Johnson v The Medical Defence Union Ltd (1)

The restrictions governing an access request under the Data Protection Act 1998 do not generally prevent disclosure in separate proceedings alleging breach of the data protection principles. Section 15(2) applies to determining whether an access request under section 7 has been properly met. It does not govern disclosure under the CPR in claims under sections 10, 13 or 14. Documents may be relevant to those claims even though they are not “personal data” for access-request purposes. The court must nevertheless consider the legislative concern for protecting confidential information relating to third parties when exercising its disclosure discretion.

Mr Johnson, a consultant orthopaedic surgeon, sued the MDU concerning its decision not to renew his membership and the alleged processing of his personal data. His claims included relief under sections 7(9), 10, 13 and 14 of the Data Protection Act 1998.

An earlier application under section 7(9) had failed. Mr Johnson subsequently sought specific disclosure under the CPR of documents substantially overlapping with those withheld on the access request. The central issue was whether section 15(2), or the earlier failure of the access request, prevented that disclosure application.

1. The disclosure application was not barred. Section 15(2) of the Data Protection Act 1998 concerns only the court’s determination of whether an access request under section 7 has been properly complied with. It permits the court to inspect information while preventing disclosure to the applicant pending determination of the access request.
2. The access-request regime and disclosure under the CPR serve different purposes. Section 7 provides transparency about whether personal data are held and how they are processed. It is not concerned with establishing whether the data controller has acted improperly. By contrast, disclosure may be relevant to claims alleging breach of the data protection principles or seeking damages, rectification, blocking, erasure or destruction under sections 13 and 14.
3. The fact that documents are outside the statutory definition of “personal data” may not prevent them being disclosable in the substantive proceedings. In particular, manually held documents may fall outside the definition of data because they are not recorded in a relevant filing system, while nevertheless being material to an allegation that personal data are inaccurate. The judgment of the Court of Appeal in Durant v The Financial Services Authority, [2003] EWCA Civ 174, [2004] FSR 573, was relied on in explaining that distinction.
4. Section 15(2) has an indirect effect on the exercise of the disclosure discretion. The concern reflected in sections 7(4) to (6), namely protection of confidential information relating to third parties, may justify refusing disclosure, limiting it or permitting redaction.
5. The court decided only the broad principle. The appropriate disclosure order required amended pleadings and identification of the arguable claims and issues. Requests for further information under CPR Part 18 would generally be ordered only where they materially narrowed the dispute or avoided surprise without disproportionate cost. Requests 23, 40 and 43 were to be answered.

Not stated in the judgment.