mr Durant would have had to go to the House of Lords and convince the Lords that the Court of Appeal was wrong on both counts.
One obstacle to Mr Durant was removed with the Freedom of Information Act coming into force in January.
One of FOIA's important provisions was to change the meaning of "data" in the Data Protection Act, so that any paper-based personal information, recorded by a public authority, is now personal data irrespective of the structure of the filing system. This legislation, which applies to public sector bodies, means that paper files held by public authorities are available on an access request. Mr Durant now has the possibility of an appeal to obtain personal data from paper files held by the FSA because the FSA is a public authority.
The Court of Appeal had decided that to be personal data, information had to "relate to" a particular individual in a significant way. For example, the content of personal information must focus on that individual, or the information has to have biographical significance for that individual.
Subsequent court cases have used the narrow view of "relate to" and Dr. Chris Pounder of Pinsent Masons, the law firm behind OUT-LAW.COM, and Editor of Data Protection and Privacy Practice, says this is beginning to expose some curiosities.
Dr. Pounder explained: "Suppose an individual complains to a company about, say, the servicing of a washing machine under a contract. The individual cannot rely on the right of access granted in the Data Protection Act to find out whether that complaint has been accurately recorded or has been properly dealt with, because most of the recorded data will have the complaint about the washing machine as its focus".
He continued: "This consequence of the Durant ruling contrasts with the approach taken by the European Court of Human Rights when interpreting the European Convention on Human Rights – where information relating to private life is construed broadly to include any information relating to an identified or identifiable individual."
Now that Mr Durant is focusing on one point rather than two, he may have a chance. Unfortunately, he is now outside the time limit for appeals, so he would need to be given special permission to appeal, out of time, by the House of Lords.
If this application is successful, then there is a possibility that the Court of Appeal decision will be overturned – and the wide meaning of personal data under the Data Protection Act 1998 will be established.
