UK: Data Protection: Selecting And Inputting Personal Data Is Not Necessarily ´Processing´

The Court of Appeal has potentially reduced the scope of the Data Protection Act 1998 by deciding that collating data about an individual and putting them in an electronic format is not necessarily ‘processing’. If data are not ‘processed’, the DPA does not apply.

To view the article in full, please see below:

Full Article

The Data Protection Act (DPA) places obligations on organisations that control the processing of personal data. This case is important because it decides that performing certain activities on or with data is not ‘processing’ for these purposes.

Johnson, a surgeon, was a member of the Medical Defence Union (MDU). Through his membership he obtained professional indemnity insurance and professional support.

As a result of complaints received against Johnson, MDU asked Roberts, a doctor, to carry out a risk assessment. Roberts concluded that Johnson’s membership should be discontinued. MDU accepted this and ended his membership.

In carrying out her assessment, Roberts reviewed electronic and paper files. These contained personal data relating to Johnson. She manually selected various items of information and entered them onto computerised risk assessment forms.

Johnson, who was not given an opportunity to explain the complaints against him, claimed that this was unfair processing of his personal data: unlawful under the DPA. He sought compensation for loss of employment opportunities and damage to his reputation.

Legal issues

The court considered whether Roberts’s actions were ‘processing’, whether any processing had been ‘fair’, and what damages Johnson would be entitled to, if any. The key issue was ‘processing’: if Johnson’s data had not been processed then he had no claim.

Roberts was not ‘processing’ Johnson’s personal data when she compiled the risk assessment. Although the automatic operation of a computer on the data after they had been entered onto the risk assessment forms was processing, the contribution made by Roberts was not. The court refused to regard the whole dealing with Johnson’s case as a single processing activity.

The court stressed that data protection obligations only apply to automated processing (or to data contained in a relevant filing system). Roberts’s actions did not count because she was ‘using her own judgement, and not … any automatic means’.

The judges who heard the case gave detailed legal reasoning for their decision. But the strongest argument advanced was a policy one. As Lord Justice Buxton put it, ‘a very wide range of decision-making would be exposed to potential scrutiny by the court in terms of [the DPA’s definition of] "fairness"’ if the MDU’s actions in reviewing Johnson’s membership were found to be ‘processing’.

To take one of Lord Justice Buxton’s examples, a barber who allocates appointments to his customers and enters their names on a computer system could, if Johnson’s claims were accepted, be challenged on the basis that his allocation was not ‘fair’ under the DPA.

This decision appears helpful to organisations that review personal data for decision-making purposes. So long as such reviews are not processed by a computer, and do not involve use of a relevant filing system (as defined by the DPA), the principles of the DPA may not need to be followed.

But data protection law is complex and often unclear. The court struggled, as it has done in previous cases, to give meaning to the key terms used in data protection law. In a strong dissenting judgement, Lady Justice Arden came to the opposite conclusion to the other judges regarding ‘processing’. There is also a potential conflict with the famous Naomi Campbell paparazzi photographs case, in which the Court of Appeal held that ‘processing’ has a very wide meaning.

Whilst companies involved in processing data will welcome the possibility of limits to their DPA obligations, they should consider carefully what their decision-making process involves, and seek specific legal advice, before attempting to rely on this decision.

Johnson v Medical Defence Union [2007] EWCA Civ 262

Naomi Campbell v MGN Limited [2003] QB 633

This article was written for Law-Now, CMS Cameron McKenna's free online information service. To register for Law-Now, please go to www.law-now.com/law-now/mondaq

The original publication date for this article was 22/06/2007.