England and Wales Court of Appeal (Civil Division) Decisions

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
His Honour Judge Thornton QC
[2012] EWHC 2088 (QB)

		Royal Courts of Justice Strand, London, WC2A 2LL
		20/02/2013

Lord Justice Tomlinson :

Introduction

1. All of us are affected, whether we realise it or not, by the operation of Credit Reference Agencies, "CRAs", which furnish to lenders or extenders of credit such as utility providers information relevant to our financial standing. The Appellant in this case, Equifax, one of the three principal CRAs in this country, maintains a credit file on virtually everyone within the UK. CRAs must be licensed to operate and are heavily regulated in the obtaining retention, dissemination and correction of data concerning an individual. This appeal from a decision of HHJ Anthony Thornton QC, sitting as a Deputy Judge of the High Court, concerns the potential liability of CRAs for the dissemination of incorrect information.
2. Between 22 May 2002 and 17 July 2006 Equifax included in its credit file concerning the Respondent, Mr Keith Smeaton, an entry to the effect that he was subject to a bankruptcy order. This was incorrect. Mr Smeaton had been made subject to a bankruptcy order made against him in the Aylesbury County Court on 1 March 2001. However on 22 May 2002 the bankruptcy order was rescinded by the same court. In June 2006 Mr Smeaton made an enquiry of National Westminster Bank with a view to opening an account on behalf of a company, Ability Records Limited. Mr Smeaton had himself incorporated and funded Ability Records and he was at all material times the beneficial owner of it, taking all management decisions on its behalf. The approach was declined, apparently because of adverse data on Mr Smeaton's credit file at Equifax, including in the first instance a reference to the bankruptcy order. On receiving National Westminster's letter of rejection dated 30 June 2006 and having ascertained that it was from Equifax that the bank had obtained its information, Mr Smeaton wrote to Equifax pointing out that he was no longer bankrupt and enclosing for its attention a copy of the court order rescinding the bankruptcy order. He also asked for £500,000 compensation, apparently for defamation. Equifax immediately amended its records, pointing out that it had done so as soon as it had been informed of the rescission of the bankruptcy order, which information had not previously been published in the London Gazette. Mr Smeaton pursued his approach to National Westminster Bank, this time with a view to the bank extending credit to his company, in the shape of a Small Firms Loan Guarantee for approximately £60,000. This approach, which fell short of a formal application, was considered by a different branch and apparently at a different level but it again, in the language of the bank, "fell for a decline" in the light of adverse data. The bankruptcy order had not been the only adverse item in the data in Mr Smeaton's credit record.
3. Mr Smeaton claims that Equifax has caused him enormous losses, not limited to unrecovered forecast profits of Ability Records in a sum in excess of £500,000. He also claims in respect of other losses and distress consequent upon his descent into a chaotic lifestyle. He was in fact homeless and living out of a car between January and August 2006. I simply reiterate in passing that his first approach to National Westminster Bank was made in June 2006.
4. The present proceedings issued in March 2007 have a tortuous history which it is unnecessary to recount. Originally brought in defamation and against additional parties, by the time of the trial in January 2011 the action had resolved into a claim for:-

i) compensation pursuant to s.13 for damages and distress suffered by reason of contravention by Equifax of the requirements of the Data Protection Act 1998; and

ii) damages at large for breach of duty at common law.

5. Mr Smeaton represented himself at trial which, despite the considerable assistance which he was able to give, inevitably presented the judge with some difficulties in addressing novel issues. Despite the length of the gestation period, Mr Smeaton was not at the outset of the trial in a position to present his case as to the loss which he had allegedly suffered. The judge therefore ruled that the trial would in the first instance be confined to the following issues:-

(1) whether Equifax was in breach of its duties under the Data Protection Act 1998;

(2) whether Equifax owed Mr Smeaton a duty of care in tort, and if so what the content of the duty was and whether it was breached by Equifax; and

(3) whether any breaches of duty by Equifax caused Mr Smeaton or Ability Records to be unable to raise finance in or after mid-2006 (on which it is common ground that all Mr Smeaton's alleged losses, whatever they may be, depend).

6. The trial process was regrettably unhappy. The trial initially occupied two days, 7 and 8 February 2011. Thereafter the parties made closing submissions in writing, Equifax on 17 February 2011 and Mr Smeaton on 28 April 2011. On 4 May 2011 the judge directed that "The hearing as to liability and causation is now closed and judgment is now reserved". However on 15 August 2011 the judge sent a note to the parties calling for further submissions and evidence on a series of points, including clarification of what issue the court was supposed to be determining in relation to causation. Submissions and evidence were duly provided and on 16 November 2011 a further one day hearing took place at which oral evidence was given on behalf of both parties.
7. On 30 March 2012 the judge handed down a draft judgment, "Judgment 1". However, following criticisms of Judgment 1 made by Equifax at the hand-down hearing, the judge decided to retract Judgment 1 and to produce a revised judgment, which was eventually handed down on 11 May 2012, "Judgment 2". Judgment 2 is very significantly different from Judgment 1. The judge made these extensive revisions despite the fact that he had recently been criticised by this court for adopting a similar course in another case: see Brewer v Mann [2012] EWCA Civ 246. It is right to note however that in the present case Equifax did not object to the judge revising Judgment 1 before it made its application for permission to appeal. This appeal is of course concerned with Judgment 2 which provides the basis for the Order which the judge made, although the court has also been shown Judgment 1.
8. Judgment 1 had failed to resolve the causation issue. In particular, the judge failed to dispose of the three principal arguments deployed by Equifax on this issue, which were:-

(1) that Mr Smeaton was not refused credit by NatWest on the sole ground of the entry concerning the bankruptcy order, but at least partly because of other adverse data in his credit file;

(2) that Mr Smeaton made no real attempts to raise finance after his unsuccessful application to NatWest in August 2006; and

(3) that even if he had made such attempts, he would not have succeeded in obtaining the substantial loan he was seeking, again largely because of his poor credit record.

In relation to these three arguments the judge said, in Judgment 1, that it was "not possible to find that Equifax's breaches caused no pleaded or claimed loss"; that "I cannot make any findings about [Mr Smeaton's reasons for not making more effort to raise finance]" and that "I cannot make a finding [as to whether Mr Smeaton had any prospect of raising finance] at this stage". At trial Mr Smeaton had been extensively cross-examined on his attempts to raise finance and on the contents of his credit file.

9. In Judgment 2 the judge determined in favour of Mr Smeaton all three of the issues to which he had directed that the trial would, in the first instance, be confined. Thus:-

(1) he held that Equifax had breached the Data Protection Act 1998, in particular the fourth data protection principle, but also the first and fifth principles. This was upon the basis that Equifax had failed to take reasonable steps to ensure the accuracy of its data.

(2) he held that Equifax owed Mr Smeaton a duty of care in tort, which was co-extensive with its duties under the Act, and that Equifax breached this duty also.

(3) he found that Equifax's breaches of duty caused Mr Smeaton loss, in that they prevented Ability Records from obtaining a loan in and after mid-2006.

10. The judge had heard no argument on the first and fifth data protection principles and as Mr Peter Arden QC for Mr Smeaton on the appeal accepted he had in this respect gone further than he had been asked. Mr Arden did not appear below and he did not seek to uphold the judge's conclusions in that regard. There were other parts of the judge's reasons which Mr Arden felt unable to support but he nonetheless sought to uphold his principal conclusions, including therefore his determination of the third issue, causation, in Mr Smeaton's favour.
11. In retrospect it is I think unfortunate that the judge attempted to resolve the causation issue in principle, divorced from the question what loss could actually be shown to have been caused by the asserted breaches of duty. I have little doubt that Mr Smeaton believes in all sincerity that a good number of the vicissitudes that have befallen him can be laid at the door of Equifax, but a close examination of the relationship between the losses alleged and the breaches of duty found by the judge would perhaps have introduced something in the way of a reality check. Had the judge looked at both issues together he might I think have had a better opportunity to assess the proposition in the round. As it is, the judge's conclusion that the breaches of duty which he identified caused Mr Smeaton loss in that they prevented Ability Records from obtaining a loan in and after mid-2006 is in my view not just surprising but seriously aberrant. It is without any reliable foundation and completely unsupported, indeed contradicted, by the only evidence on which the judge could properly rely. In the light of that conclusion it is tempting to dispose of this appeal quite shortly, by simply explaining why I have formed that view. However Mr Richard Handyside QC, for Equifax, urged us not to take that course. The judge's first two conclusions, and in particular his finding that a CRA has assumed a duty of care in tort to all whose personal data it holds, have wide implications. Equifax would not wish the court to leave those aspects of the judgment undisturbed. I can see the force of this, and the implications for the industry, and since I have concluded that the judge has in these parts of the case again fallen into error, it is appropriate to deal with these points also.

The Bankruptcy Order, its advertisement and its rescission

12. It is necessary to put only a very little more flesh upon the bones which I have already outlined. The circumstances in which Mr Smeaton's bankruptcy order came to be rescinded and removed from the register kept at the Land Registry of writs and orders affecting land are unusual – the judge thought them "highly unusual and probably unique". He also described them as "remarkable". Whilst not therefore providing a paradigm, they do nonetheless illustrate the features exhibited by a more typical case.
13. The bankruptcy order resulted from a dispute between Mr Smeaton and his former landlords by whom he had been evicted, he alleged unlawfully. Mr Smeaton began proceedings in the Watford County Court seeking damages and compensation in respect of the alleged unlawful eviction. An application to dismiss that claim led to it being stayed, not to be proceeded with without the permission of the court. The dispute escalated when Mr Smeaton brought proceedings in defamation against the landlords. That claim was struck out with costs awarded against Mr Smeaton. It was a statutory demand in the sum of £3,174.25, the summarily assessed costs of two hearings, which, when unmet, led directly to the making of the bankruptcy order. Mr Smeaton notified the landlords, now creditors, that he would pay the amount demanded by setting it off against the sum which he alleged was due to him consequent upon the unlawful eviction. He also applied unsuccessfully to set aside the statutory demand. On 10 October 2000 the creditors presented a bankruptcy petition in the Aylesbury County Court. On 12 October 2000 the petition was registered at the Land Registry in the register of writs and orders affecting land. On 1 March 2001 a bankruptcy order was made by the Aylesbury County Court.
14. The Aylesbury County Court notified the Official Receiver, the "OR", of the bankruptcy order and he, pursuant to his statutory duty, caused it to be advertised in the London Gazette and to be notified to the Land Registry at which it was on 8 March 2001 registered in the register to which I have already referred.
15. Equifax, in accordance with its standard procedures, obtained details of the bankruptcy order from the London Gazette and entered them onto the credit file kept by it in relation to Mr Smeaton.
16. Meanwhile, on 1 March 2001, Mr Smeaton had telephoned the department of the OR and informed it that he intended to appeal the bankruptcy order and to apply for a stay of execution of that order pending the appeal. On 12 March 2001 a hearing took place before Hart J at which Mr Smeaton and counsel for the petitioners appeared. A representative of the OR was also present in court. Mr Smeaton contended that the bankruptcy order had been presented for the malicious purpose of disrupting his [stayed] claim in the Watford County Court. Hart J ordered a stay of the bankruptcy order and directed that Mr Smeaton's appeal against it should be pursued as soon as reasonably practicable. It appears that the court thereafter failed to list the appeal. Indeed the order of Hart J seems not to have been drawn up. Of course, the stay of the bankruptcy order did not operate as a stay, still less a withdrawal, of the bankruptcy petition itself. The bankruptcy order having been made, the bankruptcy petition could not be withdrawn unless the bankruptcy order was first annulled or rescinded. The stay of the bankruptcy order simply prevented any further steps being taken in the bankruptcy proceedings.
17. In March and early April 2002 Mr Smeaton obtained legal aid for the prosecution of his stayed claim for damages against the former landlords. Within two weeks of his nominated solicitors beginning to act on his behalf all the disputes between Mr Smeaton and the creditors were compromised, albeit those solicitors could not deal with the bankruptcy proceedings or the defamation action, with which aspects Mr Smeaton continued to deal himself. The nature of the compromise appears to have been drop hands, with the bankruptcy petition to be withdrawn. A settlement agreement was drawn up and signed by all parties. It does not survive, but the judge accepted Mr Smeaton's evidence to the effect that the agreement provided, so far as concerns the bankruptcy, simply for the bankruptcy petition to be withdrawn. The agreement was then submitted to the Aylesbury County Court to enable the court to draw up a Tomlin Order. The court duly drew up a Tomlin Order which was submitted to the parties for signature. On its return signed by both parties the court drew up and sealed an order dated 22 May 2002 to which was annexed the agreement. The order recorded that:-

"Upon the Petition of Messrs L, S and PD Butcher, Creditors which was presented on the 10^th day of October 2000

Upon the parties having agreed the terms of settlement hereof and

Upon the parties having entered the agreement annexed

By consent it is ordered that:-

1. The Bankruptcy Order made by District Judge Mostyn on 1^st March 2001 be rescinded.

2. The Petition presented by the Creditors on 5^th October 2000 be withdrawn by the Creditors, L, S and PD Butcher.

3. The petition deposit of £300 paid by the creditors on 5^th October 2000 to be retained by the Official Receiver.

4. Permission to the Debtor to apply to H. M. Land Registry to remove the caution registered against him on 8^th March 2001 in respect of Pending Action reference WOB3106127.

5. There be no order as to costs.

6. There be liberty to apply for the purposes of enforcing the terms of this order."

18. As I have already observed the parties' agreement that the bankruptcy petition be withdrawn could not in fact be achieved unless the bankruptcy order was first annulled or rescinded. It would appear that the district judge was alive to this point and of his own motion inserted into the order the provision for rescission of the bankruptcy order. The parties had of course accepted that addition by signing the draft order, but it was the evidence of Mr Smeaton, which the judge accepted, that he did not recall studying the Tomlin Order sufficiently closely to notice this addition and moreover that in any event he had no idea what it meant to rescind a bankruptcy order. Mr Smeaton considered that the bankruptcy petition had already been withdrawn by virtue of the order of Hart J of 11 May 2001. Although it can have no relevance to the ambit of the duty cast upon CRAs (or the OR) it should be mentioned that Mr Smeaton is severely dyslexic, a factor which the judge took fully into account in assessing his evidence.
19. The OR took no part in the negotiations or drafting of the agreement to compromise the bankruptcy proceedings nor in the drawing up of the order. The judge found, at paragraph 101(5) of Judgment 2, that a copy of the consent order would have been sent by the Aylesbury County Court to the OR on the day the order was made, but there was no evidence to support this finding.
20. It was also the evidence of Mr Smeaton that he first became aware that the bankruptcy proceedings had been registered against his name at the Land Registry when he received a copy of the Tomlin Order from the court. The judge does not indicate whether he accepted that evidence but at all events Mr Smeaton promptly contacted the OR asking him to apply to the Land Registry for the removal of the registration. There was some to-ing and fro-ing, with the OR taking the view that the responsibility to make the application rested on Mr Smeaton, as paragraph 4 of the Order recited. Contrary to the judge's conclusion, the OR was indeed under no duty to make the application, as will be apparent when I review the statutory provisions from which alone his duties can derive.
21. On 26 May 2002 Mr Smeaton issued an application in the Chancery Division, returnable on 29 May 2002, seeking an order compelling the OR to arrange for the notification of the bankruptcy order to be removed from the register at the Land Registry. On 29 May 2002, but before Mr Smeaton's application was heard, the OR sent a request to the Land Registry to have the notification removed and that request was immediately acted upon by the Land Registry by removal of the registration. The judge regarded this action as the OR accepting that, "unusually, he had had an obligation to apply to the Land Registry to have the caution cancelled". No such acceptance can be spelled out of the OR's action. It was a helpful and a constructive thing to do, possibly motivated by a desire for a quiet life or simply by a desire to assist, but it is not possible to spell out of it without more an acceptance of an obligation so to act.
22. On the same day Mr Smeaton attended before Briggs J for the hearing of his application. The representative of the OR drew to the attention of the judge that the registration had just been removed and the judge made no order on the application.
23. On the basis of the judge's findings, which is the basis upon which we are considering this appeal, Mr Smeaton remained in ignorance of the fact that the bankruptcy order had been entered on his credit file by each CRA operating in the UK. He was also unaware of the fact that, until he took appropriate steps with each CRA to have his credit file corrected, the erroneous entry would remain on the credit file.
24. However shortly before the hearing of the appeal Equifax applied for permission to introduce further evidence which had not, it said, been available for deployment at the trial. This evidence, or more particularly the evidence which Mr Smeaton in turn adduced in answer to it, suggests that the judge's findings do not paint an entirely accurate picture.
25. The fresh evidence is to the effect that at some time in 2002 Mr Smeaton appears to have contacted Experian, another CRA operating in the UK, obtained a copy of his credit file and disputed certain entries on it, following which a Notice of Correction was placed on the file on 3 December 2002. The evidence also suggests that at the same time as providing Mr Smeaton with his credit file Experian would also have sent him an explanatory booklet or leaflet "Your Credit File Explained" which, among other things, advised consumers whose bankruptcy orders had been discharged, annulled or cancelled to contact the other CRAs in the UK, including Equifax, and provided Equifax's contact details. The leaflet points out that "Other credit reference agencies may not hold the same information as us". Mr Smeaton for his part put in a witness statement responding to the application. In it he explains that he had indeed contacted Experian in late 2002, although he cannot recall how he came to hear of Experian. He must, he thought, have appreciated its role in recording and reporting on people's creditworthiness to finance companies because in relation to a personal loan agreement which he then had with Black Horse (a lender associated with Lloyd's Bank) he was concerned to ensure that Experian was not reporting him as bankrupt now that his bankruptcy order had been rescinded. Accordingly, he said, he telephoned Experian, the representative of whom confirmed that Experian was indeed reporting him as bankrupt. He was told that Experian would desist from so doing now that it knew of the rescission. Mr Smeaton denied having requested or obtained a copy of his credit file and he denied receiving the booklet or leaflet "Your Credit File Explained" which contained the advice summarised above. Mr Smeaton denied that as a result of this episode he had learned that there were other CRAs in the UK. He makes the fair point that had he known of them he would have contacted them in the same way as he did Experian.
26. We had no need to rule on whether the fresh evidence should be admitted. It is obvious that had this evidence been available at trial it would have opened up new areas for cross-examination of Mr Smeaton. However it would be unfair to have regard to any part of it, even to Mr Smeaton's own evidence, in the absence of the evidence being tested by giving to Mr Smeaton an opportunity to give his own account and to be cross-examined on it. I shall accordingly approach the issues on the basis that Mr Smeaton was in the state of ignorance found by the judge which I have summarised above.

The application to National Westminster Bank in 2006

27. It was in this state of ignorance that Mr Smeaton made his approach to National Westminster Bank that I have described above. The judge found that Mr Smeaton was a "shadow director" of Ability Records. It is unnecessary to say any more about Ability Records and Mr Smeaton's relationship to it save only that Mr Smeaton considered that Ability Records had the opportunity to exploit a niche product which had been overlooked by the larger recording companies. He initially approached the National Westminster Bank with a view to opening an account in the name of Ability Records. The letter of rejection of 30 June 2006 to which I have referred at paragraph 2 above included this passage:-

"Thank you for your recent request for a Business Account.

I regret that on this occasion we are unable to help you for the following reasons. Adverse data revealed in credit reference search/Bankruptcy data revealed. No doubt this decision will come as a disappointment to you, however, I hope that you can understand the Bank's position.

Should your circumstances change in the future, we will be happy to consider a fresh application. If you feel there is information we did not take into account, you may contact me asking that we reconsider our decision. I will generally ask you to provide me with additional information that supports your request to reconsider your application."

28. The credit file was corrected by 17 July 2006 in the circumstances which I have described above. Mr Smeaton then contacted the bank's Harrow branch and met Mrs Muggeridge, a business manager, to discuss the possibility of Ability Records being granted a loan under the Small Firms Loan Guarantee Scheme. Following that meeting Mrs Muggeridge wrote to him on 10 August 2006 as follows:-

"Thank you for taking the time to meet with me to discuss the possibility of getting a Small Firms Loan Guarantee for approx £60K.

I have been in contact with Mr Athwal, as to how much he had done with regards to the previous meeting that you had with him with regards to the opening of an account for Ability Records Ltd, but it fell for a decline because of the adverse data that was in the background.

I am also having to decline your request as the adverse data will be a stumbling block that I am unable to escape, and our lending centre will not entertain any request were this an issue.

I hope that you are able to progress in some way with your ambitions with the Company and wish you all the best for the future, once again I am sorry that I am unable to assist you with the lending required."

29. In addition to the bankruptcy order before that was deleted, Mr Smeaton's credit file showed an unsatisfied county court judgment for £218.00 entered on 10 January 2005, together with details of eleven credit agreements which had gone into default, nine before and two since the making of the bankruptcy order. The latter two represented half of the credit agreements into which Mr Smeaton had entered in the previous five year period. The file also showed twenty-five credit searches made in the period between 5 June 2002 and 30 June 2006. There was evidence before the judge that this was indicative of a struggle to obtain credit, although there was also other evidence which suggested that more routine enquiries might generate such entries. I am inclined to discount the credit searches. Nonetheless, I can see no legitimate basis upon which the judge could reject, as he did, the evidence of Mr Beresford, Equifax's UK Data Director, to the effect that even after correction Mr Smeaton's file recorded a significant amount of negative data.
30. The judge concluded at paragraph 136 that :-

". . . the evidence presented by the credit file gave little support for the submission that Mr Smeaton's credit would have been considered to have been so poor that he would never have obtained credit even if his credit file had made no reference to his bankruptcy order. The first and most obvious reason for this finding is that Mr Smeaton's credit file did contain that reference and, furthermore, in the later part of the five-year period it related to, the reference showed him to be an undischarged bankrupt who remained undischarged after the period for automatic discharge had passed. That could well have explained at least some of the negative entries on the file."

31. At paragraph 143 the judge concluded that the rejection communicated by letter of 30 June 2006 was "on account of Mr Smeaton's recorded long-standing undischarged bankruptcy".
32. At paragraph 144 the judge turned to Mrs Muggeridge's letter of 10 August 2006. He concluded that the two "references [therein] to adverse data are clearly, in context, to the bankruptcy data that had lain on Mr Smeaton's credit file for so long".
33. Thus the judge's conclusion at paragraph 145 was that "For all these reasons, it is inescapable that the applications were refused on the sole ground of Mr Smeaton's bankruptcy entry on his credit file".
34. I am afraid that I regard these findings as wholly unsustainable. Whilst credit applications might have been in the interim refused on account of the apparently outstanding bankruptcy order, that could not account for either the unsatisfied county court judgment or the credit agreements that went into default, nine of which defaults predated the making of the bankruptcy order. It was also irrelevant to the attitude of a prospective lender that Mr Smeaton may have had explanations for some of the defaults. A prospective lender is likely to be guided by the information on the file, knowing that there are procedures available pursuant to which a dissatisfied consumer may ensure that incorrect data is corrected. The letter of 30 June 2006 referred both to adverse data and to bankruptcy data, and there was of course significant adverse data over and above the fact of the bankruptcy order. The letter of 10 August 2006 referred, in the second paragraph, to the first rejection having been "because of the adverse data that was in the background" which of course included at that time the bankruptcy order. For my part I suspect that Mrs Muggeridge deliberately omitted reference to the bankruptcy order because she by then knew that that information had been shown to be incorrect. To have referred to the bankruptcy order would have been particularly insensitive and moreover irrelevant once it was appreciated that the bankruptcy order had been rescinded. However, given that the relevant correction had been made, there is no reason whatever to regard the reference to adverse data in the third paragraph as including reference to the bankruptcy order, given that there was ample other adverse data upon the basis of which the application was surely bound to fail. At the very best from Mr Smeaton's point of view, there is no reason to regard this second reference in the letter to adverse data as relating only to the bankruptcy order when plainly there was other adverse data to which it was relevant to refer. I thus find incomprehensible the judge's conclusion that the applications were refused on the sole ground of Mr Smeaton's bankruptcy entry on his credit file. This conclusion was not simply against the weight of the evidence, it was contradicted by the evidence of the two letters themselves read as in my judgment they fairly and naturally should have been.
35. After the rejection by National Westminster in 2006 Mr Smeaton approached no other bank for credit, or at any rate there is no evidence that he did, until making an application to Nationwide in June 2009. The judge does not refer to this application. The evidence, in the shape of an email from Mr Smeaton himself to Nationwide, showed that the application for a credit facility for Ability Records up to £40,000 "proved difficult because of my credit rating". This speaks for itself. The reference to the bankruptcy order had of course long since been expunged.
36. The judge accounted for Mr Smeaton's failure to make any further applications for credit after 2006 in this way:-

"147. Ability's failure to make a further SFLGS application to another participating bank is, on Mr Smeaton's case, explained in this way. His life descended into a tragic mixture of homelessness, living in a car on the streets, mental breakdown, impecuniosity and a consequent inability to progress his business affairs as a direct result of the enormous shock on discovering that he had had an adverse credit record for the last five years and that the bank on which he had pinned so much hope in providing Ability with the necessary step up to obtain the SFLGS, itself an essential feature of its business plan, prevented him from taking anything other than relatively modest steps to further that plan for many moths. He was taking some action, but for some time that action was the best that he could take but were not sufficient to enable him to obtain alternative sources of credit or finance."

37. Mr Smeaton did not himself proffer this explanation nor did he suggest that he had suffered "shock" on learning that the bankruptcy order was still being referred to four years after it had been rescinded. There may also be a confusion on the dates. The judge found in paragraph 84 of his judgment that Mr Smeaton had been homeless and on the streets between 6 January 2007 and 28 August 2007, whereas in his second witness statement at paragraphs 32-38 Mr Smeaton describes this as having occurred between those dates in 2006. Be that as it may, Mr Smeaton deserves sympathy for the confusion into which his life descended, whenever that occurred. However I agree with Mr Handyside that it would not have been a reasonably foreseeable consequence of Equifax's alleged breach of duty that a consumer such as Mr Smeaton would (a) not be provided with any information about his credit file or take any steps to investigate his credit file for several years, and (b) upon discovering that his file contained inaccurate bankruptcy data, suffer severe shock and, in consequence, become homeless, suffer a mental breakdown, and become unable to make any renewed application for credit. These consequences, even upon the assumption that they can be shown to be causally related to the breach of duty, are far too remote from that breach to give rise to liability under either the Data Protection Act or at law. Putting the point another way, there is a clear break in the chain of causation between the alleged breach and the inability to obtain credit subsequent to the error being corrected. The judge should therefore have acceded to Equifax's submission that, even if Ability Records was unable to obtain funding in July 2006 because of the bankruptcy data on Mr Smeaton's file, that was not the reason for its subsequent failure to obtain credit thereafter.
38. In fact the reason put forward by Mr Smeaton for his failure to make any further application for credit for Ability Records after June/July 2006 was that he believed that he had been blacklisted by the banks. There was no evidence that he had in fact been blacklisted, although he may well of course have had that perception. If that was the driving force behind his failure to make further applications on behalf of Ability Records, this is yet another reason why the judge should have acceded to Equifax's submission.
39. In short, even assuming that the judge was right to hold that Equifax was in breach of duty to Mr Smeaton, his further conclusion that that breach or those breaches caused Mr Smeaton loss in that they prevented Ability Records from obtaining a loan in and after mid-2006 is simply unsustainable. I would therefore answer the fourth question which the judge posed for himself "No". It follows that the claim should have been dismissed.

The alleged breach of the Data Protection Act 1998

40. In what follows and particularly my description of the statutory framework I have relied heavily on the skeleton argument prepared for the appeal by Mr Handyside and his junior Mr Alexander Milner. Their exposition of the relevant statutory and regulatory framework was accepted to be accurate and comprehensive. They have also extracted the relevant material from various publications in a manner which again was accepted to be accurate and comprehensive, notwithstanding Mr Arden did not accept that these publications went beyond practical advice and was at pains to emphasise that they were not conclusive as to the extent of Equifax's duties under the Data Protection Act. Accordingly I reproduce below without further attribution the relevant sections from Mr Handyside's skeleton argument.

The Data Protection Act

41. The Data Protection Act 1998 ("the DPA") is one of three interrelated statutory regimes relevant to this appeal. The others are the regime governing bankruptcy orders contained in the Insolvency Act 1986 and the Insolvency Rules 1986, and the rules regulating CRAs in the Consumer Credit Act 1974 and the Consumer Credit (Credit Reference Agencies) Regulations 2000.^[1]
42. The following provisions of the DPA are the most relevant to the issues on the appeal:

(1) Section 1:

1 Basic interpretative provisions.

(1) In this Act, unless the context otherwise requires -

"data" means information which –

(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose,

(b) is recorded with the intention that it should be processed by means of such equipment,

(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system...

(d) [...]

(e) [...].

"data controller" means, subject to subsection (4), a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed...

(2) Section 4:

4 The data protection principles.

(1) References in this Act to the data protection principles are to the principles set out in Schedule 1.

(2) Those principles are to be interpreted in accordance with Part II of Schedule 1.

(3) [...]

(4) [...] it shall be the duty of a data controller to comply with the data protection principles in relation to personal data with respect to which he is the data controller.

(3) Section 13:

13 Compensation for failure to comply with certain requirements.

(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.

(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if –

(a) the individual also suffers damage by reason of the contravention [...]

(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.

(4) Schedule 1:

SCHEDULE 1

The Data Protection Principles

PART I

The Principles

4 Personal data shall be accurate and, where necessary, kept up to date.

PART II

Interpretation of the Principles in Part I The fourth principle

7 The fourth principle is not to be regarded as being contravened by reason of any inaccuracy in personal data which accurately record information obtained by the data controller from the data subject or a third party in a case where –

(a) having regard to the purpose or purposes for which the data were obtained and further processed, the data controller has taken reasonable steps to ensure the accuracy of the data, and

(b) if the data subject has notified the data controller of the data subject's view that the data are inaccurate, the data indicate that fact.

43. Equifax is a data controller for the purposes of the DPA and it therefore has a duty to comply with the data protection principles. The data appearing in Mr Smeaton's credit file was between 22 May 2002 and 17 July 2006 inaccurate in the respect discussed above. Although it does not matter on the facts of this case, the judge was wrong to regard the data as having been also inaccurate between 12 March 2001 and 22 May 2002. Mr Beresford's acceptance that had Equifax known of the stay imposed it would have removed the entry, which the judge inappropriately characterised as "a concession", was simply an explanation of Equifax's usual practice. The stay did not affect the existence of the order. The entry was accurate until the order was rescinded.
44. The judge was also in my view wrong to regard the mere fact that the data had become inaccurate and remained accessible in its inaccurate form for a number of years as amounting to a "clearly established breach of the fourth principle" – judgment paragraph 106. Paragraph 7 of Part II provides that the fourth principle is not, in circumstances where the data accurately records [erroneous] information obtained by the data controller from the data subject or a third party, to be regarded as contravened if the data controller has, putting it broadly, taken reasonable steps to ensure the accuracy of the data. A conclusion as to contravention cannot in such a case be reached without first considering whether reasonable steps have been taken. As the facts of this case show, that may not always be a straightforward enquiry. Perhaps often it will and it may not therefore usually be difficult to establish a contravention. Once it is concluded that reasonable steps were not taken in this regard, a consumer may seek compensation under s.13. It will then be a defence for the data controller to show that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned. It may be that that enquiry is in substance no different from that required under paragraph 7 of Part II in the limited class of case to which that paragraph refers. However it should be noted that in cases not covered by paragraph 7 a contravention may be established without consideration of the reasonableness of the steps taken by the data controller. In such a case reasonableness would arise only if a defence were mounted under s.13(3).
45. The judge concluded that Equifax did not take reasonable steps to ensure the accuracy of its data. In order to test that conclusion it is necessary to examine the legislative scheme relating to bankruptcy orders.

Insolvency Legislation

46. The legislation relating to bankruptcy orders has been laid down by Parliament in the Insolvency Act 1986 and by the Lord Chancellor (acting together with the Secretary of State and the Lord Chief Justice) in the Insolvency Rules 1986 (as successively amended).^[2] As far as this appeal is concerned, the key features of the legislation are as follows (save where indicated, these features have existed throughout the period from 2001 to the present day).

(1) A court may make a bankruptcy order against an individual upon the presentation of a creditor's petition, if the conditions in section 271 of the Insolvency Act 1986 are satisfied.

(2) When a court makes a bankruptcy order, it must send two copies of the order to the OR.^[3]

(3) The OR must then have the order advertised in the London Gazette ("the Gazette") and notify the Chief Land Registrar to enable the order to be registered in the register of writs and orders affecting land.^[4]

(4) The OR is also required to enter details of the bankruptcy into the Individual Insolvency Register.^[5] (Until 1 April 2004 this was known as the Register of Bankruptcy Orders: I shall use the term "the Register" to refer to the Register of Bankruptcy Orders or the Individual Insolvency Register as applicable.)

(5) Bankruptcies are, generally speaking, automatically discharged after one year. (Prior to 1 April 2004 the relevant period was 3 years.)^[6]

(6) A bankruptcy may come to an end prior to discharge by virtue of being annulled under s.282 of the Insolvency Act 1986 or, following a change of circumstances or the discovery of new evidence,^[7] by being rescinded under s.375.

(7) Where a court makes an annulment order under s.282, it must notify the Secretary of State (or in practice the OR) of the annulment.^[8] Upon being notified of the annulment, the Secretary of State must cause the bankruptcy order to be deleted from the Register.^[9]

(8) However, where a court rescinds a bankruptcy order under s.375, it is not required to notify the Secretary of State of the rescission. In this regard, Judgment 2 at [26] contains a number of errors:

(a) The judge correctly noted that "The [Insolvency Rules] have never imposed a requirement on a court to notify the Secretary of State of the fact or terms of a rescission order rescinding a bankruptcy order." However, the Judge then incorrectly held that "since the court has an obligation to notify the Secretary of State of the making of a bankruptcy order, the same court is subject to an implied obligation to notify the Secretary of State that the bankruptcy order so notified has been rescinded".^[10] The notion of an implied obligation of this sort is both surprising and unsupported by any authority. With respect to the judge it is quite unsustainable. The judge went on to state that "In practice, courts do notify the Secretary of State of the fact of a rescission order relating to a bankruptcy order by sending the Secretary of State a copy of the order". There is no evidence sufficient to support this finding. Mr Arden suggests that in practice the OR, and through him the Secretary of State, must in practice find out about rescissions because the OR has various statutory functions in relation to the bankrupt, including acting as receiver and manager of his estate immediately upon the making of the bankruptcy order (s.287 of the Insolvency Act 1986) and investigating and reporting to the court on his affairs (s.289 of the Insolvency Act 1986). Someone must therefore tell him to stand down. This may usually be so. It is however of no significance in a case like the present where the OR had not embarked upon these functions. There may be other types of case in which, for whatever reason, the OR does not in fact learn of rescission orders or where the information is, for whatever reason, of little or no practical moment.

(b) It does not logically follow from the fact that the court is required to notify the Secretary of State of a bankruptcy order that it must necessarily also be required to notify him of a rescission order. A reasonable reader of the relevant Insolvency Rules would not interpret them in that way.^[11]

(c) Furthermore, that the court is not subject to any such obligation is reasonably clear from a comparison of the current rules 6A.5(a) and 6A.5(d). These rules, which have been in force since 1 April 2004 (subject to non-material amendments), require the Secretary of State to delete information concerning a bankruptcy from the Individual Insolvency Register after receiving notice of an annulment and a rescission respectively. Rule 6A.5(a) now provides that, in the case of an annulment, the information must be deleted where "the bankruptcy order has been annulled…and a period of 3 months has elapsed since notice of the annulment was given to the Secretary of State". By contrast, the equivalent rule in a case of rescission applies where "the bankruptcy order is rescinded by the court under section 375, the Secretary of State has received a copy of the order made by the court, and 28 days have elapsed since receipt of the copy of the order" (rule 6A.5(d)). The difference in wording reflects the fact that there is no requirement that the Secretary of State be given notice of rescission orders. The judge also fell into error in paragraph 34 of that judgment in overlooking this distinction.

(d) The judge further found that notification of rescission orders by the courts to the Secretary of State "is obviously done in all other rescission cases since the [Insolvency Service] is able to maintain statistics showing how many rescission orders rescinding a bankruptcy order were made in any year and is also able to amend the [Register] to delete reference to bankruptcy orders that have been rescinded". This finding is also unsatisfactory. The Insolvency Service's statistics can only show the number of rescission orders of which the Service became aware in a given year. They do not show that all rescission orders were notified to the Insolvency Service.^[12]

(9) Where the Secretary of State is notified that a bankruptcy order has been rescinded, he is under an obligation to remove the details of the order from the Register. The judge was mistaken when he stated (at [27])) that this obligation has only existed since 1 April 2004: in fact a rule to this effect has existed since March 1999, and therefore throughout the period material to these proceedings.^[13]

(10) Importantly, upon being notified (or provided with a copy) of an order annulling or rescinding a bankruptcy order, the Secretary of State is not under any duty to advertise the fact of the annulment or rescission in the Gazette or anywhere else. Instead, the law gives the former bankrupt the option of requiring the Secretary of State to advertise the annulment, upon payment of an appropriate fee.^[14]

47. This has not always been the law. Prior to the 1986 reforms, rule 358(1)-(2) of the Bankruptcy Rules 1952 provided as follows:

(1) Where an order which has been gazetted is annulled, revoked or rescinded, the Registrar shall forthwith give notice of the order of annulment, revocation or rescission to the Board of Trade, who shall publish it in the London Gazette.

(2) The expenses of gazetting shall, where the order is annulled, revoked, or rescinded on the application of the Official Receiver or trustee, be paid out of the estate, and in any other case be paid by the party on whose application the order was made.

48. Thus, before 1986, annulments and rescissions were both required to be gazetted and, in an ordinary case where the annulment or rescission order was made on the application of the former bankrupt, the former bankrupt would be liable for the costs of the advertisement. In making the Insolvency Rules 1986, the legislator must be taken to have deliberately intended to change this system so as to give the former bankrupt the option of not advertising the annulment or rescission, if he does not perceive it to be in his interests. (See Muir Hunter on Personal Insolvency (2011), p.7159.) As the editors point out, publicity is capable of harming the bankrupt's interest.
49. Finally as regards the relevant bankruptcy legislation, it is necessary to mention stays of bankruptcy orders. As to these:

(1) The court can, on the application of the bankrupt or a creditor, order the OR to suspend the notification of a bankruptcy order to the Chief Land Registrar and/or the gazetting of the order.^[15]

(2) Alternatively, either the court making the order or the appeal court can grant a general stay of a bankruptcy order pending an appeal, under CPR 52.7(a).

(3) In addition to these two possibilities (referred to in Judgment 2 at [15] and [19]) the Judge also stated (at [19]) that a bankruptcy judge has power to impose a stay of any bankruptcy order under s. 375 Insolvency Act 1986. However, s.375(1) does not expressly refer to any such power and the Judge cited no authority for this statement.

(4) There have never been any rules requiring stays of bankruptcy orders to be notified to the Secretary of State, gazetted, or entered into the Register. This is not surprising, because a stay is a procedural order whose effects may prove to be only temporary. A stay is defined in the Glossary to the CPR as follows:

"A stay imposes a halt on proceedings, apart from any steps allowed by the Rules or the terms of the stay. Proceedings can be continued if a stay is lifted."

(5) By contrast, an annulment is a substantive order which has the effect of cancelling the bankruptcy order as if it had never been made: Bailey v. Johnson (1872) LR 7 Exch 263. A rescission has a similar effect.

CRAs and bankruptcy orders

50. At this point it is necessary to explain the process by which CRAs obtained their data relating to bankruptcy orders during the relevant period. There was no dispute about this, and the Judge correctly summarised the position as follows:

"34. IIR as a source of credit data. Neither the RBO [Register of Bankruptcy Orders] nor the IIR [Individual Insolvency Register] was a direct source of bankruptcy data for Equifax until 2008 when, for the first time, the IS [Insolvency Service] introduced for CRAs a facility enabling the entire contents of the IIR to be transferred electronically from the IIR to each CRA on a daily basis. Until that change occurred, there appeared to be no practical way that the IIR could be used by a CRA to obtain details of bankruptcy orders that were removed from the IIR because they had been discharged, annulled or rescinded…"

91. Until 2008, Equifax was made aware of all bankruptcy orders when they were made because these orders and the date on which they were made were recorded in the London Gazette and Equifax uploaded these entries manually onto its databases. Since 2008, Equifax has taken a subscription from the IS so as to receive by electronic transfer at regular intervals the entire contents of the IIR save for sole trader information which it obtains directly from the London Gazette in electronic format…

93. Equifax [received] information about bankruptcy orders which have been annulled, rescinded or discharged in two different ways. The first way [was] by being notified by the debtor consumer that his or her bankruptcy order has been discharged or has otherwise come to an end. The second way [was] by obtaining details of all discharged, rescinded and annulled bankruptcy orders advertised in the London Gazette. These advertisements appear only when a debtor consumer arranges for a notice advertising in the London Gazette that his or her bankruptcy order has been terminated having paid the current fee.

51. The significance of the introduction of the electronic feed of bankruptcy information from the Register in 2008 was that, since all annulments and (when the Secretary of State is notified of them) rescissions of bankruptcy orders have to be reflected in the Register (under the law in force since 1999), all such orders would automatically be incorporated into the CRAs' databases irrespective of whether they were advertised in the Gazette or otherwise brought specifically to the CRAs' attention.

Consumer credit legislation and guidance

52. Parliament and the Secretary of State have also laid down detailed rules governing the operation of CRAs and the correction of information contained in consumers' credit files. The Judge described some of these rules at [89] of Judgment 2, but omitted to refer to some of the more important ones. In summary:

(1) A CRA must be licensed under s.21 of the Consumer Credit Act 1974 ("CCA"). Broadly, this requires the OFT to be satisfied that the CRA is a "fit person" to carry on a consumer credit business (s.25).

(2) Under s.157(1) of the CCA, a consumer may request from a lender the details of the name and address of any CRA to which the lender has applied for information about the consumer in the preceding 28 days. The lender has seven working days to comply with such a request.^[16] Since 1 February 2011 it has been compulsory for creditors to provide this information upon declining to enter into a credit agreement, under s.157(A1), and in fact Mr Beresford's evidence was that before that date lenders "invariably" provided the information to consumers when refusing them credit in any event.^[17] They were required to do so in order to comply with the Guide to Credit Scoring 2000, discussed in paragraph 53 below.

(3) Under s.157(1) of the CCA, a consumer may request a copy of his credit file from a CRA and, upon paying a fee of £2, is entitled to receive a copy within seven working days.^[18] At the same time as providing the credit file, the CRA must also give the consumer a statement of his rights to have any inaccurate information corrected.

(4) By s.159(1), a consumer who considers that an entry in his credit file is incorrect and that he is likely to be prejudiced by the entry may give notice to the CRA requiring it to remove or amend the entry. The CRA must remove or amend the entry within 28 days, or alternatively inform the consumer that it has taken no action (s.159(2)). If it takes no action, the consumer may require the CRA to add to the file a notice of correction of up to 200 words and include a copy of the notice of correction when providing credit data to its customers (s. 159(3)).

(5) If a CRA fails to comply with the requirements of s.157(A1) or (1) or s.158, it commits a criminal offence.

53. In addition to the above, in 2000, various bodies operating in the credit industry, including the British Bankers' Association, the Council of Mortgage Lenders and the CRAs, supported by the Office of Fair Trading, published the "Guide to Credit Scoring 2000". The Introduction to the Guide stated (among other things) as follows:

"This Guide is for developers and users of scoring system that are used in making decisions about consumer credit. It updates the second edition, drawn up in 1993.

The Office of Fair Trading supports the principles of scoring and recognises its important contribution to responsible credit granting.

Credit scoring measures the statistical probability that credit will be satisfactorily repaid. It is based on the fact that it is possible, using statistical techniques, to predict the future performance of applicants with similar characteristics to previous applications (either of the credit grantor itself or groups of credit grantors).

[...]

Since the Guide was last updated, techniques have been continually developed and improved and new legislation, such as the Data Protection Act 1998, has been enacted. The relevant principles in the Act have been taken into account in this Guide. [...]

In drawing up the new Guide, the industry has recognised the Office of Fair Trading's concern that consumers should be given reasons for a refusal of credit. It is important that reasons are meaningful and useful to consumers; but at the same time there are dangers to lenders and their customers if credit scoring systems are opened up to manipulation and fraud through excessive disclosure.

[...]

Credit is not a right. The purpose of this Guide is to ensure that everyone can be confident that credit granting decisions based on credit scoring are made fairly."

54. In his foreword to the Guide, the then Director General of Fair Trading, Mr John Bridgeman, wrote:

"Since the publication of the last Guide to Credit Scoring in 1993, and my Office's report on Credit Scoring in 1992, there have been significant advances in the use of this method of credit assessment, and relevant legislative changes such as the implementation of the EC Directive on Data Protection. As a result of those changes my Office decided to take a fresh look at the issues involved, in consultation with the credit industry and the Office of the Data Protection Registrar. That led to a number of proposals for amendments to the industry Guide, to bring it into line with the new regulatory environment and to improve the provision of information to consumers.

[...] The scope of the Guide has been broadened so that it applies not only to decisions about initial applications for credit but also subsequent requests for amendments to existing facilities. Lenders will inform applicants that scoring may be used in an assessment of their application, and will explain how credit scoring works and indicate some of the characteristics common to the scoring process. If requested they will also provide details of the logic involved in the automated decision taking. Where an application is declined, the lender will provide a clear explanation of the principal reasons for the decline, including whether this was based on credit reference agency information. The applicant will be informed that they have a right of appeal which will be considered manually, and will be given the opportunity to provide additional information in support of their application. If the applicant's credit reference agency file contains a notice of correction, there will be systems in place to ensure that the application is reviewed manually.

Credit scoring plays a useful role in the responsible granting of credit, and as such is of benefit to both lenders and borrowers. However, consumers need to understand the basis of credit scoring and the procedures involved, and what steps they can take if they are refused credit. The revisions to the Guide will help provide greater openness and transparency in this regard. [...]"

55. The Guide provides a number of protections for applicants for credit, including the following:

(1) When a credit grantor tells an applicant that his credit application has been declined, the grantor is obliged to provide a clear explanation of the principal reason why the applicant has not met the lending criteria (for example, a decline based on adverse credit reference agency data) (paragraph 6.4);

(2) A credit applicant has a right of appeal where his credit application is declined (paragraphs 5.11 & 7.7);

(3) Where a credit applicant appeals a declined credit application, the credit grantor is required to give the applicant the opportunity to provide additional relevant information and to consider that additional information when reviewing the application (paragraph 7.12); where appropriate the review must be carried out by a different lending officer from the one originally handling the application; and

(4) Where a credit grantor is aware that a Notice of Correction and/or Dispute has been filed with a credit reference agency by or in relation to an applicant, it is required to review any declined application manually (paragraph 9).

The Insolvency Service's publications

56. The government (in the form of the Insolvency Service, an executive agency of the Department of Trade and Industry at the relevant time),^[19] appears always to have been aware that no system existed whereby CRAs would learn about annulments of bankruptcies in the ordinary course of events, without their being advertised or otherwise notified to CRAs. This is clear from the Insolvency Service's publication entitled "Can my bankruptcy be cancelled?" published in October 2001, and referred to at various places in Judgment 2.^[20] As noted by the Judge at [100], it stated as follows:

"Credit Reference Agencies - the Official Receiver does not send any form of notice to credit reference agencies. The agencies pick up information from other sources such as advertisements of bankruptcies in newspapers, "The London Gazette" and the Register of County Court Judgments. If no advertisement of your discharge from bankruptcy or the annulment of the bankruptcy order is made, separate information will have to be provided to credit reference agencies to amend their records."

57. It appears that the Information Commissioner was similarly aware at the relevant time that CRAs would not necessarily learn about the annulment of a bankruptcy order unless the former bankrupt took steps to bring it to their attention. In December 2005, the Information Commissioner published the following guidance, also quoted by the Judge at [100]:

"If your bankruptcy has been annulled (cancelled), you will need to send proof to the credit reference agencies."^[21]

58. There is no evidence that either the Insolvency Service or the Information Commissioner ever expressed any dissatisfaction with or concern about this state of affairs.

The Judge's Approach

59. The judge's approach begins with the observation, at paragraph 95 of the judgment, that erroneous or out of date data which remains on a consumer's credit file can be particularly damaging. Of course this is true, and nothing I say in this judgment is intended to undermine the importance of the fourth data protection principle. But before deciding what is the ambit of the duty cast upon CRAs to ensure the accuracy of their data, it is necessary to put this important principle into context and to maintain a sense of proportion. In the context of lending, arrangements have been put in place to ensure that an applicant for credit should not suffer permanent damage as a result of inaccurate information appearing on his file. As recorded above these safeguards are set out in the Guide to Credit Scoring and are further explained in at least two other published documents. The first is a leaflet entitled "No Credit – How to find out what credit reference agencies report about you and how you can correct mistakes". This was published by the Data Protection Commissioner in December 2001. The second is a booklet called "Credit Explained" published by the Information Commissioner's Office in 2005. An applicant should be told in advance if the credit scoring technique is to be used to process his application. As these publications explain, credit scoring may be carried out by reference, amongst other things, to data from CRAs. The lender must tell a failed applicant by reference to the data of which CRA an application was declined, if it was, and the failed applicant, like any consumer, has the right to obtain a copy of his file from a CRA on payment of £2.00. The judge made no reference to these arrangements which are in my view relevant to the question how onerous a duty should be imposed upon a CRA to ensure that its data is accurate. I agree with Mr Handyside that in most cases of applications for credit failed on account of incorrect data the harm likely to be suffered is temporary inconvenience. It is possible that the judge overlooked this as a result of his flawed conclusion that it was inaccurate data, or more precisely the alleged breach of duty which gave rise thereto, which prevented Mr Smeaton / Ability Records from obtaining credit in and after July 2006.
60. Mr Arden submitted that it is no answer to the vice of inaccuracy of data that it can be inspected and corrected. An applicant for credit whose application is refused because of inaccurate data has thereafter a hill to climb to overcome the inaccurate impression initially formed of him. He submitted that a requirement to consider a second application does not mean that the lender has to put out of his mind what he has first learned. But with respect to Mr Arden this is precisely what the Guide to Credit Scoring 2000 says should be done. Section 8.1 provides:-

"Any repeat application for credit will be treated as a new application, and assessed accordingly. An applicant for credit will not be declined or accepted solely on the grounds of having made a previously declined or accepted application to that credit grantor."

Section 9 provides:-

"Where a credit grantor is aware that a Notice of Correction and/or Dispute has been filed with a credit reference agency by or in relation to an applicant, any declined application must be manually reviewed."

61. The judge ought also, I consider, to have taken into account in this connection that the circumstances in which Mr Smeaton's bankruptcy order came to be rescinded were "highly unusual and probably unique" and "remarkable". It must be very unusual for a bankruptcy order to be rescinded without the bankrupt having first applied for it to be rescinded. It must be equally unusual for a bankrupt not to appreciate that his bankruptcy order has been rescinded. As set out at paragraph 56 above, the Insolvency Service's guidance is explicit that in the event that a bankruptcy order is annulled then unless that fact is advertised the former bankrupt will have to ensure that the CRAs receive the information in order to enable them to amend their records. As set out in paragraph 57 above, the 2005 document "Credit Explained" stated in terms that "if your bankruptcy has been annulled (cancelled), you will need to send proof to the credit reference agencies". The earlier document "No Credit", also cited by the judge at paragraph 100, was not so explicit, although there is sufficient there to put a reasonable reader on notice that in such a situation he will need to ensure that the CRA data is updated. The judge thought that Mr Smeaton might not have appreciated that "annulment" covered his situation. However what is relevant is what a reasonably informed reader would have understood. In that connection references to annulment and cancellation are, I should have thought, more helpful to the ordinary reader than references to rescission. At the very least they would put the reasonable reader on notice that he might need to seek advice on the question whether the setting aside of his bankruptcy order would without more necessarily be picked up by the CRAs from the information normally available to them.
62. The judge ought in my view to have taken into account that these various publications demonstrate that both the methods by which CRAs collected and updated their data and the shortcomings in those methods were well-known to and understood by the Information Commissioner and the Insolvency Service. Furthermore, it is surely relevant to the consideration of the ambit of the duty cast upon CRAs to bear in mind that in 1986 Parliament legislated specifically so as to remove the former requirement, dating back to 1952, that rescission of a gazetted bankruptcy order should itself be gazetted. The legislature apparently took the view that it was for the former bankrupt to decide whether he wished to be exposed to this further and possibly damaging publicity.
63. The judge thought that about ten such rescission orders had been made in 2002, although if as is likely he based that finding on the Insolvency Service's statistics, it should be borne in mind that those statistics do not necessarily record all rescission orders made by the courts. Nonetheless, such orders are rare. The judge recorded that the problem thrown up by this case affected only "a tiny number of consumers" – judgment paragraphs 112, 119 and 120. This again is relevant to the ambit of the duty cast upon CRAs. The judge also concluded, at paragraph 120, that all rescission orders are now invariably brought to the attention of the OR by the relevant court and that their entry on the Register (from which Equifax since 2008 takes an electronic feed) is immediately corrected. As I have already observed at paragraph 46(8)(a) above, the judge was wrong about the current position as there is no evidence to support the proposition that courts invariably notify the OR of a rescission. It may be that the judge was induced to make this finding by a combination of his view that the court is under an implied obligation to notify and his unsupported conclusion that the Aylesbury County Court notified the OR of the rescission of Mr Smeaton's bankruptcy order. The judge may therefore have thought that he was dealing only with a situation which had obtained for a relatively short period in the past, but that is not so. The blind spot, as Mr Arden aptly put it, remains.
64. The judge was critical of Equifax for having failed to review its procedures in relation to bankruptcy orders and in particular for failing to consider "whether it could and should take steps proactively to ascertain whether it was reasonably possible to find out when annulment, rescission and stay orders were made without having to rely on being informed of this by consumers whose bankruptcy orders had been dealt with in this way." (Judgment paragraph 101(8)). Equifax should, he concluded, "have considered whether it was possible to find a quick, reliable and cheap way of being informed of annulment, rescission and stay orders, which did not rely exclusively on consumers drawing such orders to its attention." (Judgment paragraph 101(10)). I am not sure that it is profitable to dwell on the extent to which Equifax should have reviewed its procedures from time to time since what is ultimately determinative is whether there existed steps which Equifax could reasonably have been expected to take which would have ensured that the data was accurate. However, the judge seems not to have given any weight to the circumstance that, until the problem with Mr Smeaton in 2006, Equifax had had no reason to believe that a problem existed. The judge paid little regard to industry practice and the extent to which that was in turn informed by the legislative and regulatory framework.
65. The judge's ultimate conclusions on this part of the case were as follow:-

"119. Any detailed consideration of the bankruptcy data and the system giving rise to bankruptcy orders should have identified those subject to rescission as being a special class within the class of those subject to early termination of their bankruptcy orders. They are a tiny number, it would be rare indeed that they had brought the bankruptcy order onto themselves in the first place and, at least in the early 2000s, they were not covered by the guidance offered to those whose orders had been annulled.

120. Equifax should also have noticed that those whose orders were annulled were immediately brought to the attention of the OR and had their entry on the IIR automatically removed since the court that had made the annulment order would have sent a copy of that order to the OR who had a duty immediately to amend the IIR on receipt of it. Although the same notification process did not occur for those subject to rescission and stay orders, the numbers were tiny and the extra task of reporting these to the OR would not have been great. Indeed, rescission orders are now invariably brought to the attention of the OR by the relevant court and their entry on the IIR is immediately corrected.

121. Whether alone or in conjunction with the other two licensed CRAs, Equifax could have held discussions with the Secretary of State and the IS to seek to persuade those parties to modify the then current arrangements so that: (a) courts dealing with personal insolvency reported on rescission and stay orders in addition to annulment orders that were already subject to a reporting regime; (b) the Secretary of State arranged for those subject to annulment, rescission and stay orders to be the subject of an automatic report in the London Gazette and (c) the RBO and, subsequently, the IIR reported in a separate part of the register a list of all those bankruptcy orders subject to rescission, annulment or stay that could be consulted by CRAs and the public.

122. As an alternative, Equifax could have considered and then implemented other ways of obtaining data about orders relating to the termination of bankruptcy orders by means other than discharge."

66. I have already pointed out that the last sentences of both paragraphs 119 and 120 contain errors. I also consider that paragraph 122 adds nothing to the analysis as it identifies no concrete step which should have been taken over and above that discussed in paragraph 121. I also leave on one side that the suggestion at paragraph 121(a) might have led the judge to question whether he was right to have found, earlier in his judgment, both that courts are already under an implied obligation to notify the Secretary of State of the rescission of a bankruptcy order and that courts invariably do so.
67. Paragraph 121 of the judgment as a whole amounts to a conclusion that Equifax was in breach of the duty required of it under the DPA because it failed to attempt to persuade the Secretary of State and the Insolvency Service to initiate modifications to the legislative and regulatory framework and in particular failed to secure the reversal of the legislative choice made in 1986 no longer to require the automatic advertisement of annulments and rescissions.
68. I do not consider that this is a realistic conclusion. Self-evidently it is not realistic to conclude that an exercise of this sort was either necessary or feasible in relation to a tiny number of cases where the consequences of inaccuracy could not normally be expected to be anything other than temporary inconvenience. A duty the content of which is to lobby for a change in the law must be very uncertain in its ambit and extent and in my view is implausible.
69. The 1986 changes to the law were made at a time when the Data Protection Act 1984 was already in force. That Act contained provisions similar to those in the DPA 1998 which are here engaged. The 1986 amendments can be taken to have been formulated with the provisions of the 1984 Act in mind. There is no suggestion that the data collection methods employed had given rise to any problem before that relating to Mr Smeaton on account of their failure to capture annulments or rescissions of bankruptcy orders. The relevant government agency published guidance to the effect that it was the responsibility of a former bankrupt to send proof of the annulment to the CRAs, guidance which would reasonably be understood as applying equally to rescissions. I do not consider that it is reasonable either to expect CRAs to have identified a "blind spot" or, had they done so, to lobby for a change to a so recently formulated legislative framework. Even if the suggested change to the Register could have been achieved without legislation, whether primary or subordinate, it would have been of no use on its own and would moreover, since the Register is public, itself achieve automatic advertisement in a manner against which Parliament set its face in 1986. The implications of imposing a duty of this nature would be profound, extending far beyond bankruptcy data on which this case has focussed.
70. Mr Arden submitted that a CRA could reasonably be expected to conduct a risk assessment which would lead to the discovery that it would only learn of a rescinded bankruptcy order if the debtor took the initiative and advertised or contacted the CRA directly, what he characterised as the blind spot. Having identified the blind spot a CRA could, he submitted, reasonably be expected to go to the IS and ask whether there is any way in which the IS could assist the CRA in ensuring that its data is accurate. The IS would no doubt be prepared to give details of rescission orders for an appropriate fee. Underpinning Mr Arden's argument was his suggestion, recorded at paragraph 46(8)(a) above, that where a rescission order is made the OR must ordinarily learn about it in order to stand down from his statutory functions. I have already pointed out that this suggestion is itself flawed, as the present case demonstrates. The only safe inference here is that the OR heard of the rescission order only because Mr Smeaton asked him to apply to the Land Registry for the removal of the registration. Nothing short of a rule change would ensure that the IS received the information which, it is suggested, the CRAs should have asked to share.
71. Equifax did take steps to ensure that its bankruptcy data was accurate. It obtained the data from a reliable and authoritative source in the form of the Gazette, it transferred the data accurately onto its data bases from that source and it amended its data immediately upon being made aware that it was inaccurate. Equifax monitored the Gazette. When the electronic data supply was first made available in 2008, Equifax implemented it immediately in order to ensure, as best it could, the continuing accuracy of its data. In my judgment the judge was wrong to conclude that Equifax had failed to take reasonable steps to ensure the accuracy of its data.

The alleged co-extensive duty of care in tort

72. The judge reasoned as follows:-

"127 . . . Given the framework, duties and compensation provisions of the DPA, Equifax, by deciding to operate as a CRA and provide credit checks and references to customers, has assumed a responsibility to the consumers whose personal data it holds for the benefit of its customers. This is the liability that is imposed on it by the DPA when it chooses to offer services as a CRA and it owes the same duties to affected consumers as it owes to them by virtue of the statutory data protection principles that it must apply. In both cases, it must act with reasonable skill and care.

128. It seems to me self-evident that since common law duties can co-exist with statutory duties based on a similar failure to exercise reasonable skill and care, a statutory tortfeasor acting negligently is ordinarily also to be found to be liable in common law negligence. The only practical consequence of this somewhat conceptual distinction between liability for breach of statutory duty and liability for breach of a common law duty is that it is conceivable that the rules of remoteness, scope of duty, recoverable loss and limitation are, in some situations, more generous in negligence than in statutory duty and, in the case of distress, more generous in statutory duty than in negligence."

73. With respect to the judge, this reasoning falls into the error identified by Lord Hoffmann in Customs and Excise Commissioners v Barclays Bank [2007] 181 at 200:-

"The question of whether the order can have generated a duty of care is comparable with the question of whether a statutory duty can generate a common law duty of care. The answer is that it cannot: see Gorringe v Calderdale Metropolitan Borough Council [2004] 1 WLR 1057. The statute either creates a statutory duty or it does not (that is not to say, as I have already mentioned, that conduct undertaken pursuant to a statutory duty cannot generate a duty of care in the same was as the same conduct undertaken voluntarily). But you cannot derive a common law duty of care directly from a statutory duty."

74. I also consider that the judge was in error in concluding that a CRA assumes a responsibility to every member of the public simply by choosing to operate this type of business. As Lord Mance put it in the Barclays case at 217, such an approach "is to assign to the concept of voluntary assumption of responsibility so wide a meaning as to deprive it of effective utility". Thus the judge was in my view wrong to identify a duty of care in tort co-extensive with that which he had found to be imposed by the statute.
75. Approaching the matter on the basis of the traditional three-fold test of foreseeability, proximity and whether it is fair, just and reasonable to impose a duty, Mr Handyside supplied four compelling reasons which, to my mind, demonstrate conclusively why it is inappropriate here to superimpose on whatever is the statutory duty a co-extensive duty of care in tort. Thus:-

"(1) It is doubtful whether it was reasonably foreseeable that the recording of incorrect data on Mr Smeaton's credit reference would cause him any loss, having regard to the practices operated by the credit industry set out in the Guide to Credit Scoring 2000. A person whose credit application was rejected because of adverse CRA data would be told of that fact and would be entitled to take steps to correct (or dispute) that data and to require the lender to reconsider the application for credit having regard to further, correcting information provided by the applicant.

(2) It would also not be fair, just or reasonable to impose a duty. In particular, imposing a duty owed to members of the public generally would potentially give rise to an indeterminate liability to an indeterminate class.

(3) It would also be otiose given that the DPA provides a detailed code for determining the civil liability of CRAs and other data controllers arising out of the improper processing of data.

(4) Apart from the DPA, Parliament has also enacted detailed legislation governing the licensing and operation of CRAs and the correction of inaccurate information contained in a credit file in the CCA 1974. This provides for the possibility of criminal sanctions, but does not create any right to civil damages. In such circumstances it would not be appropriate to extend the law of negligence to cover this territory."

I agree.

76. I would allow the appeal. I would answer the judge's three questions set out at paragraph 5 above:-

(1) No

(2) No

(3) Does not arise, but had it arisen No.

Lord Justice Davis :

77. Before the Insolvency Act 1986 and Insolvency Rules 1986 came into force, the problem thrown up on the unusual facts of this case could not have occurred. Under s.29(3) of the Bankruptcy Act 1914 and Rule 358 of the Bankruptcy Rules 1952 rescission or annulment of a bankruptcy order would have been positively required to be advertised in the Gazette. The reasons for the subsequent change in the Rules are (to me at least) rather difficult to discern. The justification suggested by the editors of Muir Hunter is that the automatic gazetting of an annulment or rescission might be capable of harming the bankrupt's interests by reason of the publicity. But, given that the making of the original bankruptcy order will itself have been publicised in the Gazette, one would have thought that publication of subsequent annulment or rescission would only assist rather than hinder. Moreover, there may well be third parties who would have an interest in knowing, via the Gazette, of any subsequent annulment or rescission. But the change in the law was and is clear: it is now for the bankrupt (if he chooses) to initiate the necessary steps for publication.
78. I am also not clear as to the rationale for the differentiation in the notification requirements for orders of annulment on the one hand and orders of rescission on the other. But again the 1986 Rules make that differentiation.
79. That being so, in my view it places the bar way too high to suggest that CRAs should have been required to seek (let alone, by implication, achieve) by negotiation with the authorities a modification of the detailed statutory scheme in this regard (which Parliament had decided to introduce in the 1986 Rules) with a view to correcting what was asserted before us to be a "blind spot".
80. The principles of the DPA relevant to this case do not impose an absolute and unqualified obligation on CRAs to ensure the entire accuracy of the data they maintain. Questions of reasonableness arise in the application of the fourth principle, as paragraph 7 of Part II of Schedule I spells out. No problem of the present kind had previously been thrown up, so far as Equifax or other CRAs were concerned. There was also no suggestion in the evidence that consumer protection groups had previously raised the existence of any perceived problem in this regard. It is noteworthy that the judge himself described this very case as "virtually unique". It is also important to bear in mind the existence of the various published leaflets and guidance documents, drawing attention to the need for individuals to take responsibility for arranging any required publicity or notification of withdrawal of a bankruptcy order previously made against them.
81. In my clear view the evidence, taken with the statutory schemes, could not justify a conclusion that Equifax breached its obligations under the DPA. It discharged any burden on it to show that it had taken reasonable steps. There is also in this regard simply no room for – as well as no need for – the construct of some concurrent duty in tort. The statute itself exhaustively provides for the applicable obligations and remedies in a case such as this.
82. As to causation, and whether at first sight or second sight or third sight, the judge's conclusion, given the background circumstances, seems remarkable. I appreciate his conclusion was one of fact. But in my view, with all respect, it cannot be sustained on the evidence. Indeed, in reaching this conclusion he plainly misconstrued the second letter from the bank: which clearly, by its reference to adverse data, was referring to all the other adverse matters on Mr Smeaton's file, and not the bankruptcy order itself.
83. I have had the opportunity of reading the judgment of Tomlinson LJ. I agree that this appeal should be allowed, for all the reasons which he gives and with which I entirely concur.
84. I would like to acknowledge the very thorough and able arguments of Mr Handyside (leading Mr Milner) and Mr Arden (leading Mr Calland).

Sir Robin Jacob :

85. I agree with both judgments.

Note 1   These are incorrectly referred to in Judgment 2 at [88] as the Consumer Credit (Credit Rating Agencies) Regulations.    [Back]

Note 2   See s.412 of the Insolvency Act 1986     [Back]

Note 3   Insolvency Rules 1986, rule 6.34(1)     [Back]

Note 4   Insolvency Rules 1986, rule 6.34(2)    [Back]

Note 5   Insolvency Rules 1986, rule 6.223(B)(1) (until 1 April 2004); rule 6A.2 (since 1 April 2004)     [Back]

Note 6   Insolvency Act 1986, s.279(1)     [Back]

Note 7   See Fitch v. Official Receiver [1996] 1 WLR 242, 246     [Back]

Note 8   Insolvency Rules 1986, rule 6.213(2) The time period for such notification has varied over time: currently notification must be given as soon as reasonably practical: see Judgment 2 at [25].     [Back]

Note 9   Insolvency Rules 1986, rule 6.223A(5) (until 1 April 2004); rule 6A.5 (since 1 April 2004).    [Back]

Note 10   Judgment 2 at [26]    [Back]

Note 11   cf Attorney General of Belize v. Belize Telecom Ltd [2009] 1 WLR 1988, per Lord Hoffmann at [16]-[27]     [Back]

Note 12   This point is only of limited significance to the present appeal, because as explained below, the CRAs did not at the relevant times obtain their bankruptcy data from the Insolvency Service or the Register.    [Back]

Note 13   Insolvency Rules 1986, rule 6.223(A)(6) (inserted by the Insolvency (Amendment) Rules 1999, rule 8).    [Back]

Note 14   Insolvency Rules 1986, rule 6.213. The rule only makes provision for annulments to be advertised. However, rescissions of bankruptcy orders can in practice be advertised in the Gazette, as the Judge acknowledged at [93].    [Back]

Note 15   Insolvency Rules 1986, rule 6.34(3)    [Back]

Note 16   Consumer Credit (Credit Reference Agency) Regulations 2000, regulation 3     [Back]

Note 17   First Witness Statement of Nicholas Beresford, paragraph 53     [Back]

Note 18   Consumer Credit (Credit Reference Agency) Regulations 2000, regulation 3    [Back]

Note 19   It is now part of the Department for Business, Innovation and Skills.    [Back]

Note 20   See Judgment 2 at [94], [100], [101(7)].    [Back]

Note 21   Information Commission: Credit Explained, December 2005     [Back]