Johnson v The Medical Defence Union Ltd (2)

Processing under the Data Protection Act 1998 includes selecting information from manual and electronic files and entering it into a computerised record. Fairness must be assessed in the contractual and commercial context in which the data controller operates. The Act does not generally require a commercial organisation to abandon a good-faith risk-management policy or consult the data subject about material processed under that policy. Where personal data is obtained from third parties, however, fair processing requires timely information about the data, its purpose and the subject’s access and rectification rights. A breach is compensable only if it caused damage. Section 13 permits compensation for proved pecuniary damage and, where that gateway is satisfied, distress, but not general damages for loss of reputation.

Mr Johnson, a consultant orthopaedic surgeon, claimed compensation under section 13 of the Data Protection Act 1998 after the MDU decided not to renew his membership under article 11(a) of its Articles of Association. The MDU had conducted a risk review based on files recording allegations, complaints and other incidents. Mr Johnson alleged that selecting and summarising this material without obtaining his responses was unfair processing and caused the termination of his membership, financial loss, distress and reputational harm.

The court also considered claims under sections 10, 14 and the fifth data protection principle. A preliminary section 7 access claim had previously been decided by Laddie J, with permission to appeal refused. The central issues were whether there had been processing, whether it was unfair, whether any breach caused the non-renewal, and what compensation was available.

1. Processing. Mr Johnson’s personal data was processed when information was selected from manual, microfiche and computerised files and entered into computerised risk-assessment documents. The definitions in section 1, read with section 1(2), covered the manual elements of a set of operations linked to automated processing. The reasoning in Campbell v MGN Ltd [2003] QB 633 was accepted and applied.
2. Lead files. The renewal document’s reference to processing for “risk management” informed Mr Johnson that his data could be used for the MDU’s internal risk-management purposes, including decisions about subscriptions and continuing membership. The further-information requirement in paragraph 2(3)(d) of Part II of Schedule I did not require consultation with him or an opportunity to make representations. The MDU was entitled to operate its established policy, which assessed potential risk by reference to allegations and incidents rather than their merits. The policy and its application to the lead files were not unfair.
3. Non-lead files. Different considerations applied to information obtained from other members. Mr Johnson had not been informed of its existence, purpose or his rights of access and rectification. The processing therefore failed the requirements of paragraphs 2(1)(b), 2(2)(a) and 2(3) of Part II of Schedule I and was unfair. It nevertheless caused no damage: the two files carried no score, were fairly summarised, and probably played only an immaterial part in the decision.
4. Individual summaries and causation. The summaries of the remaining files were accurate or materially accurate when assessed against the MDU’s policy. Even if further explanations had been included, the RAG would probably have applied the same policy and reached the same result. The claim therefore failed on causation. The court added that, if the more extensive policy proposed by Mr Johnson had been legally required, a different decision would probably have resulted.
5. Compensation. Section 13(1) permits recovery of proved pecuniary damage. Section 13(2)(a) permits compensation for distress only where that gateway is satisfied. General compensation for reputational harm is unavailable under section 13, although financial loss flowing from reputational injury may be recoverable. The claim for compensation was dismissed. The section 10 claim had been abandoned and was dismissed; the fifth-principle claim was dismissed; and the section 14 claim was left for further consideration.

This was a first-instance decision. The judgment records that Laddie J had previously determined the claimant’s section 7 access claim, and that permission to appeal was refused by both Laddie J and the Court of Appeal.