Data Protection

Commercial – Data Protection – Definition of Personal Data

The European Commission is unlikely to bring infringement proceeding against the UK over a narrowing of the definition of ‘personal data’ in the 2003 Court of Appeal decision in the case of Durant v Financial Services Authority [2003]. In that case, the court held that personal data, as defined by the Data Protection Act 1998 (“the Act”), must "relate to an individual" by being significantly biographical in nature and having the data subject as its central focus. This decision applied to subject access requests.

It should be noted that the Commission has played down the importance of ongoing communications with the UK government. It has been suggested that it was dissatisfied with about a third of the UK's implementation of the Data Protection Directive. The Commission has stated that this is routine dialogue which it conducts with other member states.

The European Commission is apparently less concerned with the Durant decision than with the decision’s implications. They are of the opinion that it might lead to a narrowing of the definition of personal data.

Even so, there are no reports of businesses taking any radically new approach to data protection in light of the perception that Durant has narrowed the definition of personal data. Commentators on the matter have stated that with regards to subject access searches, reputable businesses in the UK have always adopted a ‘best-practice’ approach which conforms to a broader view of personal data. It is believed that this still continues subsequent to the decision.

The Durant case involved Durant's attempt to obtain data about him held by the FSA. The data concerned his dealings with Barclays Bank. Durant believed the data in question would have allowed him to re-open litigation against the bank, as the bank had won the previous case in which he was involved in 1993.

Barclays transferred data about him to the FSA after Durant persuaded the FSA to investigate his case. However, the regulator refused his request to make available any information it held about him after the investigation was concluded.

Durant then made two subject data access requests to the FSA under s.7 of the Act. The subject access requests were for both manual information and computer information held about him. The FSA provided a computer print-out, which blacked out names of other persons related to the case, however refused to provide the manual files. The FSA reasoned that the information was not personal within the Act's definition of data. Furthermore, the FSA argued that it did not form part of a 'relevant' filing system.

This line of argument was made due to the fact that the manual data was about Durant's complaints rather than about him as an individual.

The Court of Appeal broadly endorsed the FSA's view.

Durant did not appeal to the House of Lords. A number of commentators are of the opinion that further case law may constrain the ruling within its own terms. The government has stated that further jurisprudence narrowing the definition of personal data could not lawfully be applied.

Interestingly enough, the Information Commissioner has released guidance which considers the Durant personal data concept. The guidance requires data controllers to carefully consider the practical effect of data on an individual's privacy before deciding if it is personal data or not.

It should be noted that Durant had the effect of potentially applying a narrow definition across UK data protection law. The court's definition stating that personal data should have biographical significance and the individual as a focus are both terms which are not found anywhere in the Act. Due to this new limitation, many commentators feel that this potential new definition is too narrow.

Please contact us for more information on data protection law at [email protected]

Visit http://www.rtcoopers.com/practice_corporatecommercial.php;  http://www.rtcoopers.com/practice_dataprotection.php

© RT COOPERS, 2008. This Briefing Note does not provide a comprehensive or complete statement of the law relating to the issues discussed nor does it constitute legal advice. It is intended only to highlight general issues. Specialist legal advice should always be sought in relation to particular circumstances.