Dispute Resolution Data Protection

Personal data explained - Laura Gillespie discusses the Durant decision.

The Data Protection Act 1998 ("DPA") came into force on 1 March 2000, with the primary purpose of regulating the processing of personal data. The DPA defines personal data as "data relating to an individual". Data includes both information held on computer and manual information, provided the manual data is organised into a relevant filing system. It is these very definitions within the DPA which have caused much confusion amongst businesses and professionals alike, leaving many Data Controllers at a loss to understand what exactly their obligations under the DPA are. Helpfully, judicial guidance has been received through the Court of Appeal decision, Durant -v- Financial Services Authority (2003) and on 4 October 2004, the Information Commissioner published updated guidelines to assist in the interpretation of that decision.

Durant - The Facts

Mr. Durant was involved in litigation with Barclays Bank and made a "Subject Access Request" under the DPA seeking disclosure of records which were being held by the FSA relating to a complaint made by him in the course of the litigation proceedings. While some computer records were provided to Mr. Durant, the FSA refused to provide access to manual files on the basis that the information sought was not "personal" and even if it was, the information did not form part of a "relevant filing system".

What is Personal Data?

Mr. Durant argued that "data relating to an individual" covered any information which could be retrieved as a result of a search under his name. The Court of Appeal decided that personal data "is information that affects a person's privacy, whether in his personal or family life, business or professional capacity." Essentially, Data Controllers must consider the following questions:

• is the information biographical in a significant sense?
• does it go beyond the recording of an individual's involvement in a matter which has no personal connotations?
• what is the focus of the information?

The English Court of Appeal concluded that while the documents requested contained reference to Mr. Durant, the focus of the investigation was Barclays Bank, with information relating to Mr. Durant being secondary, and therefore he was not entitled to disclosure of the documents sought.

What is a relevant filing system?

The data which Mr. Durant was seeking was held on manual files which the FSA refused to disclose on the basis that they were not part of a "relevant filing system". The Court of Appeal held that a manual filing system will only be "relevant" under the DPA if:

• the files in that system are structured in such a way so that it is clear at the outset of the search whether personal data is held; and
• the system has a sufficiently sophisticated means of indicating where an individual file with specific information about an individual can be located.

The "Temp" Test

The Information Commissioner, who is charged with policing the DPA, published guidelines in October 2004 on interpreting the DPA in light of the Durant decision. In considering what is a "relevant filing system", the "temp test" has been devised. Data Controllers should consider whether, if they employed a temporary administrative assistant, that assistant be able to extract specific information about an individual without any particular knowledge of the documents being held? If so, it is likely that the manual files form part of a relevant filing system and so, are caught by the DPA.

What now?

The Durant ruling has provided some clarity on the obligations of Data Controllers and the documents Data Subjects are entitled to receive. Before Durant, many considered that any reference made to an individual in a document required disclosure of that document upon receipt of a Subject Access Request. Life post Durant may well be a comfort to many businesses as it illustrates that a more restrictive approach to the disclosure of manual files may be upheld by the Courts.

Laura Gillespie is an Associate Solicitor in the firm's Litigation Department. Her main areas of practice are commercial litigation and employment.

Quote: