Data protection – help from the Court of Appeal

A Court of Appeal decision concerning the scope of the Data Protection Act 1998 (the "Act"), has provided a welcome approach to the amount of information which has to be provided in response to a data subject access request, in contrast to some more radical views which have been circulating. The Court of Appeal has reiterated the fundamental link between data protection and privacy rights. Its narrow interpretation of the terms "personal data" and "relevant filing system" will prevent individuals from going on "fishing expeditions" to see what they can find about themselves for other purposes.

Although Durant v Financial Services Authority is not a pensions case, the Court's decision and its guidance apply equally to subject access requests by scheme members.

The Court has clarified that the purpose of a data subject access request is to allow an individual access to his/her "personal data" to check that there has not been an unlawful invasion of privacy. A data subject access request is not intended to provide automatic access to any information in which the individual may be simply named or involved. Mere mention of an individual's name in a document does not make the information in that document "personal data". For the disclosure obligation to arise, the information should be biographical in a significant sense and have the individual as its focus. This narrow interpretation of "personal data" will ensure that employees who request access to data in future will only be guaranteed disclosure of information which is necessary in order to protect their privacy.

In addition, an individual only has the right to access his personal data held in paper-form if it is part of a "relevant filing system". A relevant manual filing system is one where the information is structured by reference to that individual. If the filing system is not structured by reference to personal data, the disclosure provisions of the Act do not apply. In practical terms, this may mean that the documents in a paper file containing correspondence with a particular member may not need to be disclosed to that member, even if the file is stored alphabetically by reference to the member's name.

The Information Commissioner has recognised the significance of this judgment by publishing comments on his own website welcoming the Court's guidance and greater clarity as to the meaning of "personal data" and "relevant filing system". He has recognised that the interpretation suggested by this decision is more restrictive than the approach adopted by him to date. The guidance issued by the Commissioner's Office is to be reviewed and amended to reflect this difference of approach. The Information Commissioner has also confirmed that all his responsibilities, including existing and future casework, will now be carried out in accordance with this judgment.