Durant v Financial Services Authority

Mr Durant had been a customer of Barclays Bank. There was litigation between Mr Durant and the bank in 1993, which he lost. Subsequently, he has sought disclosure of various records in connection with the dispute giving rise to that litigation, records which, the Court of Appeal recorded "he believes may assist him to re-open his claims against it and/or to secure an investigation of its conduct". In about July or August 2000, he sought the assistance of the Financial Services Authority (the "FSA") to obtain this disclosure. The FSA investigated his complaint against the Bank, eventually closing that investigation in March 2001, without informing Mr Durant of its outcome, pursuant to its obligation of confidentiality under sections 82 to 85 of the Banking Act 1987. In October 2000, Mr Durant complained about that refusal to the FSA's Complaints Commissioner, who adjudicated upon and dismissed that complaint.

In September and October 2001, Mr Durant made two requests to the FSA under section 7 of the Data Protection Act, seeking disclosure of personal data held by it, both electronically and in manual files. In October 2001 the FSA provided Mr Durant with copies of documents relating to him that it held in computerised form, disclosure that went beyond his entitlement under the Act, which is to have communicated to him in an intelligible form "information constituting any personal data" of which he was the subject. However some of the documents were redacted so as not to disclose the names of others. The FSA later made further disclosure of computerised material. But the FSA refused the whole of his request for information held on manual files on the ground that the information sought was not "personal" within the definition of "personal data" in section 1(1) of the 1998 Act, and that, even if it was, it did not constitute "data" within the separate definition of that word in section 1(1)(c). The FSA has since maintained that refusal, which encompasses four categories of file.

Mr Durant's application originally came before District Judge Rose who refused to make an order for further disclosure against the FSA. That decision was appealed to His Honour Judge Zeidman QC sitting in the Edmonton County Court, who dismissed that appeal. With the leave of Ward LJ, Mr Durant further appealed to the Court of Appeal.

for the purposes of the appeal the FSA provided copies of the relevant documents to the Court. The Court of Appeal also received as fresh evidence a (second) witness statement from an associate in the Enforcement Division of the FSA about its filing system and various files and documents to meet certain points raised for the first time in the appeal.

The main decision was given by Auld LJ, who commenced by noting that the primary objective of the 1995 Data Protection Directive, upon which the Act was based, was to protect individuals' fundamental rights, notably the right to privacy and accuracy of their personal data held by others ("data controllers") in computerised form or similarly organised manual filing systems.

The Court of Appeal held^[4] that the appeal raised four important issues of law.

1. The personal data issue – What makes "data", whether held in computerised or manual files, "personal" within the meaning of the term "personal data" in section 1(1) of the 1998 Act so as to entitle a person identified by it to its disclosure under section 7(1) of the Act – more particularly in this context, to what, if any, extent, is information relating to the FSA's investigation of Mr. Durant's complaint about Barclay's Bank within that definition?
2. The relevant filing system issue – What is meant by a "relevant filing system" in the definition of "data" in section 1(1) of the 1998 Act, so as to render personal information recorded in a manual filing system "personal data" disclosable to its subject under section 7(1) – more particularly here, was the FSA's manual filing such a system so as to require it to disclose to Mr. Durant from those files information that would, if it were in computerised form, constitute "personal data" within section 1(1)?
3. The redaction issue – Upon what basis should a data controller, when responding to a person's request for disclosure of his personal data under section 7(1), consider it "reasonable in all the circumstances", within the meaning of that term in section 7(4)(b), to comply with the request even though the personal data includes information about another and that other has not consented to such disclosure?
4. The discretion issue – By what principles should a court be guided in exercising its discretion under section 7(9) of the Act to order a data controller who has wrongly refused a request for information under section 7(1), to comply with the request?

In relation to the personal data issue, the Court of Appeal considered the narrow scope applied to personal data in Criminal Proceedings against Lindquist, Case C-101/01 of the European Court of Justice. That case held "that 'personal data' covered the name of a person or identification of him by some other means, for instance by giving his telephone number or information regarding his working conditions or hobbies." Accordingly, the Court held that simply because the FSA's investigation of the matter emanated from a complaint by Mr Durant, that does not of itself render information obtained or generated by that investigation, without more, his personal data.^[5]

The court accepted two fundamental points:^[6] first, that the protection given by the legislation is for the privacy of personal data, not documents, the latter mostly retrievable by a far cruder searching mechanism than the former; and second, of the practical reality of the task that the Act imposes on all data controllers of searching for specific and readily accessible information about individuals. Furthermore, to constitute a "relevant filing system" a manual filing system must: 1) relate to individuals; 2) be a "set" or part of a "set" of information; 3) be structured by reference to individuals or criteria relating to individuals; and 4) be structured in such a way that specific information relating to a particular individual is readily accessible. Accordingly, this requires a filing system so referenced or indexed that it enables the data controller's employee responsible to identify at the outset of his search with reasonable certainty and speed the file or files in which the specific data relating to the person requesting the information is located and to locate the relevant information about him within the file or files, without having to make a manual search of them.

In relation to the redaction issue the Court also sided with the FSA. Auld LJ held that parliament could not have intended that courts in applications under section 7(9) should be able routinely to second-guess decisions of data controllers, who may be employees of bodies large or small, public or private or be self-employed.^[7] To so interpret the legislation in that manner would only encourage litigation and appellate challenge by way of full rehearing on the merits and, in that manner, impose disproportionate burdens on them and their employers in their discharge of their many responsibilities under the Act.

The Court noted that based upon its prior conclusions, the issue of discretion was no longer relevant. However, Auld LJ did proceed to comment that "I say only that I agree with the recent observations of Munby J in Lord, at para. 160, that the discretion conferred by that provision is general and untrammelled, a view supported, I consider, by the observations of the European Court in Lindquist, at paras. 83 and 88, to which I have referred".

Buxton LJ gave a short concurring judgment.