|
|
|
|
Johnson v MDU: Further guidance from the courts on data protection
LegalDay - News and Links for UK Law
Johnson v MDU - Further guidance from the courts on data protection - Act 1998
|
LegalDay
Home
Cases
CurrentIssues
LegalPractice
Jobs
News
SiteMap
|
|
Click
Here for the Latest Legal News
14 May 2004
Eversheds Johnson v MDU: Further guidance from the courts on data protection
This case further clarifies the definition of personal data but also further restricts an individual's right to see information which may refer to him. It must clearly focus on him and must be easily accessible to the data controller. However, the court has widened the circumstances where an individual can require a data controller to disclose personal data where that data refers to third parties. Under the Data Protection Act 1998, personal data may be disclosed to the individual to whom it relates (the data subject) when that individual makes a request for it from the body using that information (the data controller). The request for the information is known as a "subject access request". This recent case applies the Durant case (which has been the subject of a previous e80) in considering whether information held by the Medical Defence Union (MDU) was "personal data" relating to one of its former members. Interestingly, this case is the first since the guidance in the Durant case was produced. The court said that information that was at one time held in an electronic format, but no longer is, does not automatically have to be disclosed to a data subject following a subject access request. A data controller can only be required to search through data which it has at the time the request comes in. In addition, the court said that a data controller's employees must be able to identify relevant data at the outset with reasonable certainty and speed and without having to make a manual search. The court next followed the Durant case, in that it is only information which focuses on the data subject and affects his privacy which can be classed as personal data and therefore which may be disclosed. The court also said that if what is sought is not personal data, then neither the data nor the source or addressees of it are discloseable. The Durant case set out that the Act creates a presumption that information about a third party can only be disclosed to a data subject with the consent of that third party. However, this case sets out that information identifying a third party can be disclosed without his consent, where it is necessarily part of the personal data requested and where the data controller considers it reasonable to do so in all the circumstances, having considered all the facts of the case. Finally, under section 7(1)(c)(ii) of the Act, an individual may be entitled to information which the data controller has about the source of the individual's personal data. The court said that the definition of "sources" in section 7 of the Act is quite narrow and does not include every hand through which data may have passed (such as secretarial staff or a postman). Pawan Pandit -------------------------------------------------- |
|
Legalday Related Pages Privacy LinksContact
Eversheds More Commentaries From
Patenting software and business methods - Third update Author/Firm Profile |
Legalday Home
Recently On LegalDay
Browse Archives By Date
Disclaimer
© Day x Day Media Ltd 2006 - All worldwide rights strictly reserved
