Johnson v Medical Defence Union Ltd

Under the Data Protection Act 1998, a subject access request concerns personal data, not a general entitlement to documents. Manual records fall within the statutory scheme only where their structure provides ready access to specific information about the individual. Information that was once stored electronically but has been deleted need not be searched for at the date of the request.

Personal data must have the individual as its focus and affect the individual’s privacy. A mere reference to the person, or information about a transaction in which the person was involved, is insufficient. Third-party source and recipient information is ancillary and narrowly construed. Disclosure of third-party identities requires a two-stage analysis: whether the information is necessarily part of the personal data, followed by the statutory balancing exercise.

David Paul Johnson, a consultant orthopaedic surgeon, applied against the Medical Defence Union Ltd for relief under the Data Protection Act 1998. He alleged that the MDU had failed properly to answer his access request under section 7, including by withholding documents and redacting information.

The parties agreed that compliance with the access request should be determined as a preliminary issue before claims concerning further processing, rectification and compensation were considered. The Court of Appeal’s decision in Durant v The Financial Services Authority [2003] EWCA Civ 1746 had been delivered after the proceedings began and materially affected the issues. The central question was whether, and to what extent, the MDU had complied with its section 7 obligations.

1. The preliminary issue was answered affirmatively. The MDU had complied sufficiently with its obligations under section 7 of the Data Protection Act 1998.

2. Following the approach in Durant v The Financial Services Authority [2003] EWCA Civ 1746, a relevant filing system must permit specific information about an individual to be identified and located with reasonable certainty and speed. A system requiring a manual search through unindexed files is outside the statutory definition.

3. The relevant question was whether the information was data held at the time of the access request. Information formerly stored electronically but subsequently deleted did not remain disclosable merely because it had once been searchable. The MDU’s evidence established, on the balance of probabilities, that the disputed records were retained only in manual form.

4. Personal data were construed narrowly. Information had to have Mr Johnson as its focus and affect his privacy. Mere inclusion of his name, involvement in a transaction, or storage in a file bearing his name did not suffice. Some case summaries and records focused on his professional history did constitute personal data, while other entries did not.

5. The identity of a third-party source or recipient was disclosable only where it formed a necessary part of the personal data. The reference to sources in section 7(1)(c)(ii) did not extend to every person through whose hands information passed, including ordinary administrative or secretarial staff.

6. The section 7(4) inquiry had two stages. First, the court or data controller had to decide whether third-party information was necessarily part of the personal data sought. Only then did the balancing exercise arise. The data controller could assess the likely legitimate reasons for disclosure from the material available and was not obliged first to ask the data subject to explain his reasons.

7. The court’s function under section 7(9) was supervisory review, involving anxious scrutiny rather than determination of the merits as a primary decision-maker. On the evidence, there was no significant fault in the MDU’s response. The remaining claims therefore did not arise for determination on this preliminary issue.

First-instance decision. The judgment records no appeal or earlier determination of the preliminary issue.