COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
MR JUSTICE RIMER
Strand, London, WC2A 2LL
B e f o r e :
LADY JUSTICE ARDEN
LORD JUSTICE LONGMORE
| David Paul Johnson
|- and -
|The Medical Defence Union
WordWave International Ltd
A Merrill Communications Company
190 Fleet Street, London EC4A 2AG
Tel No: 020 7421 4040 Fax No: 020 7831 8838
Official Shorthand Writers to the Court)
Mr Richard Spearman QC and Miss Jacqueline Reid (instructed by Fladgate Fielder) for the Respondent
Hearing dates : 12-14 December 2006
Crown Copyright ©
Lord Justice Buxton :
The parties, their relationship, and the dispute
1. The claimant is David Paul Johnson. He is a consultant orthopaedic surgeon. The defendant is The Medical Defence Union Limited ("the MDU"). The MDU is a mutual society which provides its members (who are principally in the United Kingdom and Ireland) with a range of discretionary benefits in the nature of advice and assistance. Until July 2000, it also provided them with discretionary professional indemnity cover, although since then such cover has been provided by an insurance policy underwritten by an insurance company for which the MDU's subsidiary company has acted as agent.
2. Mr Johnson was a member of the MDU from 1980 to 1985 and again from 1 October 1986 to 31 March 2002. He has never been the subject of a claim for alleged professional negligence. Over the years he has, however, sought advice and assistance from the MDU in relation to professional questions and problems that concerned him, including complaints made against him. His contact with the MDU, and that from others about him, gave rise to the opening (at least since 1991) of 17 MDU files.
3. On 17 January 2002, the MDU wrote to Mr Johnson advising him that it had exercised its discretion under article 11(a) of its Memorandum of Association to resolve not to renew his membership after 31 March 2002, when his then current annual subscription would expire. The letter gave no reasons. Mr Johnson sought the reasons, but none was provided.
4. Mr Johnson was shocked. He had been given no forewarning of the possible termination of his membership. The immediate consequence of what he regarded as his "expulsion" from the MDU was the automatic termination of his professional indemnity cover, a serious thing for a professional person. He was able to obtain prompt alternative cover from the Medical Protection Society ("the MPS"), being cover of the like discretionary nature as the MDU had provided until July 2000 (the MPS does not provide its members with indemnity cover under an insurance policy). But he claims that his expulsion has caused him significant damage of a wider nature. He says he has had to disclose it to hospitals where he has, or has since sought, admitting rights or employment; and he asserts that it reflects that he was regarded by the MDU as a serious risk to its funds, which he says is likely to have had a chilling effect on hospitals who became aware of it. He claims it has damaged his professional reputation. He now asks to be compensated. His claim for compensation is brought under section 13 of the Data Protection Act 1998 ("the DPA") and is founded on the assertion that his expulsion was the consequence of the MDU's unfair processing of his personal data.
5. The MDU disagrees with every step in his case. But perhaps its main point is this. It says that over the years Mr Johnson was involved in, or was the subject of, a number of incidents and allegations in the course of his professional life, of which he and others made the MDU aware. By May 2001, his track record had caused the MDU's risk management department to carry out a risk assessment review in relation to him. That involved an assessment of the various incidents and allegations, with particular features of his case history also being scored by reference to a standard form system that the MDU applies to its members under its risk assessment policy. Mr Johnson's score was at a level which, in accordance with that policy, justified consideration of his future membership of the MDU by a committee of senior clinicians. The outcome of that consideration was the termination of his membership. The MDU's position is that the termination was properly in line with the operation of its risk assessment policy.
6. More particularly, the MDU's position is that its risk management policy, of which the scoring system is part, is not dependent on any allegation against the member being well founded, a question which the MDU does not attempt to answer. It depends simply on the fact that the allegation was made: the MDU does not endeavour to investigate its merits. It applies the same policy to all its members. If (which it disputes) it processed any of Mr Johnson's personal data whilst carrying out its risk assessment in relation to him, it asserts that he consented to it, that he knew that his data was liable to be processed for the MDU's risk management purposes and that the processing was in line with its established policy and was fair. It emphasises that it is a non profit-making body, with a duty to protect its funds in the interests of all members, and it asserts that the termination of Mr Johnson's membership was a decision responsibly made by it in the performance of that duty. It emphasises that, under its contractual relationship with Mr Johnson, it had an absolute discretion to terminate his membership.
7. Mr Johnson's riposte to that is that a risk management policy geared to an assessment of risk by reference to a catalogue of allegations and what he says is an irrational and arbitrary scoring system is inherently unfair. He says that the MDU should have brought his side of the allegations and incidents into consideration and taken account of it when engaging in the risk review. The MDU's unfair failure to do so is said to have been reflected in the manner in which it processed his personal data whilst performing its risk review and entitles him to statutory compensation for the damage to him to which he says it ultimately led. He accepts that the MDU had an absolute discretion to terminate his membership, but his case is that, but for the unfair processing, the decision to terminate it would not have been made.
8. The central questions which I have to decide are, therefore: (i) did the risk review involve any processing of Mr Johnson's personal data; (ii) if it did, was the processing unfair; (iii) if it was, has it been shown that, if the processing had been fair, the termination decision would probably not have been made; (iv) if Mr Johnson succeeds thus far, to what (if any) compensation is he entitled? The answer to each question is in issue.
9. It is fair to note that Mr Johnson's case is an apparently exceptional one. I was told that the MDU currently has about 160,000 members. The evidence was that in 2002 there were 26 risk review references (including Mr Johnson's) to the MDU committee which considers such matters. The committee recommended that 16 of the referred members (including Mr Johnson) should not have their membership renewed, and that was the decision that the MDU's Board of Management made in each case.
The MDU's procedure
30. Dr Stephen Green has been head of risk management for the MDU since 1994 (he is actually employed by MDUSL). He qualified as a medical practitioner in 1975 and, after various hospital training posts, trained as a general practitioner. He practised as a GP until March 1992, when he joined the MDU as a medico-legal adviser. In 2002, he was working full time for the MDU, but he has since resumed part-time practice as a GP. He explained that the MDU has, it considers, an obligation towards all its members to protect its funds and regards it as prudent to have an internal procedure for carrying out risk assessments with regard to members about whom it has concerns. That procedure in relation to any member involves a consideration of his case history, which is contained in files opened by the MDU (or MDUSL on its behalf) following any contact made with the MDU either by the member himself or by another member in relation to him. Such contact will typically be made in circumstances in which the member seeks advice, assistance or insurance indemnity. A file will normally only be opened in relation to cases in which correspondence in relation to the matter is already in existence and is provided to the MDU. Dr Green explained that his department also provides and advertises a clinical risk-management service to MDU members and he accepted that it had been doing so since at least about the mid 1990s.
31. The MDU's risk assessment procedure in operation by 2002 (when Mr Johnson's membership was terminated) dates from early 1998, when the MDU executive first implemented a formal procedure directed at identifying and assessing members whose membership might represent a disproportionate risk to MDU funds. Dr Tomkins said that the MDU had been giving thought to a risk assessment procedure since 1994. Dr Green, as head of the risk management department, had a central role in its formulation. The procedure was based on the MDU's experience of the underlying risk factors in complaints and claims reported by members. In devising the procedure, the MDU identified common features in cases reported by members which might be regarded as assisting as an early warning system of future losses. This was regarded as important because the benefits of MDU membership were and are provided on the "occurrence" basis I have mentioned. In time, the risk review process became carried out by MDUSL, but nothing turns on that.
32. Dr Green produced in evidence a document headed "Risk Assessment Procedure", which he said dated from May 1998 and was the subject of amendments resulting in a final version dated April 1999. It formed the core of the MDU's risk review policy but is drawn only in very general terms. It opens by stating that some members present a disproportionate risk to MDU funds and can be identified in a number of ways, and it gives three generalised explanations of how they might do so (including "having an unfavourable track record of claims/complaints/disciplinary matters"). It summarised the essence of the review procedure, including the scoring of the subject member. It regarded a score of up to 49 as representing a low risk; one of 50 to 74 as medium risk; and one of 75 and above as high risk. Cases with scores of over 50 were referred to the Risk Assessment Group ("the RAG"), a committee of medical practitioners appointed by the Board. The RAG's function was to consider the subject member's case, and make recommendations to the Board as to how it should be dealt with, and the document summarised the options so open to the RAG. It suggests that only a score of above 80 will deserve a recommendation of article 11 treatment. As I shall explain, Mr Johnson's score was exactly 80. It is not, however, said that this undermines the lawfulness of the recommendation that the RAG made in his case, namely that his membership should not be renewed after his subscription expiry date of 31 March 2002. Mr Johnson expressly disclaims any criticism of the fairness of the RAG's procedure or recommendation, or indeed of the ultimate decision itself, which was made by Dr Tomkins acting under a delegated power from the Board. His case is built exclusively on the assertion that the recommendation and decision were probably inevitable given the material with which the RAG was presented and that the real problem was that that material had been unfairly processed at an earlier stage. His case focuses on that earlier stage.
33. The 1998 document provides little detail as to the risk assessment procedure that was devised and has in practice been operated since then. The procedure was more fully explained in the evidence. It involves the completion in relation to the subject member of three documents: a Risk Assessment Review form ("the RAR form"); a pro forma score sheet ("the score sheet"); and a Risk Assessment Group sheet ("the RAG sheet"). The work is carried out by an MDU risk manager. In an appropriate case, the completed documents will all be referred to the RAG for consideration. Dr Green's evidence was that about 50% of members who are the subject of a risk assessment review have their cases referred to the RAG. It was still the practice of the MDU in 2001 and 2002 (when Mr Johnson's case came up for review) that a score of 50 or more was the level at which there would be a reference to the RAG, but Dr Green said that in cases where special factors were present there could be a reference even if the score was lower (for example, if it turned out that the member had provided misleading information to the MDU when applying for membership). The review of a member may lead to one of several outcomes: for example, (i) he may be notified under article 11(a) that his membership will not be renewed after the expiry of his current subscription; (ii) his membership may be terminated under Article 11(b); or (iii) he may be retained on the adverse risk register, with any instances of further contact being closely monitored. I now refer in more detail to the RAR form, the score sheet and the RAG sheet.
34. The completion of the RAR form is based on files opened in respect of the member. It will contain a summary of the member's case history. Any allegation, claim or complaint in respect of a member which is the subject of contact by that member with the MDU will generally have resulted in the opening of a file in the member's name. These files are so-called "lead files". Files opened with respect to like contact made by another member, but in which the member in question is also identified, are known as "non-lead files". The files are regarded by the MDU as the member's case history. When a file is opened a brief summary of the nature of the matter with which it is concerned is given to it. This is known as the "day one summary." When a risk manager is required to consider a particular member, he will consider the day one summary in relation to each file and will also review some or all of the underlying files, which will be held either in electronic or manual form. The usual practice is for review managers to consider the member's files over the previous ten years or, if there is a significant number of them, then at least the last ten files. Both assistance and advice files will be reviewed, the task being to identify potential risk factors. The risk manager will make summaries of his review in the RAR form and may add his own observations on matters that occurred to him in his review.
35. Dr Green made it clear, as did all the MDU witnesses (in particular, Dr Roberts, the risk manager who dealt with Mr Johnson's case), that it is no part of the review procedure for the risk manager, or anyone else, to form or express a judgment on the truth or otherwise of any allegations against the member recorded in the files. If the outcome of a particular allegation is known, it will be included in the review, but it will not always be known: the member may not have reported it. Even if the outcome is known and favourable, that is not regarded as a factor material to the risk assessment exercise. The MDU's risk assessment policy is based on the principle that it is the nature of the allegation or the incident, not its ultimate outcome, which is regarded as potentially relevant. It is the fact that an allegation has been made that is regarded as predictive in terms of future risk to the MDU's funds; and the rights or wrongs of the particular allegation or incident are regarded as immaterial. The purpose of the procedure is to identify markers for future potential risk. Dr Green did, however, also make clear in cross-examination that the allegations are looked at in the context in which they had been made and that the RAR form would set out that context. He said that it would seem to him to be unfair if the form merely set out a list of allegations, with no other information at all.
36. The MDU's experience in these respects is, as Dr Tomkins further explained, that the making of a claim or complaint, regardless of its merits, can be a marker of the likelihood of a future claim or complaint. The MDU engages in no attempt to establish the validity or otherwise of the allegation when engaging in a risk assessment review in relation to one of its members, or to assess blame or culpability, although if, by the time of the review any claim is a settled claim (that is, the MDU has made a payment), the MDU will take into account the fact of the settlement. In practice, it is obvious that the MDU could anyway rarely, if ever, conclusively investigate the merits of an incident or an allegation. The MDU's policy has been developed against a background in which the MDU's experience has taught it that there is no direct connection between clinical incompetence and the making of a claim or complaint. There are many doctors – the so-called "benign incompetents" (long on bedside manner, charm and communication skills but short on clinical skills) - who pose a risk to their patients but who will never suffer a complaint or claim; by contrast, a doctor who is clinically highly competent can attract claims; and there is often a long time-lag between the occurrence and the claim. Dr Tomkins referred to a study by Charles Vincent who had analysed some 8.5 million hospital admissions in three specialities and their related clinical records and had estimated that there had been avoidable adverse incidents in 5% of the cases, or in relation to 425,000 patients. But there had not been 425,000 claims or complaints.
The review in Mr Johnson's case
Suspension of inpatient and outpatient admitting rights pending investigation into alleged breach of regulations; member asked other member of staff to log into computer data, to which he had no access.
Member notified MDU of incident 2/00. The hospital manager had been approached by two separate junior members of administrative staff who reported that mbr had asked them to log onto system to which he had no access. Hospital manager indicated that similar problem had occurred in 1999, following which member assured management that he recognised error and would not repeat.
Suspended following final occurrence.
Member advised that this is a BMA issue, or that private legal proceedings an option. Board of Management decision that member be not assisted in this case and that member be referred to RA Group
The Judge then gave, at his §§ 44-47, an account of the process that followed:
44. The case was referred to Dr Karen Roberts. Dr Roberts has both medical and legal qualifications. She had joined the MDU in 1999 as a Senior Medical Claims handler and on 2 April 2001 she became employed by MDUSL as a clinical risk manager. There were about four other risk managers also carrying out reviews. Dr Roberts had received training for the task, in particular that her function was to summarise allegations against the member although she also understood that they had to be summarised in a sufficient context to show the circumstances in which they had been made. The review would also include the outcome of the allegation, if known, although often it will not. In Mr Johnson's case, as in others, Dr Roberts's task was to prepare an RAR Form, a score sheet and a RAG sheet. She had previously prepared like documentation in other cases and she followed the usual practice. Since 2001, she has carried out about one or two risk reviews per month.
45. Dr Roberts worked on a blank RAR form, score sheet and RAG sheet on an MDUSL computer. She completed the RAR form on 27 November 2001, recording in its first six boxes Mr Johnson's initials (not his name), address, MDU membership number, GMC number, the date he joined the MDU (recorded as 1 October 1986: she made no reference to his prior period of membership), the date of the next renewal of his membership (1 April 2002), his qualifications ("MD MB ChB FRCS (Orth)"), his surgical speciality ("Orth/Trauma Surg"), and his non-indemnified income (£125,000, being his private practice income and so relevant to the professional indemnity cover provided). The form is deliberately anonymous and if (as with Mr Johnson) the case is referred to the RAG, they will not know the identity of the member.
46. Dr Roberts derived from Mr Johnson's case history (held on computer under his MDU membership number) that 17 files had been opened for him since 1991 (the practice is to go back ten years). She recorded this in the RAR form, describing 11 files as "active" (an active file is one that has not been closed on the system, although she added that seven such files were apparently either inactive or raised statute-barred allegations) and the other six as "advice" files. She wrote "Nil" against "Costs", "Indemnity" and "Legal" and recorded a figure of £300 for "Reserves". That meant that the matters raised in the various files had not resulted in any call on MDU funds, although a small (and unexplained) reserve of £300 had been provided for.
47. Dr Roberts listed in the RAR form each of the 17 files and their day one summaries. She also retrieved and reviewed ten of the underlying files going back to 1995: with regard to the earlier ones, she merely set out the day one summaries. She gave a compressed summary of each file she reviewed.
(i) did the risk review involve any processing of Mr Johnson's personal data; (ii) if it did, was the processing unfair; (iii) if it was, has it been shown that, if the processing had been fair, the termination decision would probably not have been made; (iv) if Mr Johnson succeeds thus far, to what (if any) compensation is he entitled?
Put shortly, the Judge's answers were (i) yes; (ii) only in a minor and inconsequential respect; (iii) and (iv) do not arise, but if they did the answers to them would be (iii) yes, on the balance of probabilities; (iv) £10.50 for pecuniary loss, £5,000 for distress; and if (contrary to Judge's view) damage to reputation is a valid head of claim under the 1998 Act, £1,000 in that respect. The appellant appeals against the Judge's finding (ii), and against his approach to, and thus the level of the sums awarded under, (iii) and (iv). The respondents cross-appeal against finding (i) and against findings (iii) and (iv), saying that in any event no damages were recoverable. It hardly needs to be said that that brief summary does not do justice to the elaboration of the issues, to which I now turn.
Was there processing of data in the terms of the 1998 Act?
The legislative framework
2. Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy….
7. Whereas the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory of one Member State to that of another Member State…..
10. Whereas the object of national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community
11. Whereas the principles of the protection of the rights and freedoms of individuals, notably the right to privacy, which are contained in this Directive, give substance to and amplify those contained in the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to the Automatic Processing of Personal Data
The 1998 Act
1.-(1) In this Act, unless the context otherwise requires –
'data' means information which –
(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose,
(b) is recorded with the intention that it should be processed by means of such equipment,
(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system…..
data controller' means, subject to subsection (4), a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed;
'data processor', in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller;
'data subject' means an individual who is the subject of personal data;
'personal data' means data which relate to a living individual who can be identified –
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
'processing', in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including –
(a) organisation, adaptation or alteration of the information or data,
(b) retrieval, consultation or use of the information or data,
(c) disclosure of the information or data by transmission, dissemination or otherwise making available, or
(d) alignment, combination, blocking, erasure or destruction of the information or data; …
(2) In this Act, unless the context otherwise requires –
(a) 'obtaining' or 'recording', in relation to personal data, includes obtaining or recording the information to be contained in the data, and
(b) 'using' or 'disclosing', in relation to personal data, includes using or disclosing the information contained in the data. …
4. – (1) References in this Act to the data protection principles are to the principles set out in Part I of Schedule I.
(2) Those principles are to be interpreted in accordance with Part II of Schedule I.
(3) Schedule 2 (which applies to all personal data) … [sets] out conditions applying for the purposes of the first principle; …
(4) Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller. …
i) The information held by the MDU in relation to Mr Johnson's career and claims record was his personal data
ii) The MDU was a data controller in respect of that data
iii) It was therefore the duty of the MDU to comply with the data protection principles in respect of that information.
That is why it is crucial to this case to determine whether any relevant "processing" of Mr Johnson's data had taken place, because the main thrust of Mr Johnson's complaint is that it was the MDU's processing of his data that infringed the Data Protection Principles, and thus was unlawful under the 1998 Act.
THE DATA PROTECTION PRINCIPLES
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –
(a) at least one of the conditions in Schedule 2 is met, …
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. …
INTERPRETATION OF THE PRINCIPLES IN PART I
The first principle
1. – (1) In determining for the purposes of the first principle whether personal data are processed fairly, regard is to be had to the method by which they are obtained, including in particular whether any person from whom they are obtained is deceived or misled as to the purpose or purposes for which they are to be processed. …
2. – (1) Subject to paragraph 3 [which is not material], for the purposes of the first principle personal data are not to be treated as processed fairly unless –
(a) in the case of data obtained from the data subject, the data controller ensures so far as practicable that the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3), and
(b) in any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3).
(2) In sub-paragraph (1)(b) 'the relevant time' means –
(a) the time when the data controller first processes the data, or …
(3) The information referred to in sub-paragraph (1) is as follows, namely –
(a) the identity of the data controller,
(b) if he has nominated a representative for the purposes of this Act, the identify of that representative,
(c) the purpose or purposes for which the data are intended to be processed, and
(d) any further information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair. …
The acts alleged to constitute the processing of Mr Johnson's personal data
Selecting the information contained in the personal data and thereby presenting a false picture of the situation.
The selection was the process that was performed by Dr Roberts when she drew up the RAR form, score sheet and RAG sheet: see §8 above.
Extended definitions of processing of data
'processing of personal data' shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means
the emphasis being supplied by the appellant. Taken literally, that definition cannot be reconciled either with article 3.1, referred to in §24 above; or with recital 15 to the Directive, which reads:
Whereas the processing of such data is covered by this Directive only if it is automated or [if the data is contained in a relevant filing system]
The answer would seem to be that the very general definition of "processing" in article 2(b) was intended to cover both of the cases addressed by the Directive: automatic processing on the one hand; and processing of material in a relevant filing system on the other. So read, it does not assist the appellant on the present point.
Processing as a continuous operation
This Directive shall apply to the processing of personal data wholly or partly by automatic means…
However, first, that contention assumes what it has to prove, that the relevant "processing" in the present case is the whole operation on Mr Johnson's data. And, second, I found persuasive Mr Spearman QC's suggestion that this definition is an anti-avoidance provision, to prevent arguments that, because some manual operations had occurred in the course of processing, none of that processing could fall under the Directive.
Does it constitute 'the processing of personal data wholly or partly by automatic means' to list on a self-made internet home page a number of persons with comments and statements about their jobs and hobbies etc?
The ECJ held that the listing of the parishioners was the processing of their personal data, and that the process had been "performed, at least in part, automatically" because of the loading of the page on to the server. The selection of the data had been purely manual, yet there was no suggestion that the processing taken as a whole was not automatic. It is, however, important to remind ourselves of the terms of the question that was asked in Lindqvist, which was limited to whether using the computer to place the list on the net was processing. Plainly it was, for the reason given by the ECJ. By the same token, when Dr Roberts caused the computer to transmit her conclusions to the RAG data was being processed. But it does not help Mr Johnson to establish the latter point, because what he complains of is unfair conduct in the reaching of those conclusions, before that processing of the conclusions took place. I think that in the end it was agreed by the appellant that Lindqvist does not assist in our present concerns.
Campbell v MGN Ltd  QB 633
the definition of processing is so wide that it embraces the relatively ephemeral operations that will normally be carried out by way of the day-to-day tasks, involving the use of electronic equipment, such as the laptop and the modern printing press, in translating information into the printed newspaper.
For that reason, it was inevitable that there had been processing of data by automatic means leading up to the print publication, and no-one seems to have argued to the contrary. But that was not the end of it. The issue that exercised the court was that set out in the cross-heading before the court's §§ 96-106: Does the Act apply to the publication of hard copies? And that on the facts was the important question, because it was that publication that infringed C's privacy, in breach inter alia of that part of the first data principle that requires the consent of the data subject to the processing.
While an individual may reasonably find it objectionable that another should record and hold personal data about himself, the greater invasion of privacy, damage and distress is likely to be caused when that information is made public.
In that context, the compensation provisions would not be effective to protect the privacy of a data subject's personal data if (§105) publication was not treated as part of the operations covered by the requirements of the 1998 Act.
101. The definition of "processing" in the Directive and the Act alike is very wide. "Use of information or data" and "disclosure of information or data by transmission, dissemination or otherwise making available" are phrases, given their natural meaning, which embrace the publication of hard copies of documents on which the data has been printed. Is such a meaning consistent with an interpretation which gives effect, in a sensible manner, to the objects of the Act?
103. The Directive and the Act define processing as "any operation or set of operations". At one end of the process "obtaining the information" is included, and at the other end "using the information". While neither activity in itself may sensibly amount to processing, if that activity is carried on by, or at the instigation of, a "data controller", as defined, and is linked to automated processing of the data, we can see no reason why the entire set of operations should not fall within the scope of the legislation. On the contrary, we consider that there are good reasons why it should.
And the court then set out the policy reasons for that approach that I have referred to in §36 above.
Under section 32(1) it is the data which is exempt from the provisions of the Act specified in subsection (2). The Act only applies in relation to data. If, as we have held, the Act applies to publication, as part of the processing operation, it does so because the information published remains "data", as defined by the Act.
We must, of course, be wary of reading too much into that observation. But, first, it reinforces the focus of the court's concern, as already set out. And, second, if the explanation is that the information remains "data", by section 1(1)(a) the information achieves that status only because it was processed by means of equipment operating automatically. Information at the pre-processing stage does not share that quality.
Some implications of the Judge's view
Was the processing fair?
I find that in no case did her summary, again measured by reference to the MDU risk assessment policy, reflect any unfairness, or at any rate any material unfairness.
That general conclusion was not challenged before us.
The MDU's policy and the Judge's approach to it
The complaint is that, having processed the personal data from the lead files, Dr Roberts did not consult Mr Johnson about the fruit of her work. But by then the relevant processing had been done and the suggested consultation cannot naturally be regarded as a continuation of the processing. Mr Johnson's complaint that he was not consulted about Dr Roberts's work is, in substance, nothing other than a complaint that he was not entitled to make representations to the RAG about his case. He has specifically disclaimed that he had any right to do so, and so his case under this head is nothing other than an attempt to say that he should have enjoyed a like right at an earlier stage and as part of the processing exercise. In my judgment, that contention is misconceived.
That the Judge thought that "the relevant processing" was completed as soon as Dr Roberts had made her selection was, of course, loyal to Mr Johnson's pleaded case, but as a broad proposition it is difficult to reconcile with his analysis of the nature of processing, as discussed above. But however that may be, the Judge was with respect right to think that no guidance as to fairness was to be found in the legislation.
109. In considering this, I regard the starting point as the MDU's risk assessment policy. As I have explained, and find, that policy was one under which the MDU assessed a member's potential risk to MDU funds by reference exclusively to the allegations made against him, or the nature of the incidents in which he was allegedly involved. Whether the allegation was justified or not was regarded by the policy as irrelevant, as was (at least generally) the outcome of the allegation (if known). It is easy for an outsider, with no experience of the type of risk management in which the MDU was engaged, to leap to a judgment that such a policy was unfair and that a fairer one - which might perhaps be expected to enable a more reliable assessment of future risk – would be one in which the merits of each allegation are, so far as possible, assessed, although there are obvious limits to that possibility. If a policy of that sort were one that the MDU in fact employed, it is also easy to see that a fair assessment of the merits could only be arrived at after (at least) consulting the subject member for his comments on the allegations made against him.
110. That, however, is not the policy that the MDU has developed and adopted and, with respect to Mr Howe's unqualified submission to the contrary, I regard it as no part of the court's function to pass judgment on the merits of the policy that it did adopt. The policy was devised as a result of the MDU's own experience and its formulation was essentially a matter of commercial judgment exercised in what I have no doubt was complete good faith in the interests of the members of the MDU generally. It was also formulated against the background of a contractual relationship between the MDU and its members under which the MDU had and has an absolute discretion to terminate a member's membership and in which it was in the interests of all members that it should have a sound risk assessment policy. …Like all MDU members, [Mr Johnson] must take the MDU risk assessment policy as he finds it; and, given its nature, I see no basis on which it can be said that his input was necessary in order that the data could be fairly processed. The MDU could process his data in the circumstances in which it did perfectly fairly without his input, and the evidence from the MDU witnesses satisfied me that his input would be unlikely to have made any difference to the assessment of his case: because, put shortly, the policy regards a member's input as essentially irrelevant.
The Judge's conclusion on fairness
It is easy to see how [Mr Johnson] regards the decision in his case as unfair but it has to be remembered that the policy is directed at risk management – at preserving the MDU funds against a risk of claims, and the incurring of costs, in the future. The MDU experience is that a risk of that nature cannot be measured simply by awaiting the happening of a statistically significant number of occurrences that do in fact cause a drain on its funds. It is also that the risk of complaints is not a matter that is necessarily geared to the clinical competence of a doctor. The likelihood of complaints may well be based just as much on the way in which the doctor gets on with his colleagues and patients. A complaint, when made, may well be unfounded, but may also be expensive to defend. The objective of the risk management policy is to minimise the exposure of MDU funds to such expense. The policy that the MDU has developed is to assess risk by reference to whether the particular doctor attracts complaints. It is not assessed by an attempted investigation of whether there is anything in such complaints, an investigation which in practice could anyway not be carried out in any conclusive way. It would be possible to obtain the member's view of the complaint, but it is not part of the policy to do so because (a) it would only provide part of the picture and (b) it is a part which the policy does not regard as material to the assessment which the risk review is making. A wider investigation would usually be impracticable. In defending the MDU's risk assessment policy as fair, Mr Spearman emphasised that it has to be viewed against the background in which there is a contractual relationship between the MDU and its members and in which the MDU has a positive duty, in the interests of all its members, to adopt a responsible risk assessment policy directed at preserving its assets. The fairness of the processing of a member's personal data has to be considered in that contractual context.
If the processing had been unfair, would that unfairness have affected the MDU's decision?
201. The final hypothesis I have to consider is the possibility that, contrary to my view, the requirements of fair processing under the DPA required the MDU to tear up its established risk assessment policy and operate the quite different type of policy that Mr Johnson urged would have been fairer. That was one which required the abandoning of the score sheet, with its alleged potential for arbitrariness and irrationality; which required the RAG to assess so far as possible the merits of a particular incident or allegation, at any rate by taking account of the subject member's representations on it; and which required the RAG to engage in a more sensitive analysis of which incidents and allegations were of real potential seriousness and which were not.
202. For reasons given, I reject the suggestion that Mr Johnson was entitled to have his data processed and case considered by reference to his own inexpert assertions as to the risk assessment policy that the MDU should apply. I consider he had to take the MDU's policy as it was and is. If, however, I am wrong on that and Mr Johnson is right that his data should have been processed, and his case considered, in the way I have just summarised, then I find that it is probable that the MDU would have come to a different decision about the termination of his membership.
"Unfair processing led to unfair meeting documents leads to expulsion"
That said nothing to alert the MDU to the need to meet the specific hypothesis adduced by the Judge.
The legislative structure
Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of an act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered
The Judge recalled that article 249 EC leaves to member states "the choice of form and methods" in achieving the results required by a Directive. That choice has been made in section 13 of the 1998 Act, which provides:
13. – (1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if –
(a) the individual also suffers damage by reason of the contravention
I am prepared to find, on the probabilities, that the £10.50 for the extra breakfast was referable to the meeting with the MPS representative. I have no reason not to accept Mr Johnson's evidence that such a meeting took place
No doubt the meeting took place, but the Judge had no evidence from Mr Johnson that it was over breakfast or that the extra breakfast that he paid for was eaten by the MPS representative; and much less that any purchase of breakfast was required of Mr Johnson as a step in the process of obtaining cover, a matter that I am certainly not prepared to assume. The Judge was not entitled to find that this, the only item of pecuniary damage that survived, was attributable to damage for which the MDU was responsible.
Reference to the European Court of Justice
Lady Justice Arden:
(1) the 1998 Act must be interpreted so far as possible in conformity with the data protection directive 95/46/EC ("the directive");
(2) the directive applies to the selection of information constituting personal data which following such selection is to be placed on a computer;
(3) the decision of the Court of Justice of the European Communities ("the Court of Justice") in the Lindqvist case  QB 1014 provides some slight support for this conclusion;
(4) the statutory definition of "processing" in the 1998 Act can be interpreted in conformity with the directive;
(5) my conclusion on processing is consistent with the conclusion of this court in Campbell v MGN  QB 633;
(6) accordingly, the judge was right to conclude that the selection of personal data about Mr Johnson and its presentation on the RAR form, the RAG form and the score sheet constituted "processing" for the purpose of the 1998 Act, and the Medical Defence Union Ltd ("the MDU") as the data controller thus had a duty to comply with the data protection principles.
The importance of the issue
(1) The 1998 Act must be interpreted so far as possible, in conformity with the directive
"72. It has been said European Union legislation is "a negotiated law" (Jean-Claude Piris, The Legal Order of the European Community and of the Member States: Peculiarities and Influences in Drafting). It is often the product of compromise. In the context of the European Union, legislation has to be negotiated between different sovereign states with separate interests. For this reason, it may not be possible to obtain a precise text. To obtain agreement, an element of ambiguity must be left for later resolution. The very nature of this kind of legislation places a greater burden on courts than domestic legislation where the scheme of the legislation is generally worked out in great detail."
"73. …Under what is now article 249 of the EC Treaty, a directive is binding as to the result to be achieved but needs to be implemented in a member state to have effect. The effect of a directive in the United Kingdom is governed by the legislation bringing the EC treaties into force in the United Kingdom, namely section 2 of the European Communities Act 1972. Section 2(1) of the 1972 Act incorporates obligations under the EC Treaties into domestic law. It also provides a means for the incorporation of later directives into domestic law by secondary legislation. Thus, section 2(2) of the 1972 Act provides that designated Ministers can make regulations for the purpose of implementing any Community obligation of the United Kingdom. Then section 2(4) of the 1972 Act provides:
"… any enactment passed or to be passed, other than one contained in this Part of this Act, shall be construed and have effect subject to the foregoing provisions of this section;"
74. The 1972 Act thus contains the mandate for the English courts to interpret domestic legislation in accordance with applicable European Union directives. The courts may have to interpret domestic legislation in this way because it was adopted specifically in order to implement such directives. It may also have to interpret legislation in accordance with European Union law even though it (the domestic legislation) was enacted for another purpose if it in fact contains the provisions which have to be enacted in the member state to implement a directive or which, if the directive were properly implemented, would be affected by it, and the date for implementing the directive has passed.
75. The approach of the English courts when interpreting UK legislation designed to give effect to Community legislation is to construe the English legislation so far as possible so as to make it compatible with the Community legislation. This is the approach that the English courts adopt to legislation implementing international treaties generally. In addition, when Parliament recently incorporated the European Convention on Human Rights into domestic law, it took the same formula and used it to impose an obligation on English courts to interpret domestic statute law, so far as possible, compatibly with human rights (Human Rights Act 1998, section 3). ..
77. Non-implementation or defective implementation of a European Union directive may lead to liability on the state: Francovitch v Italy  2 CMLR 66…
78.…Where there is no preliminary ruling from the Court of Justice and difficulties arise because the case cannot be said to be acte clair, it may be necessary to seek a preliminary ruling from the Court of Justice… In Kobler v Austria  2 WLR 976, the Court of Justice held that in special circumstances a state can be liable if the final court of appeal in a member state declines to refer a question of the interpretation of the EC treaties to the Court of Justice, and takes a wrong view of the EC law. This may lead to national courts taking a more restrictive view of acte clair in the future.
79. The Court of Justice lays down the obligations of national courts with respect to European Union legislation. The Court of Justice has held that the national court's obligation is to interpret domestic legislation, so far as possible, in the light of the wording and the purpose of a directive in order to achieve the result pursued by the directive and thereby comply with Community obligations: see Marleasing S.A. v La Commercial Internacional de Alimenation SA at para 8. In this judgment, I refer to this obligation as the Marleasing principle. It is sometimes also referred to as the principle of conforming interpretation. The Court of Justice has held that the obligation may apply even if the relevant legislation was passed before the relevant Community legislation: Webb v EMO Air Cargo (UK) Ltd  QB 718, and see S.Vogenauer, Richtlinienkonforme Auslegung Nationalen Rechts, (1997) ZEuP 158.
"81. The approach described above makes it clear that, while under European Union law the member states are bound to interpret national legislation so far as possible in conformity with the wording and purpose of a directive, it is for domestic law to determine how far the domestic court can change other provisions of purely domestic law to fulfil this obligation. Thus in this situation the national court is not concerned to ask what interpretative approach is adopted by the courts of the other member states of the European Union. The question how far it can go under the guise of interpretation, and whether it can for instance adopt what would otherwise be regarded as a strained construction, is a matter for domestic law.
82. Normally when construing domestic legislation, the English courts must find the meaning of the words which Parliament has used. In the context, however, of legislation which requires to be construed in a way which is compatible with European Union law or with the rights conferred by the European Convention on Human Rights, the English courts can adopt a construction which is not the natural one. The process, however, remains one of interpretation: the obligation imposed by the Court of Justice is only to interpret national law in conformity with a directive "so far as possible". That raises the question when a process ceases to be that of legitimate interpretation and trespasses into the field of lawmaking that is the task of Parliament and not the courts."
"85. However, further guidance is now provided by Ghaidan v Godin-Mendoza. As I have explained above, this was a case under section 3 of the Human Rights Act 1998 and is thus not a case in which the House had to consider the interpretation of legislation so as to make it compatible with the wording and purpose of a directive. However, under section 3 of the 1998 Act, the court has to interpret legislation "so far as possible" in a manner which is compatible with Convention rights. The case is therefore in my judgment authority as to what is "possible" as a matter of statutory interpretation. The similarities in this regard between interpretation under section 3 of the 1998 Act and under the Marleasing principle are illustrated by the fact that Lord Steyn traced the origin of the interpretative obligation in section 3 to the Marleasing case and that both Lord Steyn and Lord Rodger in their speeches relied on (inter alia) the Litster case as demonstrating that the court could read in words in order to interpret legislation under section 3(1) of the 1998 Act. In those circumstances, in my judgment, the guidance given by the House of Lords in that case as to the limits of interpretation can also in general be applied to when the limits of interpretation under the Marleasing principle arise for consideration….
92. Although the technique of interpreting domestic legislation as far as possible in conformity with European Union law has now been applied (with necessary alterations) to test whether the legislation is compatible with the ECHR, I recognise that the context is different in some respects. The obligation to comply with the Convention is imposed on the member state. The Convention does not bind the courts of a member state. But the actions of the courts can place the member state in breach of its obligations under international law. Furthermore, the Human Rights Act 1998 provides the court with an alternative solution, namely that of making a declaration of incompatibility (Human Rights Act 1998, section 4). This alternative was inserted in the interests of preserving Parliamentary sovereignty. No such alternative is available for domestic legislation implementing European Union legislation. I doubt however whether much turns on this point. Section 3 imposes an obligation to interpret legislation compatibly with Convention rights, not a discretion to do so. Accordingly, I consider that the differences in concept between section 3 interpretation and interpretation under the Marleasing principle are more apparent than real. As already stated I consider that the Ghaidan case is a helpful guide when determining the interpretation under the Marleasing principle. I see no reason why the same robust techniques used to make legislation compatible with the ECHR should not equally apply to make domestic legislation comply with the laws of the European Union."
(2) The directive applies to the selection of information constituting personal data which, following such selection, is to be placed on a computer
"Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy…"
"65. The Court reiterates that the storing of data relating to the "private life" of an individual falls within the application of Article 8 § 1 (see the Leander v Sweden judgment of 26 March 1987, Series A no. 116, p.22, § 48).
It points out in this connection that the term "private life" must not be interpreted restrictively. In particular, respect for private life comprises the right to establish and develop relationships with other human beings; furthermore, there is no reason of principle to justify excluding activities of a professional or business nature from the notion of "private life" (see the Niemietz v Germany judgment of 16 December 1992, Series A no. 251-B, pp. 33-34, § 29, and the Halford judgment cited above, pp. 1015-16, § 42).
That broad interpretation corresponds with that of the Council of Europe's Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data, which came into force on 1 October 1985 and whose purpose is "to secure in the territory of each Party for every individual…respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him" (Article 1), such personal data being defined as "any information relating to an identified or identifiable individual" (Article 2).
66. In the present case the Court notes that a card was filled in on the applicant on which it was stated that he was a "contact with the Russian embassy" and did "business of various kinds with the [A.] company" (see paragraphs 15 and 18 above).
67. The Court finds that those details undeniably amounted to data relating to the applicant's "private life" and that, accordingly, Article 8 is applicable to this complaint also."
"80. The Court concludes that both the creation of the impugned card by the Public Prosecutor's Office and the storing of it in the Confederation's card index amounted to interference with the applicant's private life which cannot be considered to be "in accordance with the law" since Swiss law does not indicate with sufficient clarity the scope and conditions of exercise of the authorities' discretionary power in the area under consideration. It follows that there has been a violation of Article 8 of the Convention."
"Whereas the processing of such data is covered by this directive only if it is automated or if the data processed are contained or are intended to be contained in a filing system structured according to specific criteria relating to individuals, so as to permit easy access to the personal data in question;"
"Whereas the protection of individuals must apply as much to automatic processing of data as to manual processing; whereas the scope of this protection must not in effect depend on the techniques used, otherwise this would create a serious risk of circumvention; whereas, nonetheless, as regards manual processing, in this directive covers only filing systems, not unstructured files; whereas, in particular, the content of a filing system must be structured according to specific criteria relating to individuals allowing easy access to the personal data;…"
"(a) "personal data" shall mean any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) "processing of personal data" (processing) shall mean any operation or set of operations, which is performed upon personal data, whether or not by automatic means such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;"
"(1) This directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data, which form part of a filing system or are intended to form part of a filing system."
"32. As regards the ninth recital in the preamble to Regulation No 176/89, it is sufficient to recall that the preamble to a Community act has no binding legal force and cannot be relied on either as a ground for derogating from the actual provisions of the act in question or for interpreting those provisions in a manner clearly contrary to their wording (Case C-162/97 Nillson and others[ 1998] ECR 1-7477,para. 54, and Case C-308/97 Manfredi  ECR 1-7685, para. 80)."
(3) The decision of the Court of Justice in the Lindqvist case provides some support for this conclusion
"25. According to the definition in Article 2(b) of Directive 95/46, the term "processing" of such data used in Article 3(1) covers " any operation or set of operations which is performed upon personal data, whether or not by automatic means". That provision gives several examples of such operations, including disclosure by transmission, dissemination or otherwise making data available. It follows that the operation of loading personal data on an internet page must be considered to be such processing.
26. It remains to be determined whether such processing is "wholly or partly by automatic means". In that connection, placing information on an internet page entails, under current technical and computer procedures, the operation of loading that page on to a server and the operations necessary to make that page accessible to people who are connected to the internet. Such operations are performed, at least in part, automatically.
27. The answer to the first question must therefore be that the act of referring, on an internet page, to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constitutes "the processing of personal data wholly or partly by automatic means" within the meaning of article 3 of Directive 95/46."
(4) The statutory definition of "processing" in the 1998 Act can be interpreted in conformity with the directive
"1(1) In this Act, unless the context otherwise requires –
"data" means information which –
(a) is being processed, by means of equipment operating automatically in response to instructions given for that purpose,…
"data controller" means, subject to subsection (4), a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data, or are to be, processed;
"personal data" means data which relate to a living individual who can be identified –
(a) from those data…
"processing", in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including-
(b) retrieval, consultation or use of the information or data,…
(2) In this Act, unless the context otherwise requires –
(a) "obtaining" or "recording" in relation to personal data, includes obtaining or recording the information to be contained in the data, and
(b) "using" or "disclosing", in relation to personal data, includes using all disclosing the information contained in the data.
(4) Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller…
13(1) An individual who suffers damage by reason of any contravention by the data controller of any of that requirement of this act is entitled to compensation from the data controller for the damage…"
(5) My conclusion on processing is consistent with the conclusion of this court in Campbell v MGN
"101. The definition of 'processing' in the Directive and the Act alike is very wide. 'Use of the information or data' and 'disclosure of information or data by transmission, dissemination or otherwise making available' are phrases, given their natural meaning, which embrace the publication of hard copies of documents on which the data has been printed. Is such a meaning consistent with an interpretation that gives effect, in a sensible manner, to the objects of the Act?
102. While the Act extends to certain manual filing systems, it is otherwise concerned with the automated processing of personal information. Almost all of the provisions of the Act relate to activities prior to the moment when that information is transferred to hard copies. It would conflict with the overall nature and object of the Directive and the Act to seek to apply their provisions to the acts of those who distribute and make available to the public the product of prior data processing in which they have not been concerned. Extending 'processing' to embrace such activities need not, however, have that result.
103. The Directive and the Act define processing as 'any operation or set of operations'. At one end of the process 'obtaining the information' is included, and at the other end 'using the information'. While neither activity in itself may sensibly amount to processing, if that activity is carried on by, or at the instigation of, a 'data controller', as defined, and is linked to automated processing of the data, we can see no reason why the entire set of operations should not fall within the scope of the legislation. On the contrary, we consider that there are good reasons why it should." (emphasis in the original)
"106. Accordingly we consider that, where the data controller is responsible for the publication of hard copies the reproduced data that has previously been processed by means of equipment operating automatically, the publication forms part of the processing and falls within the scope of the Act." (emphasis added)
Conclusion on processing
The fairness principle
"Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –
i. at least one of the conditions in schedule 2 is met, and
"1. The data subject has given his consent to the processing."
"1(1) In determining for the purposes of the first principle whether personal data are processed fairly, regard is to be had to the method by which they are obtained, including in particular whether any person from whom they are obtained is deceived or misled as to the purpose or purposes for which they are to be processed."
"11. The Board of Management shall be entitled in its absolute discretion
(a) and subject only to giving 42 days' prior notice to the member of its intention to do so to refuse to renew the membership of any member with effect from the date on which that member's current subscription expires ("the expiry date") and in such event at the end of the expiry date, such member shall cease to be a member of The MDU…"
"2(1) subject to paragraph 3, the purposes of the first principle personal data on not to be treated as processed fairly unless –
(a) in the case of data obtained from the data subject, the data controller ensures so far as practicable that the data subject has, is provided with, or has made readily available to him, the information specified in subparagraph (3), and
(b) in any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him, the information specified in subparagraph (3).
(3) The information referred to in subparagraph (1) is as follows, namely --
(a) the identity of the data controller,
(b) if he has nominated a representative of the purpose of this Act, the identity of their representative,
(c) the purpose or purposes for which the data are intended to be processed, and
(d) any further information which is necessary, having regard to the specific circumstances in which the data are all are to be processed, to enable the processing in respect of the data subject to be fair."
Reference to the Court of Justice
Lord Justice Longmore: