Durant v Financial Services Authority

This appeal concerns access to information under section 7 of the Data Protection Act 1998 and the proper construction of the Act in light of Directive 95/46/EC. The Court held that most of the material sought by the appellant was not "personal data" within the meaning of section 1(1) of the 1998 Act and so was not disclosable under section 7. The Court further held that the four categories of manual files were not part of a "relevant filing system" for the purposes of the Act because the FSA's manual systems lacked the structured indexing that would make specific personal information readily accessible.

In relation to redaction, the Court explained the two-stage approach under section 7(4)–(6): first, whether third-party information is necessarily part of the data subject's personal data; and second, if it is, whether disclosure without consent is reasonable in all the circumstances. The Court emphasised that decisions on reasonableness require a proportionate review and that courts should not routinely substitute their own view for a data controller's decision.

Background and procedural posture. The appellant, Mr Michael Durant, sought disclosure from the Financial Services Authority (FSA) of information he described as his personal data under section 7 of the Data Protection Act 1998. The FSA supplied some computerised material (some of it redacted) but refused disclosure of material in four categories of manual files. The appellant appealed from a decision of His Honour Judge Zeidman QC at Edmonton County Court (24 October 2002). Permission to appeal to the Court of Appeal was granted by Ward LJ and the FSA provided unredacted documents for inspection under section 15(2).

(i) Nature of the claim. The appellant sought subject access disclosure of personal data held both electronically and in manual files; he also challenged redaction of names in disclosed computerised documents.

(ii) Issues framed by the Court. The Court set out four principal issues: (1) the meaning of "personal data" under section 1(1) of the 1998 Act; (2) the meaning of "relevant filing system" in respect of manual files; (3) the proper application of the section 7(4)–(6) test on redaction and reasonableness of disclosure of third-party identities; and (4) the principles governing the court's discretion under section 7(9) to order compliance with an access request.

(iii) Reasoning and conclusions. On "personal data" the Court adopted a purposive and restrictive construction consistent with the Directive: information must "relate to" the data subject in the sense of affecting his privacy or being biographical in a significant way or having the data subject as its focus. Material generated by the FSA's investigation of the appellant's complaint about Barclays Bank was held to be information about the complaint or about the bank rather than information about the appellant himself and therefore not his personal data.

On "relevant filing system" the Court concluded that manual files are only caught where they are structured and indexed so as to allow specific information about an individual to be readily and quickly located without a manual trawl. The FSA's manual files lacked the requisite structured referencing and indexing and so were not "relevant filing systems".

On redaction the Court explained the two-stage approach under section 7(4)–(6): first whether third-party information is necessarily part of the personal data sought, and second whether disclosure without third-party consent is reasonable in all the circumstances. The Court held that most redactions here did not involve personal data of the appellant; where redaction related to third-party identification the FSA had applied the statutory balancing process and courts should review such decisions with a proportionate, intensive standard but should not routinely substitute their own primary decision on the merits.

Finally, on the discretion under section 7(9) the Court observed that the discretion is general and untrammelled but that, on the facts and for the reasons given (no personal data and no relevant filing system), the appeal was dismissed.

Appeal dismissed. The Court held (i) the appellant was not entitled to most of the material because it was not his "personal data" within section 1(1) of the Data Protection Act 1998; (ii) the FSA's manual files did not constitute a "relevant filing system" as they lacked the structured indexing necessary to render specific personal information readily accessible; (iii) redaction must be approached by first deciding whether third-party information is necessarily part of the data subject's personal data and, if so, by a balancing test under section 7(4)-(6); and (iv) courts should review but not routinely substitute decisions of data controllers when exercising their discretion under section 7(9).

Appeal from His Honour Judge Zeidman QC, Edmonton County Court (decision dated 24 October 2002) to the Court of Appeal (Civil Division). Permission to appeal granted by Ward LJ (20 March 2003). Court of Appeal judgment: [2003] EWCA Civ 1746 (8 December 2003).