Maloney v Alexander Johnson (A Firm)

Obtaining personal data contravenes section 55(1) of the Data Protection Act 1998 only where it is done knowingly or recklessly and without the data controller’s consent. Where the controller supplies the information in response to a clear request, the consent requirement is not satisfied. On a second appeal, permission requires a point of practice or principle of general importance, or another compelling reason. A new complaint, not part of the proceedings below, cannot provide that basis.

Following divorce proceedings, a county court ordered the applicant to transfer a mortgaged property to his former wife, conditional on payment of £3,000. He sued her solicitors, alleging that they had breached the Data Protection Act 1998 by obtaining mortgage redemption details from the Abbey National without his consent, and also alleging malpractice and obtaining goods by deception.

A Deputy Master struck out the latter claims. Eady J struck out the remaining data-protection claim on the ground that the information had not been obtained without the consent of the data controller. The applicant sought permission for a second appeal and an extension of time. The central issues were whether the statutory claim disclosed a reasonable cause of action and whether the second-appeal threshold was met.

1. Permission threshold. The application was for a second appeal. Permission required a point of practice or principle of general importance, or some other compelling reason. The applicant identified neither such a point nor any error of principle or practice in Eady J’s decision.
2. Data-protection claim. Section 55(1) of the Data Protection Act 1998 prohibits knowingly or recklessly obtaining personal data without the consent of the data controller. The Abbey National was the data controller. The solicitors’ letter identified their client, identified the mortgagor and requested a redemption statement. The Abbey National supplied the information in response. It followed that the information was not obtained without the controller’s consent, so the claim disclosed no reasonable cause of action.
3. New complaint. The applicant relied on an expanded pleading alleging late payment of the £3,000 ordered by the county court. That was an entirely new complaint and was not part of the proceedings before the Court of Appeal. No determination could therefore be made on it in this application.
4. Disposition. Permission to appeal was refused. The application for an extension of time was also refused.

1. Court of Appeal (Civil Division): Permission for a second appeal and an extension of time refused in [2002] EWCA Civ 1544.
2. High Court, Queen’s Bench Division: Eady J struck out the remaining claim for breach of the Data Protection Act 1998 on 13 June 2002.
3. Willesden County Court: A Deputy Master had previously struck out the claims alleging malicious prosecution, malpractice or obtaining goods by deception.