Smeaton v Equifax Plc

A credit reference agency must take positive and proportionate steps to keep personal credit data accurate and up to date. A system that relies solely on consumers reporting changes is insufficient where the agency has not assessed whether a small, identifiable class of cases requires different treatment. The burden lies on the data controller to prove that it took the care and reasonable steps required by Data Protection Act 1998, section 13(3) and Schedule 1, paragraph 7. A statutory duty under the Act may coexist with a common-law duty of care. On the facts, retaining bankruptcy data after a stay and rescission breached both duties and caused the claimant’s inability to obtain funding.

The claimant sought damages from a credit reference agency after his credit file continued to record him as an undischarged bankrupt. The bankruptcy order had been stayed pending appeal and was later rescinded, with the petition withdrawn. Equifax removed the entry only after the claimant notified it in July 2006.

The first trial was confined to liability and causation. The issues were whether Equifax breached the Data Protection Act 1998, whether it owed a common-law duty of care, whether that duty was breached, and whether the breaches caused the refusal of funding and banking facilities sought for the claimant’s company.

1. Data protection duty. Equifax was subject to the fourth data protection principle requiring personal data to be accurate and, where necessary, kept up to date. Section 13(3) and Schedule 1, paragraph 7 imposed positive obligations. Equifax had to prove that it had taken reasonable care and reasonable steps to ensure continuing accuracy.
2. The obligation had to be assessed case by case by reference to reasonableness and proportionality. Equifax was entitled to recognise the practical difficulty of checking every bankruptcy record, but it had failed to distinguish ordinary bankruptcies ending by discharge from the small class whose orders were stayed, annulled or rescinded. It had not carried out a risk assessment, audit or review of whether inexpensive reporting arrangements could be developed with the insolvency authorities and other credit reference agencies.
3. Retaining the bankruptcy entry for more than five years, despite the stay and subsequent rescission, was a serious breach of the fourth principle and also breached the first and fifth principles. The statutory defence was not established.
4. Negligence. By operating as a credit reference agency and holding consumers’ personal data for the benefit of its customers, Equifax assumed a legal responsibility to exercise reasonable skill and care. The common-law duty was coextensive with the statutory duty. It was unnecessary to decide the alternative tests for a duty of care causing pure economic loss.
5. Causation. NatWest refused the company’s account, overdraft and loan applications because the claimant appeared to be a longstanding undischarged bankrupt. The inaccurate entry was the direct cause of the company’s inability to obtain funding in mid-2006 and subsequently. The four liability and causation issues were therefore answered yes.

Not stated in the judgment. This was a first-instance determination of liability and causation.