A judgment from the Court of Appeal on 7 February 2014 in the case of Edem v The information Commissioner & Financial Services Authority [2014] EWCA Civ 92, has held that "a name is personal data unless it is so common that without further information, such as its use in a work context, a person would remain unidentifiable despite its disclosure" (see paragraph 20 of judgment).
The definition of 'personal data' within the meaning of the Data Protection Act 1998 ('DPA') is often debated. Section 1(1) of the DPA defines 'personal data' as "Data which relates to a living individual who can be identified from those data, or from those data and other data which is in the possession of or is likely to come into the possession of the data controller and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual."
The Court of Appeal previously interpreted the application of this definition in the case of Durant v Financial Services Act [2003] EWCA Civ 1746 [2011] 1 Info LR 1 (Durant). Paragraph 28 of Auld LJ's judgment provided two notions to be used to determine if information is personal data. The first was whether the information is biographical in a significant sense, the second was if the information has the data subject at its focus and whether disclosure of such information would affect that data subject's fundamental right to privacy derived from the European Data Protection Directive 95/46/EC.
The most recent case before the Court of Appeal has now elaborated further on this interpretation, specifically examining whether an individual's name is automatically deemed personal data. Mose LJ, Beaton LJ and Underhill LJ questioned whether a person's name is automatically considered personal data simply because it identifies and relates to that individual, or whether it is necessary for that information to arise in some form of context which reveals more information about an individual beyond merely his or her name.
The facts of the case are very similar to Durant, involving an application by Mr Edem under the Freedom of Information Act 2000 ('FOIA') for the disclosure of information relating to complaints he had made to the Financial Services Authority ('FSA') regarding its regulation of a company. Specifically, Mr Edem sought information about the complaints and the names of the three individuals within the FSA who handled these complaints. The Information Commissioner declined to order the disclosure of these names in response to Mr Edem's information request, on the grounds of section 40(2) of the FOIA which permits exemption from disclosure of information which is personal data. On appeal, the First Tier Tribunal decided that the names of the officials did constitute personal data and ordered that they be disclosed. However the Upper Tribunal (Administrative Appeals Chamber) reversed this decision preventing the disclosure of the information, leading Mr Edem to appeal to the Court of Appeal.
The Court of Appeal sought to distinguish this case from that of Durant, finding that Auld LJ's two notions outlined above were not applicable to the facts of this case, where the issue was whether information comprising a person's name could be automatically considered personal data, rather than the issue of whether information which did not obviously relate to or specifically name an individual could amount to personal data within the meaning of the DPA.
In reaching the conclusion of the judgment and dismissing the application of Auld LJ's reasoning in the case of Durant, the Court of Appeal reiterated guidance from the Information Commissioners Office, which clarifies "It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked' to an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider biographical significance, only where information is not obviously about an individual or clearly linked to him."
Applying this guidance to the facts of the case, the Court of Appeal declared that the names of the individuals did amount to personal data, upholding the decision of the Upper Tribunal (Administrative Appeals Chamber) to prevent the disclosure of such information on the grounds of section 40(2) of the FOIA.
This case is significant because it adds weight to argument that the Durant test for determining if information is personal data within the meaning of the DPA is not definitive and is limited to certain factual scenarios. Furthermore it reconfirms that the Durant test should not be applied in isolation, without consideration of further tests that have proliferated, such as those arising from the case of Kelway v The Upper Tribunal, Northumbria Police and the Information Commissioner (2013) EWHC HC 2575 (Admin) ( see our previous blog).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.