UK: Data Protection Burdens Eased

Originally published July 2004

Prior to the Court of Appeal’s decision in the case of Durant -v- the FSA, employers were faced with a barrage of detailed requests by employees requesting copies of personal data held about them pursuant to Section 7 of the Data Protection Act. The request extended to items such as memoranda in which the employee happened to be mentioned. This was a tool used by claimants to obtain data during the course of litigation without going through the process of discovery.

However, the case of Durant -v- FSA provided welcome guidance as to what data was capable of falling within the definition of personal data pursuant to Section 7 of Data Protection Act. Subsequent to that case the Information Commissioner has issued guidance on two issues considered by the Court of Appeal in the Durant case.

The Data Protection Act applies only to "personal data". The Court of Appeal concluded that "personal data" is information that affects a person’s privacy whether in his personal or family life, business or professional capacity.

In the circumstances, privacy is clearly central to the definition of personal data. A factor, employers should take into account is whether or not the information in question is capable of having an adverse impact on an individual.

The Information Commissioner suggested that where an individual’s name appears in the information, the name will only be personal data where its inclusion in the information affects the individual’s privacy. Simply because an individual’s name appears on a document, the information contained in that document will not necessarily be personal data about the named individual.

It is more likely that an individual’s name will be personal data where the name appears together with other information about the named individual such as address, telephone number or information regarding the individual’s hobby. The Information Commissioner has suggested that the following examples will fall within the definition of personal data;

• Information about the medical history of an individual;

• An individual’s salary details;

• Information concerning an individual’s tax liability;

• Information comprising an individual’s bank statements; and

• Information about an individual’s spending preferences.

The above may be contrasted with the following examples of information which would not normally be personal data:

• A reference to an individual’s name where the name is not associated with any other personal information;

• Incidental mention in the minutes of a business meeting of an individual’s attendance at that meeting in an official capacity; or

• Where an individual’s name appears on a document or email indicating only that it has been sent or copied to that particular individual, the content of that document or email does not amount to personal data about the individual unless there is other information about the individual within it.

The second issue is what is meant by a "relevant filing system"?

In the Durant case the Court concluded that a relevant filing system for the purposes of the Data Protection Act is limited to a system:

• in which the files forming part of it are structured or referenced in such a way as to clearly indicate at the outset of the search whether specific information capable of amounting to personal data of an individual requesting it under Section 7 is held within the system and, if so, in which file or files it is held; and

• which has, as part of its own structure or references mechanism, a sufficiently sophisticated and detailed means of readily indicating whether and where in an individual file or files specific to criteria or information about the individual can be readily located.

For example, if your employee, Trevor Green, requests details of the leave he has taken in the last six months, and such records are not computerised, but kept in a manual file called "Trevor Green" and which contains a number of documents which are filed in chronological order but regardless of subject matter, then this would not amount to a relevant filing system.

If, however, there is a file called "Trevor Green" which is sub-divided into categories such as "contact details", "sickness", "pension" and "leave", then this could amount to a relevant filing system.

It seems to be that following the Durant judgment it is unlikely that very few manual files will be covered by the provisions of the Data Protection Act. Most information about individuals held in manual form therefore will probably not fall within the Data Protection Act.

The case has brought welcome guidance in that it clarifies the purpose of the Data Protection Act, namely to allow individuals to access personal information held by others and, if the information is incorrect, to enable individuals to correct that information. The purpose is not for employees to obtain information to assist in litigation. The decision and the guidance provided by the Information Commissioner has curtailed the requests made under the subject access provision.

© RadcliffesLeBrasseur

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.