Johnson v Medical Defence Union Ltd

Factual and Procedural Background

The Plaintiff, a consultant orthopaedic surgeon, made an access request under section 7 of the Data Protection Act 1998 ("the DPA") to the Defendant, a medical defence organisation providing medico-legal support and professional indemnity insurance to medical practitioners. The Defendant decided not to renew the Plaintiff's membership in January 2002, which affected the Plaintiff's ability to access discounted insurance and raised concerns about reputational harm. The Plaintiff contended that the Defendant failed to comply properly with the access request by providing redacted documents and withholding some documents altogether. This led to litigation commencing in February 2003.

The Plaintiff sought three forms of relief: an order compelling proper compliance with the access request under section 7(9) of the DPA; orders to prevent improper processing and to rectify, block, or destroy certain data under sections 10(4) and 14(4); and financial compensation under sections 13(1) and (2) for damage and distress caused by alleged improper data processing. The parties agreed at a case management conference that the issue of compliance with the access request should be determined as a preliminary issue, which is the matter before the court.

Since the initial response to the access request, the Defendant made further disclosures, including removing some redactions. The Court of Appeal decision in Durant v. The Financial Services Authority [2003] EWCA Civ 1746, issued after the case management conference, significantly influenced the interpretation of the DPA and led to amendments in the Defendant's defence.

Legal Issues Presented

1. Whether and to what extent the Defendant complied with its obligations under section 7 of the Data Protection Act 1998 in response to the Plaintiff's access request dated 22 January 2002.
2. What constitutes "personal data" within the meaning of the DPA and the scope of disclosure entitlements under section 7(1).
3. Whether certain manual records are subject to disclosure under the DPA, particularly in light of the definition of a "relevant filing system".
4. The permissibility and extent of redactions made by the Defendant, especially relating to third-party identities.
5. The nature and scope of the court's review powers under section 7(9) of the DPA when assessing alleged non-compliance by a data controller.

Arguments of the Parties

Defendant's Arguments

• The Defendant asserted that it was entitled to refuse to disclose certain manual records because they do not constitute "data" under the DPA, relying on the Court of Appeal's decision in Durant which restricts the application of the Act to data held in filing systems that allow ready accessibility.
• It argued that some documents disclosed were partially redacted appropriately to protect third-party identities and that some manual documents were not disclosable as they were not part of a relevant filing system.
• The Defendant maintained that it complied with the access request in accordance with the DPA and that the redactions were justified under sections 7(4) to 7(6), which protect third-party information unless consent is given or it is reasonable to disclose.
• The Defendant contended that it was not obliged to search or disclose data that were not held or processed at the time of the access request, including documents that had only been temporarily stored electronically in the past but were not currently processed.

Plaintiff's Arguments

• The Plaintiff contended that any document which had at any time been recorded electronically (e.g., typed and saved on a computer) should be treated as data and thus disclosable under the DPA, regardless of current processing status.
• He challenged the Defendant's assertion that certain documents were retained only in manual form, suggesting that these documents were likely stored electronically at some point and should be disclosed.
• The Plaintiff sought removal of redactions, arguing that he was entitled not only to his personal data but also to ancillary information such as the identity of recipients and sources of the data.
• He asserted a need for disclosure of third-party identities, alleging a possible conspiracy against him within the Defendant organisation and "spin" concerning his data, although this allegation was not pleaded or supported by evidence prior to submissions at the hearing.

Table of Precedents Cited

Court's Reasoning and Analysis

The court began by framing the scope of the DPA, emphasizing that the Act concerns "personal data" about a living individual who can be identified, and not all documents or information mentioning the individual. The court relied heavily on the Durant decision to clarify that only data held in a "relevant filing system"—one that allows ready accessibility analogous to a computerised system—are subject to disclosure under the DPA.

The court accepted the Defendant's position that many manual records did not constitute "data" because they lacked the requisite indexing or referencing to allow quick retrieval without manual search. The Plaintiff did not dispute this legal principle but challenged the Defendant's factual assertion that certain documents were retained only manually. The court found, on the balance of probabilities and based on the evidence including witness testimony and the nature of the documents, that the Defendant's assertions were credible and accepted them.

Regarding documents that had been prepared electronically and likely stored on computer hard disks, the court held that the Defendant was only required to disclose data that were being processed at the time of the access request. Data that had been temporarily stored electronically in the past but were no longer processed did not fall within the scope of the access request.

The court then addressed the nature of "personal data," applying the Durant test that information must have the data subject as its focus and affect his privacy, rather than merely mentioning or involving him tangentially. The court reviewed the disputed documents and identified some that contained the Plaintiff's personal data and others that did not. For example, routine logs or correspondence that did not focus on the Plaintiff's privacy were not personal data.

On the issue of redactions, the court considered the statutory provisions allowing withholding of third-party identifying information unless consent is given or it is reasonable to disclose. The court emphasized a two-stage test: first, whether the third-party information is necessarily part of the personal data sought; second, if so, a balancing exercise considering confidentiality and other factors. The court found that many redactions related to administrative staff identities, which were not sources of personal data within the meaning of the Act, and thus their non-disclosure was justified.

The court rejected the Plaintiff's argument that the Defendant should have enquired into the Plaintiff's reasons for wanting third-party information, noting that the Defendant is entitled to assess the legitimacy of the data subject's interest in disclosure based on available material. The Plaintiff's late-raised allegation of conspiracy was unparticularised, unsupported by pleadings or evidence, and thus given little weight.

Finally, the court noted the nature of its review under section 7(9) as supervisory rather than primary decision-making, requiring "anxious scrutiny" but deferring to the data controller's reasoned decisions where justified.

Holding and Implications

The court held that the Defendant has complied properly with its obligations under section 7 of the Data Protection Act 1998 in response to the Plaintiff's access request of 22 January 2002. The preliminary issue was answered in the affirmative in favour of the Defendant.

As a consequence, the Plaintiff's claim for an order compelling further disclosure or removal of redactions was not upheld. The court found no significant fault in the Defendant's response or redactions. The decision does not establish new legal precedent but applies the Durant principles to the facts of this case and confirms the limited scope of disclosure obligations under the DPA. The Plaintiff's distress caused by the loss of membership was noted but did not affect the legal outcome. The Plaintiff was able to obtain alternative professional indemnity insurance shortly after the membership termination.