Edem v The Information Commissioner & Anor

A person’s name is personal data where the individual is identified by the name alone or by the name combined with contextual information, including information about employment. Identification is distinct from the ability to contact or trace the person.

The biographical significance and focus considerations discussed in Durant are aids for borderline cases. They are unnecessary where information is obviously about, or clearly linked to, an identifiable individual. Under section 40(2) of the Freedom of Information Act 2000, disclosure may therefore be withheld where it would contravene the first data protection principle and no necessity for processing in pursuit of a legitimate interest has been established.

The appellant requested information held by the Financial Services Authority about its handling of his regulatory complaint. The Authority withheld the names of three junior employees on the ground that they were the employees’ personal data. The Information Commissioner upheld that refusal.

The First-tier Tribunal decided that the names were not personal data and ordered disclosure. The Upper Tribunal reversed that decision in [2012] UKUT 464 (AAC). The appellant appealed to the Court of Appeal.

The central issues were whether the names, read with the employment context, constituted personal data and whether disclosure was necessary for a legitimate interest under Condition 6(1) of Schedule 2 to the Data Protection Act 1998.

1. The appeal was dismissed unanimously. The three employees were identifiable living individuals. Their names, combined with documents showing their employment and roles at the Financial Services Authority, constituted personal data within section 1 of the Data Protection Act 1998. It was immaterial that the names were not unique.

2. Identification did not require proof that the employees could be contacted or traced. The possibility of identifying an individual from a name and its context was sufficient. A person’s name is personal data unless it is so common, and the available context so limited, that the individual remains unidentifiable.

3. The Court of Justice authorities established that a name combined with job-related information may be personal data. Criminal Proceedings against Lindqvist and Commission v Bavarian Lager supported that conclusion.

4. The First-tier Tribunal had misapplied the two notions discussed in Durant v FSA [2003] EWCA Civ 1746. Those notions—biographical significance and whether the individual is the focus of the information—assist in borderline cases concerning information in which a person is merely mentioned. They do not govern the straightforward question whether disclosure of an identifiable person’s name is disclosure of personal data. Applying them to information plainly concerning the three employees was contrary to the statute, the Directive and Court of Justice jurisprudence.

5. The Information Commissioner’s technical guidance correctly recognised that consideration of biographical significance is unnecessary where information is obviously about, or clearly linked to, an individual. The employees’ names in the emails were obviously about them, so no further inquiry was required.

6. The appellant had not shown that disclosure was necessary in pursuit of a legitimate interest under Condition 6(1) of Schedule 2. The Upper Tribunal and the Information Commissioner were therefore correct to decline to order disclosure under section 40(2) of the Freedom of Information Act 2000. The Upper Tribunal’s decision was upheld.

1. Court of Appeal (Civil Division): Dismissed the appeal and upheld the Upper Tribunal’s decision: [2014] EWCA Civ 92.
2. Upper Tribunal (Administrative Appeals Chamber): Allowed the appeal from the First-tier Tribunal and restored the refusal to order disclosure: [2012] UKUT 464 (AAC).
3. First-tier Tribunal: Decided that the employees’ names were not personal data and ordered their disclosure.
4. Information Commissioner: Declined to order disclosure of the three employees’ names.