Data Protection - Curtailment of Right to demand information

The Court of Appeal has decided an important case on the scope of the Data Protection Act 1998 and, in so doing, provides guidance on the extent to which employers are obliged to provide copies of employees' personnel files, Emails etc.. In short, it drastically curtails the right of employees to demand information by means of a data protection request.

The case, Durant v Financial Services Authority, provides as follows:

* 1. in order for data, whether held on computer or a manual file, to be 'personal data' (thus giving rise to a disclosure obligation), it must name or directly refer to an individual. But that it not enough: mere mention of a subject's name in a document does not make the information in that document 'personal data'. For the disclosure obligation to arise, the information must be biographical in a significant extent, and should have the data subject as its focus. Thus information stored by the FSA concerning a complaint by Mr Durant about Barclays Bank was not personal data which the FSA was obliged to disclose to Mr Durant (paras 26-28).

* 2. a 'relevant filing system', for a manual (rather than computer) system, is one where the information is structured by reference to that individual. Thus the FSA's file marked 'Mr Durant', which contained a large number of documents relating to his claim in date order, was not a relevant filing system because it was structured by reference to date, not to the individual (para. 35 and 48). The purpose of the Act is to protect the privacy of personal data, not documents. If the documents are not structured by reference to that data, the disclosure provisions of the Act are not triggered. Any manual filing system which requires an individual to "leaf through" multiple documents to find the personal data contained therein falls outside the scope of the Act. The fact a folder is labelled with an individual's name is not, without more, enough to bring it within the Act.

The Court of Appeal also considered the difficulties arising when personal data, which would otherwise be disclosable, identifies other people.

The Court concluded with criticisms of individuals who seek to use the Act as a method of obtaining information generally which refers to them by name, rather than information relating only to personal data. Mummery LJ described Mr Durant's application and appeal as "misconceived", which will not bode well for Applicants who put Respondents to cost in tribunal claims dealing with a (now) unwarranted Data Protection disclosure application.