| Durant v Financial Services Authority | |
|---|---|
_(St_Edwards_Crown).svg) | |
| Court | Court of Appeal |
| Full case name | Michael John Durant v Financial Services Authority |
| Decided | 8 December 2003 |
| Citations | EWCA Civ 1746 FSR 28 |
| Transcript | BAILII |
| Court membership | |
| Judges sitting | Auld LJ Mummery LJ Buxton LJ |
| Keywords | |
| data protection, personal data | |
Durant v Financial Services Authority [2003] EWCA Civ 1746 is a judicial decision of the English Court of Appeal in relation to the provisions of the Data Protection Act 1998. The case is one of the leading appellate decisions in relation to the application of that Act.
Facts
Mr Durant had been a customer of Barclays Bank. There was litigation between Mr Durant and the bank in 1993, which he lost. Subsequently, he has sought disclosure of various records in connection with the dispute giving rise to that litigation, records which, the Court of Appeal recorded "he believes may assist him to re-open his claims against it and/or to secure an investigation of its conduct". In about July or August 2000, he sought the assistance of the Financial Services Authority (the "FSA") to obtain this disclosure. The FSA investigated his complaint against the Bank, eventually closing that investigation in March 2001, without informing Mr Durant of its outcome, pursuant to its obligation of confidentiality under sections 82 to 85 of the Banking Act 1987. In October 2000, Mr Durant complained about that refusal to the FSA's Complaints Commissioner, who adjudicated upon and dismissed that complaint.
In September and October 2001, Mr Durant made two requests to the FSA under section 7 of the Data Protection Act, seeking disclosure of personal data held by it, both electronically and in manual files. In October 2001 the FSA provided Mr Durant with copies of documents relating to him that it held in computerised form, disclosure that went beyond his entitlement under the Act, which is to have communicated to him in an intelligible form "information constituting any personal data" of which he was the subject. However some of the documents were redacted so as not to disclose the names of others. The FSA later made further disclosure of computerised material. But the FSA refused the whole of his request for information held on manual files on the ground that the information sought was not "personal" within the definition of "personal data" in section 1(1) of the 1998 Act, and that, even if it was, it did not constitute "data" within the separate definition of that word in section 1(1)(c). The FSA has since maintained that refusal, which encompasses four categories of file.
Judgment
Lower courts
Mr Durant's application originally came before District Judge Rose who refused to make an order for further disclosure against the FSA. That decision was appealed to His Honour Judge Zeidman QC sitting in the Edmonton County Court, who dismissed that appeal. With the leave of Ward LJ, Mr Durant further appealed to the Court of Appeal.
Court of Appeal
for the purposes of the appeal the FSA provided copies of the relevant documents to the Court. The Court of Appeal also received as fresh evidence a (second) witness statement from an associate in the Enforcement Division of the FSA about its filing system and various files and documents to meet certain points raised for the first time in the appeal.
The main decision was given by Auld LJ, who commenced by noting that the primary objective of the 1995 Data Protection Directive, upon which the Act was based, was to protect individuals' fundamental rights, notably the right to privacy and accuracy of their personal data held by others ("data controllers") in computerised form or similarly organised manual filing systems.
The Court of Appeal held that the appeal raised four important issues of law.
- The personal data issue – What makes "data", whether held in computerised or manual files, "personal" within the meaning of the term "personal data" in section 1(1) of the 1998 Act so as to entitle a person identified by it to its disclosure under section 7(1) of the Act – more particularly in this context, to what, if any, extent, is information relating to the FSA's investigation of Mr. Durant's complaint about Barclay's Bank within that definition?
- The relevant filing system issue – What is meant by a "relevant filing system" in the definition of "data" in section 1(1) of the 1998 Act, so as to render personal information recorded in a manual filing system "personal data" disclosable to its subject under section 7(1) – more particularly here, was the FSA's manual filing such a system so as to require it to disclose to Mr. Durant from those files information that would, if it were in computerised form, constitute "personal data" within section 1(1)?
- The redaction issue – Upon what basis should a data controller, when responding to a person's request for disclosure of his personal data under section 7(1), consider it "reasonable in all the circumstances", within the meaning of that term in section 7(4)(b), to comply with the request even though the personal data includes information about another and that other has not consented to such disclosure?
- The discretion issue – By what principles should a court be guided in exercising its discretion under section 7(9) of the Act to order a data controller who has wrongly refused a request for information under section 7(1), to comply with the request?
Personal data
In relation to the personal data issue, the Court of Appeal considered the narrow scope applied to personal data in Criminal Proceedings against Lindquist, Case C-101/01 of the European Court of Justice. That case held "that 'personal data' covered the name of a person or identification of him by some other means, for instance by giving his telephone number or information regarding his working conditions or hobbies." Accordingly, the Court held that simply because the FSA's investigation of the matter emanated from a complaint by Mr Durant, that does not of itself render information obtained or generated by that investigation, without more, his personal data.
Relevant filing system
The court accepted two fundamental points: first, that the protection given by the legislation is for the privacy of personal data, not documents, the latter mostly retrievable by a far cruder searching mechanism than the former; and second, of the practical reality of the task that the Act imposes on all data controllers of searching for specific and readily accessible information about individuals. Furthermore, to constitute a "relevant filing system" a manual filing system must: 1) relate to individuals; 2) be a "set" or part of a "set" of information; 3) be structured by reference to individuals or criteria relating to individuals; and 4) be structured in such a way that specific information relating to a particular individual is readily accessible. Accordingly, this requires a filing system so referenced or indexed that it enables the data controller's employee responsible to identify at the outset of his search with reasonable certainty and speed the file or files in which the specific data relating to the person requesting the information is located and to locate the relevant information about him within the file or files, without having to make a manual search of them.
Redaction
In relation to the redaction issue the Court also sided with the FSA. Auld LJ held that parliament could not have intended that courts in applications under section 7(9) should be able routinely to second-guess decisions of data controllers, who may be employees of bodies large or small, public or private or be self-employed. To so interpret the legislation in that manner would only encourage litigation and appellate challenge by way of full rehearing on the merits and, in that manner, impose disproportionate burdens on them and their employers in their discharge of their many responsibilities under the Act.
Discretion
The Court noted that based upon its prior conclusions, the issue of discretion was no longer relevant. However, Auld LJ did proceed to comment that "I say only that I agree with the recent observations of Munby J in Lord, at para. 160, that the discretion conferred by that provision is general and untrammelled, a view supported, I consider, by the observations of the European Court in Lindquist, at paras. 83 and 88, to which I have referred".
Buxton LJ gave a short concurring judgment.
Footnotes
- "Durant v Financial Services Authority". 5RB. Retrieved 31 January 2017.
- "Durant v Financial Services Authority (Disclosure) [2003] EWCA Civ 1746 (08 December 2003)". Practical Law. Retrieved 31 January 2017.
- "Definition of Personal Data: Durant Revisited". Act Now Training. Retrieved 31 January 2017.
- At paragraph 20.
- At paragraph 30.
- At paragraph 45.
- At paragraph 60.