Durant v Financial Services Authority

A subject-access request under the Data Protection Act 1998 gives access to personal data, not to documents merely because they mention the requester or concern a matter in which he was involved. Information must be significantly biographical and have the individual, rather than a transaction, event or another person, as its focus.

Manual records fall within the Act only where the filing system is structured and indexed so that specific personal information is readily accessible without a manual trawl. Where third-party information necessarily forms part of the requester’s personal data, the controller must balance the interests under section 7(4). A court reviews that decision with anxious scrutiny, but does not ordinarily remake it on its merits.

Durant v Financial Services Authority concerned requests made under section 7 of the Data Protection Act 1998 for material held by the Financial Services Authority about the appellant’s complaint concerning Barclays Bank and the FSA’s investigation of it.

The FSA disclosed some computerised material, subject to redactions, but refused further disclosure. It contended that most material was not the appellant’s personal data and that its manual records were not part of a relevant filing system. District Judge Rose refused an order for further disclosure. Judge Zeidman QC, in the Edmonton County Court, dismissed the appellant’s appeal after inspecting the material.

The Court of Appeal considered the meaning of personal data, the requirements for a relevant filing system, redaction of third-party information, and the court’s discretion under section 7(9).

1. Appeal dismissed. Lord Justice Auld gave the principal judgment. Lord Justice Mummery agreed, and Lord Justice Buxton agreed with it in full while adding observations on personal data.

2. The right under section 7 of the Data Protection Act 1998 is a right to information constituting the applicant’s personal data in intelligible form. It is not a right to original documents or a means of obtaining third-party disclosure for litigation or a collateral complaint.

3. Information relates to an individual only where it is significantly biographical and has that individual as its focus. A mere mention, or information generated by an investigation into another person or body, does not become personal data merely because the individual instigated the investigation or can be identified from it. The material sought concerned the appellant’s complaints and the conduct of Barclays Bank or the FSA, rather than the appellant’s private, business or professional life.

4. A manual system is a relevant filing system only if it is structured or indexed so that a searcher can identify, with reasonable certainty and speed, both the files containing the requested specific personal information and its location within them. A system requiring staff to leaf through chronological or otherwise unindexed files is not comparable to a computerised search. The FSA’s files did not meet that standard.

5. Section 7(4) requires a two-stage approach. A controller first asks whether information about another identifiable person necessarily forms part of the requester’s personal data. Only then does the statutory balancing exercise arise. Reasonableness depends on all the circumstances, including the requester’s legitimate interest, confidentiality and the sensitivity of disclosure; no general rule resolves the balance.

6. On an application under section 7(9), the court reviews the controller’s decision with anxious scrutiny rather than routinely substituting its own merits assessment. The court’s general discretion under that provision was not determinative because the appellant had no substantive entitlement to the further material.

• Court of Appeal (Civil Division) — dismissed the appellant’s appeal in Durant v Financial Services Authority, [2003] EWCA Civ 1746.
• Edmonton County Court — Judge Zeidman QC dismissed the appellant’s appeal from District Judge Rose’s refusal to order further disclosure under section 7 of the Data Protection Act 1998.