Jersey Unreported Judgments

Employment - application by the representor for access to various documents.

[2016]JRC050

Royal Court

(Samedi)

25 February 2016

Before     :		W. J. Bailhache, Esq.,Bailiff, and Jurats Marett-Crosby and Thomas
Between	Dr Amar Alwitry		Representor
And	The States Employment Board		First Respondent
And	Minister for Health and Social Services		Second Respondent

Advocate S. M. J. Chiddicks for the Representor.

Advocate L. A. Ingram for the Respondents.

judgment

the bailiff:

1.        The Court sat on 26^th October, 2015, to hear the application of the Representor against the First and Second Respondents for orders pursuant to the Data Protection (Jersey) Law 2005 ("the Data Protection Law") and reserved its decision.  This judgment reflects the decision which has been reached.  It concerns effectively an application by the Representor for orders in respect of two classes of documents - category 2 documents, which were those delivered to the Judicial Greffier by the First and Second Respondents pursuant to the Court's interim order on 17^th June, 2015, reported at Alwitry-v-The States Employment Board and Minister for Health and Social Services [2015] JRC 131, and what are described as category 3 documents, which include any other documents which would be covered by a subject access request from the Representor but where no search has yet been carried out.  At the hearing on 26^th October, evidence was taken from both the Representor and from Advocate Howard Sharp QC and we touch on that evidence later in this judgment. 

Facts

2.        Although there is dispute over some of the relevant facts, many are agreed.  We set out below our findings of fact to the extent they are relevant for the purposes of this judgment. 

3.        There is no dispute that the States Employment Board ("SEB"), the First Respondent, employs persons on behalf of the States of Jersey, nor that the Second Respondent ("the Minister") holds political responsibility for the delivery of health and social services in the Island, and in particular for the services provided at the Jersey General Hospital, including the treatment of eye conditions.  The Representor is a consultant ophthalmologist, specialising in the treatment of eye conditions, and applied for a job as consultant at the General Hospital.  In his evidence to us, the Representor describes how on 24^th August, 2012, he entered into a contract of employment with the SEB as a consultant in ophthalmology, and on 22^nd November, 2012, the SEB purportedly decided to revoke or terminate that contract.  The Representor told us that he was brought up in Jersey and that the Island had paid for his medical training.  He wanted to return to the Island and had enrolled his sons at Victoria College.  On accepting the job offer at the General Hospital, both he and his wife had given up their jobs in the United Kingdom, preparatory to coming to the Island.  As a result of the termination of his contract his dream of returning to Jersey was lost.  The Representor has asserted before us that he has two legitimate reasons for pursuing the present litigation - first of all he is entitled to know why the contract which he had was terminated before he even arrived, and secondly he considers that there are legitimate patient safety concerns which arise out of the handling of his contract negotiations and/or the termination of it.  The SEB for its part gave as a reason for the termination of the employment that there had been an irremediable breakdown in relations between the Representor and Mr Downes, the clinical director at the Hospital to whom the Representor would report.  

4.        In or about March 2013, Mr Paul Beal, a human resources consultant, was retained by the First Respondent to conduct a case review in relation to the Representor's complaints.  He interviewed a number of witnesses in the presence of a human resources officer who took notes.  The witnesses were subsequently sent the notes and invited to comment upon them, which they did.  This process is described at paragraph 19 in the Court's judgment of 17^th June, 2015, to be found at [2015] JRC 131.  The Representor has received a redacted copy of Mr Beal's report, but has not seen the summaries and handwritten notes.  In accordance with the order of 17^th June, 2015, the documents were provided to the Judicial Greffier and we have reviewed them, as indicated later in this judgment. 

5.        On or about 25^th June, 2013, the Representor commenced proceedings before the Jersey Employment Tribunal claiming unfair dismissal.  The SEB resisted that claim and ultimately the Representor withdrew his complaint before that Tribunal by letter dated 4^th December, 2014. 

6.        In the meantime, on 1^st August, 2013, Messrs Sinels on the Representor's behalf had made a written subject access request for copies of all communications (electronic or otherwise), minutes of meetings, letters, notes and reports concerning the Representor and/or which contained his name.  Correspondence from the Law Officers' Department on behalf of the SEB, in September 2013 confirmed that this request was being given active consideration and that a comprehensive response should be available in the course of September - subsequently on 30^th September the Law Officers' Department confirmed that the subject access request was "in an advanced state of preparation" and the Representor could expect to receive it the following week. 

7.        However, on 4^th October, 2013, Advocate Sharp QC, then Her Majesty's Solicitor General, wrote to Messrs Sinels to suggest that the subject access requests be put on hold until he had conducted an investigation into the circumstances surrounding the purported revocation or termination of the Representor's contract of employment.  The then Solicitor General indicated that he wished to conclude the interviews necessary for that investigation and it was his preference to have the status quo maintained pending the outcome of it.  The Representor agreed to put his subject access request on hold.  In January 2014 the Solicitor General provided Messrs Sinels with a copy of his draft report and on 5^th February, 2014, Messrs Sinels responded with the Representors observations on that draft, which included requests for disclosure of documents referred to within the Report.  The Solicitor General was also put on notice that the Representor was duty bound to report issues regarding patient safety at the Hospital to the General Medical Council. 

8.        On 21^st February, 2014, the Solicitor General provided Messrs Sinels with a copy of the finalised report, but declined to provide any further documentation.  

9.        A further subject access request was made by Messrs Sinels on 25^th February, 2014, including more detailed requests for documents.  The response from the Law Officers' Department was that disclosure had already been made, but to the extent that the subject access request included any further material, the SEB would consider it and revert in due course.  Further correspondence followed over the next months, until on 29^th October, 2014, the Representor brought this representation before the Court seeking an order that the Respondents comply with the subject access requests and/or that all personal data relating to the Representor which has been processed by the Respondents should be made available to the Court for examination and determination regarding onward provision to the Representor.  The answer filed by the Respondents acknowledged that the Representor had been offered a job at the Jersey General Hospital by letter dated 21^st August, 2012, and contended that by letter dated 22^nd November, 2012, the job offer had been withdrawn on the basis that the Representor's behaviour had caused a fundamental breakdown in trust and confidence.  The answer relies upon the report prepared by the then Solicitor General, and advances a number of defences to the subject access request proceedings:-

(i)        By seeking disclosure of personal data that is said to exist but is not to be found in the substantial disclosure already made, the representation is said to go beyond what is proportionate. 

(ii)       The subject access request was being used not to obtain the personal data of the Representor but as a tool for wide-sweeping discovery of documents intended to further the claim by the Representor before the Employment Tribunal, and/or the plan of the Representor to make disciplinary complaints to the General Medical Council about those whom the Representor holds responsible for the termination of his contract. 

(iii)      The Representation sought disclosure of Mr Beal's unredacted report and summaries, and interview transcripts and witness statements which were generated during the Solicitor General's inquiry and during earlier enquiries and which contained personal data of the third party witnesses which it was inappropriate to disclose without their informed consent.  

(iv)      In summary, the Respondents asserted that the Representor's personal data had been processed, that the Respondents had complied with the data subject access request and that by his representation, the Representor sought disclosure of data outside that which was required to be provided under the Data Protection Law. 

10.      In effect, there are therefore three classes of documents:-

(i)        Class 1 - documents already disclosed;

(ii)       Class 2 - the unredacted report of Mr Beal and his interview summaries, including handwritten amendments by the interviewees and the interview transcripts and witness statements generated during the Solicitor General's inquiry; and

(iii)      Class 3 - any other documents which might exist in the hands of the Respondents to this appeal. 

The Law

11.      The Data Protection Law contains a wide definition of the expression "data" in Article 1; it includes information processed by equipment operating automatically, but also it includes information recorded as part of a relevant filing system - in other words the set of potentially disclosable information is structured either by reference to individuals or by reference to criteria relating to individuals in such a way that specific information relating to a particular individual is readily accessible.  The expression therefore includes information contained in paper records which form part of such a system.  There are subject information provisions found both in Article 7, to which we will come later, and in paragraph 2 of Schedule 1 Part 2 dealing with the first data protection principle.  For the purposes of this case the following Articles of the Law seem to us to be relevant. 

12.      Article 4 provides where relevant as follows:-

"(1)     References in this Law to the data protection principles are to the principles set out in Schedule 1 Part 1.

(2)       Those principles are to be interpreted in accordance with Schedule 1 Part 2.

(3)       ...

(4)       Subject to Article 27(1), it shall be the duty of a person to comply with the data protection principles in relation to all personal data with respect to which the person is a data controller."

13.      Schedule 1 contains the relevant data protection principles. At clause 1, the first principle is stated as follows:-

"Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a)       in every case - at least one of the conditions set out in paragraphs 1-6 of Schedule 2 is met; ..."

14.      Assistance on what is fair processing is to be found in Part 2 of Schedule 1, clause 1 of which requires that regard is to be had to the method by which the personal data had been obtained, including in particular whether any person from whom such data has been obtained is deceived or misled as to the purpose or purposes for which the data is to be processed.  By clause 2 of part 2 of Schedule 1:-

"(1) Subject to paragraph 3, for the purposes of the first principle personal data are not to be treated as processed fairly unless -

(a)       in the case of data obtained from the data subject - the data controller ensures so far as practicable that the data subject has, is provided with, or has made readily available to him or her, the specified information; or

(b)       in any other case - the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him or her, the specified information.

....

3         First principle: primary and other conditions

(1)       Paragraph 2(1)(b) does not apply if either of the primary conditions, together with such further conditions as may be prescribed by Regulations, are met.

(2)       For the purposes of this paragraph, the primary conditions are -

(a)       that the provision of the specified information would involve a disproportionate effort on the part of the data controller; and

(b)       that the recording of the information to be contained in the data by, or the disclosure of the data by, the data controller is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract."

15.      These data protection principles, and the guidance as to their interpretation, are relevant for the purposes of what we are required to decide today. 

16.      Part 2 of the Data Protection Law sets out the rights of data subjects.  They included fundamental rights of access to personal data:-

"7       Fundamental rights of access to personal data

(1)       An individual is entitled to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller, and, if that is the case, to be given by the data controller a description of -

(a)       the personal data being so processed of which that individual is the data subject;

(b)       the purposes for which they are being or are to be processed by or on behalf of that data controller; and

(c)       the recipients or classes of recipients to whom they are or may be disclosed by or on behalf of that data controller.

(2)       An individual is entitled to the communication in intelligible form, by the relevant data controller, of -

(a)       the information constituting any personal data of which the individual is the data subject; and

(b)       any information available to the relevant data controller as to the source of those data.

...

(7)       If a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, the controller is not obliged to comply with the request unless -

(a)       the other individual has consented to the disclosure of the information to the person making the request; or

(b)       it is reasonable in all the circumstances to comply with the request without the consent of the other individual.

(8)       In paragraph (7), the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought in the request.

(9)       Paragraph (7) is not to be construed as excusing a data controller from communicating so much of the information sought in the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.

(10)     In determining for the purposes of paragraph (7)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to -

(a)       any duty of confidentiality owed to the other individual;

(b)       any steps taken by the data controller to seek the consent of the other individual;

(c)       whether the other individual is capable of giving consent; and

(d)       any express refusal of consent by the other individual.

...

(12)     If a court is satisfied on the application of any person who has made a request under this Article that a data controller has contravened this Article in failing to comply with the request, the court may order the data controller to comply with the request."

17.      Further guidance is given by the legislature under Article 8 to the treatment of requests under Article 7.  The relevant provisions are these:-

"8 (2)  The obligation imposed by Article 7(2)(a) shall be complied with by supplying the data subject with a copy of the relevant information in permanent form unless -

(a)       the supply of such a copy is not possible or would involve disproportionate effort; or

(b)       the data subject agrees otherwise.

(3)       If any of the information referred to in Article 7(2)(a) is expressed in terms that are not intelligible without explanation the copy shall be accompanied by an explanation of those terms.

...

(8)       For the purposes of Article 7(7) and (9), another individual can be identified from the information being disclosed if the individual can be identified from that information, or from that and any other information that, in the reasonable belief of the data controller, is likely to be in, or to come into, the possession of the data subject making the request."

18.      The terms of the Data Protection Law were settled having regard to the Data Protection directive, namely Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and having regard to comparable legislation in EU member states, and in particular the data protection legislation of the United Kingdom.  For this reason it is legitimate to have regard to cases in the United Kingdom on the parallel legislation there particularly because, absent the instant case, there appear to have been no disputed cases before the Royal Court on the legislation so far. 

19.      The first case is Durant v Financial Services Authority [2003] EWCA Civ 1746.  The factual context against which this case was determined by the Court of Appeal was that Mr Durant had failed in some litigation against Barclays Bank PLC and thereafter sought the assistance of the defendant to obtain disclosure of various records in connection with the dispute giving rise to that litigation.  The defendant investigated Mr Durant's complaint against the bank as it was at that time the single regulator for the financial services sector in the United Kingdom.  In accordance with statute, the defendant investigated the complaint against the bank, closed its investigation without informing Mr Durant of the outcome (pursuant to its confidentiality obligations) and thereafter Mr Durant complained to the Financial Service Authority Complaints Commissioner, who dismissed his complaint.  Mr Durant then made subject access requests under Section 7 of the Data Protection Act 1998 ("the 1998 Act") and, on receiving only some documents, and some redacted documents, brought proceedings under what is the equivalent of Article 15 of the Data Protection Law. 

20.      The lead judgment was given by Auld LJ who identified four issues of law concerning the right of access to personal data provided by Sections 7 and 8 of the 1998 Act (Articles 7 and 8 of the Data Protection Law).  These were:-

(i)        What makes "data" "personal data" so as to entitle a person identified by it to its disclosure?  The Court's conclusions on this issue are to be found at paragraphs 26 to 31 and in Buxton LJ's short judgment at paragraphs 77 - 80. 

(ii)       What is meant by a "relevant filing system" in the definition of "data" in Section 1(1) of the 1998 Act so as to render personal information recorded in a manual filing system disclosable under Section 7(1)?  The conclusions on this issue are to be found at paragraphs 45 - 51 and especially at paragraph 50 where Auld LJ said this:-

"Accordingly, I conclude, as Mr Sales submitted, that 'a relevant filing system' for the purposes of the Act, is limited to a system:

1. in which the files forming part of it are structured or referenced in such a way as clearly to indicate at the outset of the search whether specific information capable of amounting to personal data of an individual requesting it under Section 7 is held within the system and, if so, in which file or files it is held; and

2. which has, as part of its own structure or referencing mechanism, a sufficiently sophisticated and detailed means of readily indicating whether and where in an individual file or files specific criteria or information about the applicant can be readily located."

(iii)      What is the basis upon which redaction can take place when a data controller responds to a person's request for disclosure of his personal data?  When should the data controller arrive at the conclusion that it is "reasonable in all the circumstances" to comply with the request on a redacted basis even though the personal data includes information about another person and that other person has not consented to such disclosure?  The conclusions on this subject are found between paragraphs 60 - 67.  In a nutshell, the Court noted that the relevant provisions of Section 7(4)(2)(6) and 8(7) were intended to balance the interests of the data subject seeking access to his personal data with those of another individual who may be identified in such data.  The first point was that the balancing exercise only arose if the information relating to the other person forms part of the "personal data" of the data subject.  The second point was that the provisions created a presumption or starting point that the information relating to the other individual, including his identity, should not be disclosed without his consent, but that presumption might be rebutted if it were reasonable "in all the circumstances" to disclose without it.  At paragraph 66, Auld LJ held that, in short, "it all depends on the circumstances whether it would be reasonable to disclose to a data subject the name of another person figuring in his personal data, whether that person is a source, or a recipient or likely recipient of that information, or has a part in the matter the subject of the personal data".  Auld LJ added that the courts should be wary of attempting to devise any principles of general application in this context. 

(iv)      The last issue went to the basis upon which the Court should exercise its discretion under Section 7(9) of the 1998 Act to order a data controller to comply with the request for information.  Auld LJ noted that as a result of his conclusions on the other issues, there was not any need to exercise a discretion in that case anyway, but he pointed to the difficulty that if a court concluded that it was reasonable to comply with the data subject's request so as to disclose information about a third party under Section 7(4)(b), it was on the face of it unlikely that the court could reasonably then exercise its discretion under Section 7(9) against ordering compliance with that aspect of the data subject's request. 

21.      On the issue of what constitutes personal data, Auld LJ said this:-

"26. The intention of the directive, faithfully reproduced in the Act, is to enable an individual to obtain from a data controller's filing system, whether computerised or manual, his personal data, that is, information about himself. It is not an entitlement to be provided with original or copy documents as such, but ... with information constituting personal data in intelligible and permanent form ...

27. In conformity with the 1981 Convention and Directive, the purpose of Section 7, in entitling an individual to have access to information in the form of his "personal data" is to enable him to check whether the data controller's processing of it unlawfully infringes his privacy and, if so, to take such steps as the Act provides ... to protect it. It is not an automatic key to any information, readily accessible or not, of matters in which he may be named or involved. Nor is [it] to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against third parties. As a matter of practicality and given the focus of the Act on ready accessibility of the information ... it is likely in most cases that only information that names or directly refers to him will qualify ...

28. It follows from what I have said that not all information retrieved from a computer search against an individual's name or unique identifier is personal data within the Act.  Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which is privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have an interest, for example, as in this case, an investigation into some other persons or bodies conduct that he may have instigated ..."

22.      Buxton LJ put it this way:-

"79. The guiding principle is that the Act, following directive 95/46 gives rights to data subjects in order to protect their privacy. That is made plain in recitals (2), (7) and (11) to the directive, and in particular by recital (10), which tells us that:-

'The object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principle of community law.'

...

80. But the information sought by Mr Durant was by no stretch of the imagination a borderline case. On the ordinary meaning of the expression, relating to him, Mr Durant's letters of complaint to the FSA and the FSA's investigation of that complaint did not relate to Mr Durant, but to his complaint. The 1998 Act would only be engaged if, in the course of investigating the complaint, the FSA expressed an opinion about Mr Durant personally, as opposed to an opinion about his complaint ..."

23.      Accordingly the Court of Appeal found that the information which the plaintiff sought was not "personal data" within the meaning of the 1998 Act. 

24.      The next important case is Johnson v Medical Defence Union [2004] EWHC 347.  The facts in this case are that Mr Johnson, a consultant orthopaedic surgeon, made a subject access request to the medical defence union.  One of the services of which was the provision of professional indemnity insurance, written by a major insurance company and available to MDU members at a discount.  One of the articles of association of the medical defence union was that the board of management had an absolute discretion to refuse to renew the membership of any member, subject to giving 42 days prior notice and in January 2002 Mr Johnson's membership was not renewed.  As a result, he was forced to find alternative insurance cover because he was no longer eligible for the special insurance available through the MDU; and he was also concerned that his expulsion from the MDU might convey to others, including medical colleagues, the impression either that he was incompetent or that he had done something sufficiently wrong as to justify his exclusion from the organisation. 

25.      On receipt of the subject access request, the MDU provided Mr Johnson with a number of documents some of which were heavily redacted.  Mr Johnson took the view that the MDU had failed to comply properly with the request and that led to the proceedings before the Court.  The judgment concerns the preliminary issue as to whether and if so to what extent the MDU had complied with its obligations under Section 7 of the 1998 Act pursuant to the plaintiff's subject access request. 

26.      The points of principle which arise from the judgment of Laddie J are these:-

(i)        The data controller is only required to search through data which he has at the time the access request comes in.  At paragraph 33 of his judgment, Laddie J considered that the terms of Section 7(1) are only consistent with that construction.  He went on:-

"Thus the data subject is entitled to be informed whether personal data 'are being processed' by the data controller (Section 7(1)(a)). If that is so, he is entitled to be give the personal data of which he 'is' the data subject and to be told the purposes for which they 'are being or are to be 'processed'. None of this readily covers information which was data but is not so now. Furthermore there is no justification for extending the scope of the provision."

(ii)       The 1998 Act is designed to impose on the data controller an obligation of disclosure where the data is retained in a form which will allow it to be searched for and produced quickly and cheaply, and there must be ready access.  At paragraph 34, Laddie J said this:-

"... the statutory scheme for the provision of information by a data controller has to work proportionally and in a common sense manner. The data controller's employees must be able to identify relevant data at the outset with reasonable certainty and speed and without having to make a manual search. As this case demonstrates, if Mr Roughton's argument were correct, it would be necessary to make laborious manual searches through each document contained within non-indexed files simply because at some time in the past some of them were probably recorded temporarily on a hard disk. Furthermore the searcher would presumably have to make enquiries to discover which documents in a file had been recorded in this manner in the past.  That is not what is required by the Act."

(iii)      In general terms, the data subject is entitled to not simply his personal data but also ancillary information relating to them, namely the sources and addressees of that data.  Section 7(1)(b) and (c) entitles the data subject to be told not only what personal data the data controller are processing, but information concerning those involved in the transmission of those data.  It follows that before any redaction is removed so as to reveal the masked information, it must be demonstrated that the persons whose identities have been hidden were either transmitting or receiving personal data.  Depending on the facts of the case it might well be necessary to consider each of the documents of which complaint is made against that test. 

(iv)      The data controller is entitled to ask himself, based on all the material before him, what are the reasons or likely reasons for the data subject wanting this type of information (i.e. information which includes the personal data of third parties as well as the data subject's own data), and the relevance and force of any such reasons.  In making that assessment he can take into account any reasons actually communicated to him by the data subject (see paragraph 58). 

27.      We were also referred to Ezsias v Welsh Ministers [2007] All ER 65, a decision of Judge Higginbotham sitting as a Judge of the High Court.  The judge applied the dicta of Auld LJ and Buxton LJ in Durant, and otherwise there is nothing in this case which seems to us to be particularly noteworthy, the matter being decided on the facts, applying the Durant test.  Nonetheless, we note that it was Ezsias which led to us having the Category 2 documents to which we will turn shortly. 

28.      The next significant case presented to us is that of Edem v The Information Commissioner and the Financial Services Authority [2014] EWCA Civ 92.  Mr Edem had applied to the Financial Services Authority for a copy of all information that the Authority held about him and "my complaint that the FSA had failed to correctly regulate Egg PLC".  The FSA refused to provide some information on the ground that it was Mr Edem's own data which he could access under the 1998 Act.  Mr Edem complained to the Information Commissioner, and part of his complaint was upheld.  The Commissioner accepted that the complainant had a legitimate interest in information about the grading of staff who had handled his complaint.  However, the Commissioner decided that any legitimate interest in disclosure of the names of the individual members of staff was outweighed by the prejudice disclosure would cause to the rights and freedoms of the individuals concerned.  Mr Edem appealed to the First Tier Tribunal and succeeded on the grounds that their names did not constitute personal data.  That decision was reversed by the Upper Tribunal.  The appeal ended up in the Court of Appeal, the issue being whether the disclosure of the names of three junior officials could be withheld on the grounds that it was personal data and that disclosure of that information would contravene the first principle of the 1998 Act. 

29.      The significance of the Court of Appeal decision in the Edem case lies in its finding that the First Tier Tribunal had been wrong to apply Auld LJ's 'notions' in Durant.  In doing so, the Court of Appeal found that applying them in that case ran contrary to the statute, the directive and the jurisprudence of the Court of Justice, and that it was important not to misunderstand the context in which Auld LJ referred to those notions.  Moses LJ said this:-

"20. It can immediately be seen that the 'notions' were Auld LJ's explanation as to why the information and documents in which Mr Durant's name appeared were not personal data relating to him.  In a case such as the instant appeal, questions of whether the information is biographical or sufficiently focused upon a particular named individual are of no relevance whatsoever. They have nothing to do with the question whether disclosure of a person's name is disclosure of personal data. A name is personal data unless it is so common that without further information such as its use in a work context, a person would remain unidentifiable despite its disclosure.

21. The Information Commissioner's office data protection technical guidance to assist in determining what is 'personal data' accurately sets out the effects of the statutory scheme:-

'6. It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.'"

30.      We turn next to the case of Elliott v Lloyds TSB Bank PLC and another [2012] 24th April 2012 Leeds County Court].  In this case, the claimant had made subject access requests of the defendants with which he alleged they had failed to comply, and as a result he applied to the Court for the relevant order under the 1998 Act.  The area of dispute was very limited, turning on whether or not the Bank was required to disclose to the claimant his personal data (if any) from the records of six senior managers within the Bank.  The defendants contended that the claimant ought not to receive any relief because the application was an abuse of the subject access procedure as it was pursued for a collateral purpose.  The defendants asserted that the real or dominant purpose of the claimant in pursuing the application was as a fishing expedition to further his claims against one of the defendants.  The claimant denied that this was his purpose.  He said that he was suspicious that his personal data had been used improperly and had been given to people who had no right to it.  In those circumstances the proceedings were taken to ensure that his personal data had not been misused. 

31.      The decision was that of his Honour Judge Behrens who agreed that most of the law was uncontroversial, referring as he did inter alia to Durant and Ezsias.  Judge Behrens indicated that there were two areas of law arguably not covered by the authorities.  The first was where there were mixed motives on the part of a claimant.  The second was the extent to which the defendants might by obliged to make searches in order to comply with their duties under the 1998 Act. 

32.      The judge noted that if the real purpose of the application was to obtain documents or information which might assist the claimant in a claim against a third party, that would be an improper purpose and there was no obligation to comply with the request.  However, he drew on comments of Lewison J in Iesini v Westrip Holdings [2011] 1 BCLC 498 at paragraphs 119 - 122, a case concerned with an application to bring a derivative action under Section 261 of the Companies Act 2006, to reach the conclusion that where a claimant had mixed motives in bringing an application, the application would not be an abuse of process unless it can be shown that, but for the collateral purpose, the application would not have been brought at all. It is not entirely clear where the judge considered the burden of proof lay in this respect.  At paragraph 83, having earlier summarised the claims of the defendants, he said this:-

"I see the force of these submissions but in the end I do not accept them. First, I do not accept that it is necessary for Mr Elliot to establish a lawful purpose as 'the dominant purpose'."

33.      In our judgment the structure of the 1998 Act but more importantly for present purposes, also of the Data Protection Law, is that rights are conferred on those who make subject access requests which rights are then qualified in different ways in the judgments referred to above.  However, we do not regard the motivation behind the subject access request as a matter which the data subject must prove.  Firstly, there is nothing in the Data Protection Law which leads to that conclusion.  Secondly, to the extent that in some cases the data subject would be required to prove a negative, namely that he was not bringing the subject access request for an improper purpose, it does not seem to us that a data subject should be in that position.  Finally, the usual rule in proceedings before the Court is that he who makes the assertion must prove it.  As just indicated, there is no express or implied obligation in the Data Protection Law for a data subject to prove his motivation.  If the position is that the data subject is not so required to establish the purpose for which he was bringing the subject access proceedings and the Court construes the data subject's rights in such a way that he is not entitled to exercise them where he has an improper motive, it is for the data controller to establish the improper motive if that is what is being asserted.  Of course, the evidential burden, as opposed to the legal burden, may shift one way or another as the evidence emerges in each case. 

34.      As to the proportionality of the search, Judge Behrens referred in some detail to Ezsias and reached the conclusion that the defendants were only obliged to supply such personal data to the claimant as was found after a reasonable and proportionate search. 

35.      We have noted that guidance has been issued by the Data Protection Commissioner under the Data Protection Law.  In a good practice note which we approve, the copy of which was put before us was undated, the Data Protection Commissioner gives this guidance:-

"It has been suggested that recent case law, and in particular [Durant], provides authority for data controllers to refuse to comply with a subject access request where the applicant is contemplating or has already begun legal proceedings.

The Commissioner does not accept this proposition. She takes the view that failing to comply with a subject access request in such circumstances will, unless an exemption under the law applies, amount to a breach of the 6th data protection principle. The right of subject access is one of the cornerstones of data protection legislation. If a data controller were able to avoid complying with a subject access request in circumstances where the data subject was contemplating or had begun legal proceedings it would seriously undermine this fundamental right.

However, the courts do have a discretion as to whether to grant an order under Article 7(12) and may be reluctant to exercise that discretion where it is clear that the purpose of the request is to fuel separate legal proceedings and, importantly, where the discovery rules under the Civil Procedure Rules would provide a more appropriate route to obtaining the information sought. The Commissioner is also likely to take such matters into account when considering whether to exercise her enforcement powers under Article 40." [emphasis added]

36.      Drawing these themes together, it seems to us that the following principles ought to apply in the context of consideration by the Royal Court of an application for an order against a data controller under Article 7(12) of the Data Protection Law. 

(i)        The first duty of the data controller is to review what information he has about the data subject.  It is impossible to know either whether the data in question is personal data or sensitive personal data and therefore falls within the ambit of the Data Protection Law, or indeed to determine whether the data is being processed fairly, without first identifying what it is.  In carrying out this review, the data controller will have regard to the comments of Auld LJ and of Buxton LJ in Durant, as set out in paragraphs 19 and 20 above, bearing in mind that in Edem the Court of Appeal did not find the reference to the "notions" in Auld LJ's explanation as to why some of the information was not personal data to be helpful.  In our judgment the real issue is whether the information in question is obviously about the data subject as an individual, and is private to him or her.  It is obviously about an individual not only where it relates to a particular person, but also where it is obviously linked to such a person.  Biographical details are clearly about an individual, but the definition of personal data goes wider than such details, and includes information obviously linked to him. 

(ii)       The data controller has an obligation to comply with Article 7 of the Data Protection Law.  It is to be noted that in Article 7(11) the data controller "shall" comply with a request promptly unless the provisions of Article 7(7) apply.  It follows that where personal data is being processed, one starts from the assumption that the data subject is entitled to the information set out in paragraphs (1) and (2) of Article 7 unless other provisions apply. 

(iii)      The fact that Article 8(2) provides an exception to the obligation to supply the data subject with a copy of the relevant information in permanent form does not of course mean that the data controller is obliged not to supply that information if it involves disproportionate effort.  The data controller has a discretion to refuse the subject access request, but, provided that compliance with the request satisfies any data protection obligations owed to other data subjects, the data controller can comply even if disproportionate effort is needed to do so.  It is to be noted that the exception in Article 8(2) of the Data Protection Law refers only to the supply of a copy of the relevant information, but the definition of "processing" to be found in Article 1 of the Data Protection Law imports with it the concept of proportionality in identifying what information is being held.  It will be a question of fact having regard to the circumstances of each case as to what is a proportionate exercise to undergo in order to identify whether information or data is being processed, but clearly whatever system is in issue needs to be interrogated to identify whether the system records or holds data, or whether that system has organised adapted altered or used the information or data.  If the information or data can be retrieved, then it can clearly be disclosed, and similarly if it can be combined or blocked or erased or destroyed, there is a strong probability that it can be retrieved.  The principle of proportionality needs to be applied to the rigour with which the obligation of the data controller to identify whether data is in fact being processed is enforced. 

(iv)      Where the data controller has refused a subject access request, the function of the Court is to make the following assessments:-

(a)       Whether personal or sensitive personal data is being processed by the data controller;

(b)       Whether any of paragraphs 1 - 6 of Schedule 2, or in the case of sensitive personal data paragraphs 1 - 10 of Schedule 3 is met;

(c)       Whether the data controller has contravened Article 7 of the Data Protection Law.  This may involve the Court seeking the rationale of the data controller in the decision taking process (see Article 7(3));

(d)       Where Article 7(7) does apply and the rights of other data subjects need to be balanced with the rights of the data subject making the subject access request, whether redaction is possible so as to protect the rights of the third party individuals whilst at the same time giving effect to the rights of the data subject making the request; and

(e)       Where the data subject's motivation is disputed, whether the Court considers that it ought not in its discretion assist the data subject if satisfied that the application was not brought for any proper purpose. 

Class 3 documents

37.      We heard evidence both from Dr Alwitry and from Advocate Howard Sharp QC.  In the context of the category 3 documents, Advocate Sharp's evidence was relevant.  He said that he conducted an investigation into the events surrounding Dr Alwitry's recruitment to the General Hospital and he created a bundle of documents which he could show the different witnesses.  He interviewed witnesses (the Representor twice) and these interviews were electronically recorded and transcripts produced.  He told us that when he was instructed by the First Respondent to conduct this investigation, he asked for all records relevant to the case from both of the Respondents.  He believes he had full access to the e-mail accounts of all the relevant persons.  He was able to trawl through a large number of e-mail accounts and he found a few additional documents which he put into the interview bundle.  He asked for all relevant documents as he was not interested in a collation for any other purpose. 

38.      In Advocate Sharp's view, he had obtained all relevant documents, which was an exercise which went wider than obtaining all documents relating to a subject access request under the Data Protection Law.  In the context of the expression "relevant documents", Advocate Sharp had been asked by the First Respondent to provide a full report, in particular having regard to whether the Representor had been sacked over a dispute on private practice arrangements, and/or over patient safety issues.  Advocate Sharp told us that he went through all the e-mail accounts of senior management at the General Hospital and those of some of their personal assistants, including the e-mail account of a gentleman from Human Resources. 

39.      In our view, the investigation of the then Solicitor General was not for any of the purposes of the Data Protection Law.  There does not seem to be much doubt about it.  Advocate Chiddicks submitted, in our view rightly, that Advocate Sharp could not speak to the steps which the Respondents took to check their own information, and indeed there is no evidence before us that they took any steps at all, other than in the provision of a small bundle of documents to Advocate Sharp in the first instance.  It is no answer to this objection to say that Advocate Sharp acted independently, which we are sure that he did.  Advocate Sharp's view was that no further data will be produced.  That may well be so.  Nonetheless, the Representor succeeds in relation to the Class 3 documents because, applying the principle that it is essential that the data controller reviews what data is in his possession, neither the First nor the Second Respondent has actually conducted that exercise.  That review should be made applying the principles set out in paragraph 36 above and of course the principles of the Data Protection Law. 

Category 2 documents

40.      We now turn to these documents, namely Mr Beal's statements and handwritten notes, and the transcripts and notes of interviews in relation to the interviews held by the Solicitor General. 

41.      We also refer now to the evidence which we heard from Dr Alwitry who accepted that there was a balance to be struck between the rights of the various data subjects.  He told us that he had raised valid patient safety concerns, and that he was acting properly in doing so.  He did not think that his e-mails had been appropriately passed on within the General Hospital, particularly with regard to timetabling.  He took the view that if anyone misused his personal data, he was entitled to have that put right.  He said it was not entirely accurate to say that he had reported Mr Downes to the British Medical Association, although he agreed he had written to the BMA to ask for its advice.  He had brought proceedings under the Employment Law for unfair dismissal, but these had been withdrawn and there were no proceedings on hand for breach of contract.  He asserted that he wanted the data in question because:-

(i)        He wanted to know why his dreams of returning to Jersey had been shattered. 

(ii)       He wanted to send a message to the Health and Social Services Department about how that Department should behave. 

(iii)      Armed with the relevant data, he would then consider how he should deal himself.  He had regarded this whole process as stressful and expensive.  He thought that on the balance of probability he would not be taking proceedings, whatever the data provided, but he did not rule the possibility out.  Ultimately it would probably depend on what data was disclosed.  He asserted that he had a professional duty to raise with the General Medical Council patient safety concerns if these had not been addressed. 

42.      It was contended by Advocate Ingram that the subject access request was made for an improper purpose.  The Respondents asserted that the real or dominant purpose of the Representor in pursuing the application was a fishing expedition to enable him either to further his claims in contract or to make a complaint to the General Medical Council.  In our judgment, the burden of proof lies as indicated on the Respondents in this connection.  No sufficient evidence has been put before us to support the contention that the purposes of the subject access request are as contended by the Respondents.  Further or in the alternative, if these purposes provide some of the rationale for making the subject access request, such that there were in effect mixed motives, we do not think there is any evidence which convinces us that absent these other purposes the application would not have been brought at all.  Accordingly we do not think the Representor needed to establish a lawful purpose as the dominant purpose, and furthermore that, put the other way, there is no evidence adduced which satisfies us to the civil standard that any wrongful purpose was the dominant purpose of making the subject access request.  Accordingly, we have reviewed the category 2 documents solely against the criteria of Article 7(7), namely whether the rights of other data subjects are disproportionately or inappropriately given a priority over the data subject access rights of the Representor. 

43.      We have reviewed the Class 2 documents and applied the principles which are set out at paragraph 36(iv) above, and also considered the following points in relation to this application.  This is a subject access request which arises not only out of a job application but also out of an offer actually made in respect of that job and subsequently withdrawn.  At its heart, the Data Protection Law is about protecting the privacy of information attaching to an individual, where the first protector, as it were, is the person whom the information concerns; and s/he must know what it is in order to protect it and the way it is processed.  The Representor knows that an amount of information about him and why the offer once made was withdrawn is held by the Respondents.  The starting point is that, unless there is good reason to the contrary, he is entitled to it. 

44.      In the course of assimilating that information, the Respondents have acquired personal data of others as well - their names and their opinions at least.  They too are entitled to some privacy in principle.  However, in balancing the respective rights for the purposes of Article 7(7)(b) of the Data Protection Law - what is reasonable to be disclosed notwithstanding their objection to disclosure - the Court will have regard to whether their personal data is ancillary to the main purpose for which the data is held, and here that is obviously so.  A good way of testing that is to ask the question whether the data which represents material relevant to both the Representor and others would be retrievable in a proportionate way if held not on equipment operating automatically in response to instructions given for that purpose, but held manually in a relevant filing system.  If held on the latter basis, one would find the data under "A" for Alwitry and not under the initial of whoever had expressed an opinion relevant to whether the Representors job offer should be withdrawn.  That empirical test emphasises how on any normal reading of the facts here, the context is that the data is more directly concerned with the Representor than with anyone else.  This is because the context is the withdrawal of the job offer and the reasons for it.  All of that is the Representor's personal data.  The context fits precisely one of the reasons the Representor gave us for his subject access request - and we accept it is reasonable for him to know the reasons for the job being withdrawn and what part was played by the various actors liaising with the Respondents.  He would be entitled to have the information as part of discovery in litigation and there is no reason in our judgment to refuse it to him on a subject access request when it concerns him more that those whose names and opinions are mentioned. 

45.      If the result of this approach is that data controllers become more cautious about the nature of the information they hold and process, such an outcome is consistent, as we see it, with the objectives of the Data Protection legislation.  We also add that we agree with the approach taken by Auld LJ that the assessment of reasonableness will be very much influenced in any case by the fact specific circumstances of that case.  It is not necessarily so that a similar conclusion would be reached in the present case for example if no job offer had ever been made in the first place.  That argument would be for another day. 

46.      The next point we think needs to be made is this.  We note that in Edem the issue was whether the names of the individuals at the heart of the appeals were or were not personal data.  Adopting the "notions" to which Auld LJ referred in Durant, the First Tier Tribunal reached the conclusion that there were no personal connotations attached to the names of these individuals.  It appears from the extract of the First Tier Tribunal's decision, that, had there been some contentious issue arising, such as the subject of animal rights, and the possibility of harassment of the individuals by animal rights activists, then the data might have been considered as personal data.  Reaching the conclusion that no such issues arose, the First Tier Tribunal therefore reached the conclusion that their names were not personal data, and it is because the Court of Appeal considered that approach to be wrong that Mr Edem's appeal failed.  What was not argued in the Edem case was the question of balancing the rights of the other individuals with those of the data subject.  We agree that the names of those interviewed both by Mr Beal and by the former Solicitor General amount to personal data for the purposes of the Data Protection Law.  The question for us is how their rights to protection of that personal data should be balanced with the rights of the Representor. 

47.      It seems to us that the status of the interviewees, which is set down in their statements or interview notes and their names are all data which is of particular relevance both to them and to the Representor.  The Representor is entitled to say that the names and status are relevant to the weight of the opinion which was expressed and the weight which the relevant opinion would carry.  This information therefore goes directly to the quality of the personal data held in relation to him.  He is also entitled to say that in so far as the status of the witnesses is concerned, this is very largely a matter of public record.  Most of the interviewees were relatively senior people, whose jobs would be well-known once their names were mentioned.  Put another way, their biographical significance is clearly linked to the Representor by reason of the context in which their names appear in this particular collection of data.  In those circumstances, their objections to disclosure carry less weight.  The hardship to the Representor in not having the information outweighs the hardship to them in providing it. 

48.      We therefore have reached the conclusion that, balancing the rights of the different data subjects, it would be reasonable to order disclosure to the Representor of the names of those making statements or being interviewed in the context of this case. 

49.      We have then gone on to consider whether the opinions which they expressed contained personal data relevant to themselves as well as relevant to the Representor.  We have adopted similar reasoning to this question as to the question around the disclosure of their names, save to add that in many cases it is clear that the expression of opinion is much more a matter of relevance - is much more clearly linked to - the Representor than it is to them. 

50.      We now turn to the first set of Class 2 documents, namely the notes of interviews carried out by Mr Paul Beal.  The file provided to us included the notes of the first interview carried out by Mr Beal with the Representor himself.  It is unclear whether the Representor has a copy of those notes still.  As he has signed them, or so it appears, one assumes that he does.  If it should turn out that he does not have a copy of those notes, we think that he is entitled to them.  The only redaction we would make for this purpose would be the name of the officer from Human Resources, who was taking notes.  It appears to us that her personal data has no relevance to the Representor, and should therefore be omitted.  There was apparently a second interview with the Representor, but we do not appear to have a copy of that document and so we make no findings in relation to it. 

51.      The next document in the Class 2 documents are the notes of interview between Mr Beal and Ms Angela Body, the director of operations.  It appears to us that Ms Body is of sufficient seniority that it is right that her name be not redacted for the reasons set out above.  Again a redaction should take place in respect of the identity of the note taker, and indeed that comment is of general application and we will not repeat it.  As to paragraphs 7 - 11 of her notes, it is clear that there is no express reference to the Representor, but in our view it is equally clear that this is a body of information relevant to the Representor and to his contract.  In those circumstances, we do not think any redaction should be made. 

52.      We think the file notes of Mr Beal with the other interviewees are all disclosable as containing personal data of the Representor, or containing data which relates to him because it is related to the withdrawal of his job offer.  However, in the different notes there appears a reference to one of the other candidates, either by name or by initial.  We think in both instances, whether the name or the initials, there should be a redaction because the balance lies in favour of protecting the personal data of all other interview candidates.  In the case of Mr Downes' interview notes, at paragraph 7, the second sentence refers to another candidate by reference to his intentions, and again in those circumstances that sentence should be deleted as not being personal data in any sense linked to the Representor. 

53.      One of the interviews conducted by Mr Beal was with Senator Ferguson, then a member of the Corporate Services Scrutiny Panel.  A substantial amount of the notes of this interview do not represent personal data of the Representor.  It appears to us that from page 2 of these notes where Senator Ferguson asks "Do you need anything that I have in my file?", the rest of the interview does not contain personal data of the Representor and should be redacted. 

54.      Another interview which falls in a similar category was conducted with Deputy Kristina Moore, of the Health, Social Security and Housing Scrutiny Panel.  Once again, we consider that from the words "meeting concluded" on page 2 to the end of the extract, the data does not contain personal data in any sense linked to the Representor and should be redacted.  

55.      There is a note of an interview with the Connétable of St Peter Mr John Refault, Assistant Minister for Health.  Most of this interview does not contain data which is personal to the Representor or linked to him.  In our view the first 15 lines of notes appearing under paragraph 1 of the note appears to be linked to the Representor.  The remainder of this interview starting with the word "frankly" should be redacted. 

56.      We now turn to the notes of interviews conducted by the former Solicitor General Advocate Howard Sharp QC. 

57.      As we have indicated earlier in this judgment, the former Solicitor General was invited to carry out an independent investigation into what took place.  This was an unusual process to adopt for a number of reasons, not least because the Solicitor General would normally be the legal representative for the Minister and for the States Employment Board.  However we make it plain that no privilege has been claimed over these interview notes.  Once again, the purpose of the interviews was an investigation in relation to the Representor's contract and in so far as the interviews concentrate on the reasons for the contract offer to be withdrawn, and in effect thus concentrate on the personal characteristics of the Representor in the context of the matters then under discussion, we think that in principle all these notes contain personal data which is linked to the Representor and falls within the definition provided by Article 1(1) of the Data Protection Law in the interpretation provisions.  We have been through the index of interviews and we think that the names of all those interviewed do not fall to be redacted, notwithstanding that they are personal data of those interviewees.  Our reasons for reaching that view are the same as those set out above in relation to the interviews conducted by Mr Beal.  We have given some thought to whether any redaction should be made given the objections which have been lodged to disclosure of these interview transcripts, with particular emphasis given to the fact that these interviews were conducted by the Solicitor General who stood in a position of authority which the interviewees might have considered carried more than just the weight of office but in addition an obligation, perhaps as a result of his office, that the interviewee had to cooperate in responding to the questions put.  A review of the transcripts shows that the interviews were conducted upon the basis that the interviewee was thanked for attending upon the Solicitor General, and given the explanation that the Second Respondent had asked him to enquire into the events which culminated in the termination of the offer of employment to the Representor in November 2012.  It was clear from the evidence of Advocate Sharp that he did not regard himself as a data controller for these purposes, and this data is to be regarded as the data of the Second Respondent.  He was in effect the agent of the Second Respondent in collecting this data, all of which we think relates or is linked to the Representor.  Accordingly we have reached the view that save where the transcripts refer to persons whose identities are protected, a point to which we will come in just a moment, they should be disclosed in full. 

58.      Where there is a reference in a transcript to the names of others who themselves have been the subjects of interview by the former Solicitor General, we think those names need not be redacted.  There are however, some other names which appear from time to time where a redaction would be appropriate.  We have looked at the interview transcript for Ms Angela Body, and we think in connection with her transcript, the following redactions should be made:-

(i)        On page 2 there is a reference to a gentleman by the initials MG.  His full name is given at line 6, and should be redacted. 

(ii)       On page 19, there is a reference to one of the other applicants for the job in Mr Sharp's question in the middle of the page.  It should be deleted, and indeed the whole sentence relating to him should come out. 

(iii)      At page 22, in the second main paragraph, 7th line, there is a reference to a gentlemen in relation to Friday morning.  The name of that gentleman should be redacted. 

(iv)      On page 28, in line 7 of the former Solicitor General's first question, there is a sentence which relates to a former consultant surgeon which should be redacted. 

(v)       On page 33, the second and third questions of the former Solicitor General, and the answer of Ms Body in between the two of them should be redacted. 

(vi)      On pages 34 and 35, in what is a long quote/question from the former Solicitor General, there is a reference 7 lines from the bottom of page 34 to the identity of a lawyer in the Law Officers' Department which should be redacted, and on page 35, 8 lines down a reference to another gentleman whose identity should also be protected. 

(vii)     At page 36, in the first question on that page from the former Solicitor General, 6 lines from the end of the paragraph, there is reference to the personal assistant of Mr McLoughlin whose name should be deleted. 

(viii)    On page 37, second question of the former Solicitor General, the last name which appears there should be redacted. 

59.      It appears to us that in relation to the remaining transcripts of interviews carried out by Advocate Sharp, the Second Respondent is well able to make the appropriate redactions without further assistance from the Court.  Clearly we do not authorise the redaction of the names of those whose identities we have already decided above should be disclosed.  However, all others should be redacted together with any other personal data relating to them.  In the course of making the redactions, the Second Respondent should indicate whether the name only has been redacted or whether any other material has been redacted as well.  There is liberty to apply if there should be any issue arising between the parties in connection with the implementation of this part of our judgment. 

60.      For the reasons set out above we therefore order the Respondents to comply with the subject access requests in relation to the Class 2 and Class 3 documents relating to the Representor, with liberty to apply. 

Authorities

Data Protection (Jersey) Law 2005.

Alwitry-v-The States Employment Board and Minister for Health and Social Services [2015] JRC 131.

Durant v Financial Services Authority [2003] EWCA Civ 1746.

Data Protection Act 1998.

Johnson v Medical Defence Union [2004] EWHC 347.

Ezsias v Welsh Ministers [2007] All ER 65.

Edem v The Information Commissioner and the Financial Services Authority [2014] EWCA Civ 92.

Elliott v Lloyds TSB Bank PLC and another [2012] 24th April 2012 Leeds County Court].

Iesini v Westrip Holdings [2011] 1 BCLC 498.

Companies Act 2006.