Johnson v Medical Defence Union

The Data Protection Act 1998 does not convert every human decision based on computer-held information into automated processing. Manual selection and analysis is not processing by automatic means merely because the source data was computerised or the conclusions were later recorded or transmitted electronically. Campbell v MGN Ltd [2003] QB 633 did not govern manual reasoning before automation. Fairness requires consideration of both the data subject’s and data user’s interests. A contractually permitted and reasonably foreseeable use of information may be fair without consultation. Distress under section 13(2)(a) requires damage under section 13(1), and reputational loss must be proved.

Mr Johnson, a consultant surgeon and MDU member, claimed compensation under the Data Protection Act 1998. He alleged that the MDU’s risk review unfairly selected information from his files and led to non-renewal of his membership, with resulting loss, distress and reputational damage.

Rimer J, in [2006] EWHC 321 (Ch), held that processing had occurred but that any unfairness was minor and inconsequential. The MDU cross-appealed on processing, causation and compensation. The central issues were whether manual selection for later electronic recording constituted processing, whether the policy was fair, whether any breach caused the loss, and what compensation was available.

Disposition

The appeal was dismissed and the MDU’s cross-appeal or respondent’s notice was allowed in material part. The order dismissing the claim was upheld. The court was unanimous on the result but divided two to one on whether the manual selection of information constituted processing.

1. Processing. Buxton LJ, with Longmore LJ agreeing, held that the complained-of act was Dr Roberts’s human selection and analysis of information. It was not processing by automatic means merely because the source material was stored on a computer or because her conclusions were later recorded or transmitted electronically. The automated stages did not retrospectively convert the preceding mental process into automatic processing. Campbell v MGN Ltd [2003] QB 633 was confined to its different facts and did not determine this issue. Arden LJ dissented on this point. She considered that selection connected with inputting information into a computer could be processing under the Directive and the Act.
2. Fairness. Alternatively, the court held that the MDU’s policy was not unfair. Fairness required consideration of the interests of both data subject and data user. The contractual context, the MDU’s absolute discretion to terminate membership, the foreseeable use of information for risk assessment, and the rational, good-faith purpose of protecting members’ funds were relevant. The fairness principle did not require consultation or representations about a contractually permitted use of information. The non-lead files raised a notification issue, but the processing caused no loss.
3. Causation and compensation. The hypothesis that a different risk policy would have produced a different decision was insufficiently pleaded and proved. Under section 13 of the Data Protection Act 1998, distress required qualifying damage. The Directive did not require compensation beyond pecuniary loss in these circumstances. The claimed expenditure was not proved to result from the breach, and reputational loss could not be presumed by importing defamation principles.
4. Reference. No reference was made to the Court of Justice because independent grounds already disposed of the appeal and the answers could not affect the outcome.

1. Court of Appeal (Civil Division) — In [2007] EWCA Civ 262, the appeal was dismissed, the MDU’s cross-appeal or respondent’s notice was allowed in material part, and the order dismissing the claim was upheld.
2. High Court of Justice, Chancery Division — In [2006] EWHC 321 (Ch), Rimer J held that processing had occurred but found no material unfairness and dismissed the claim.