United Kingdom Information Tribunal including the National Security Appeals Panel

 


CCN Systems Limited CCN Credit Systems Limited v The Data Protection Registrar

[1991] UKIT DA90_25498 (15 February 1991)

CCN Credit Systems Limited v The Data Protection Registrar

[1991] UKIT DA90_25499 (15 February 1991)

IN THE DATA PROTECTION TRIBUNAL

BETWEEN:

CCN SYSTEMS LIMITED

Appellant

and

THE DATA PROTECTION REGISTRAR

Respondent

AND BETWEEN:

CCN CREDIT SYSTEMS LIMITED

Appellant

and

THE DATA PROTECTION REGISTRAR

Respondent

(Case Refs: DA/90 25/49/8 and DA/90 25/49/9)

APPEAL DECISION

Members of the Tribunal: Aubrey L. Diamond (Deputy Chairman), Alex Lawrence and Victor Ross.

Introduction

1. CCN Systems Limited and CCN Credit Systems Limited are two companies, the latter being a subsidiary of the former. They supply credit reference and marketing information, direct mail services and credit scoring systems to their customers. Both companies are credit reference agencies, as defined by section 145(8) of the Consumer Credit Act 1974, and are licensed as such under that Act.
2. Both companies are registered under the Data Protection Act 1984 as data users who hold personal data. Their register entries contain a description of the purpose for which they hold personal data as purpose P035 Credit Reference – the provision of information relating to the financial status of individuals or organisations on behalf of other organisations.
3. On 28 and 29 August 1990 the Data Protection Registrar ("the Registrar") served on both companies enforcement notices under section 10 of the Data Protection Act. Both notices were in identical terms.
4. On 24 September 1990 both companies served notices of appeal under section 13 of the Act. The appeals were heard by this tribunal from 14 to 18 January 1991. Both appellants were represented by Mr David Donaldson QC and Mr David Pannick, instructed by Paisner & Co. The Registrar was represented by Mr Henry Carr, instructed by Mrs Rosemary Jay, legal adviser to the Registrar. We heard evidence from 11 witnesses. Written proofs of the evidence of each witness were exchanged by the parties and made available to the tribunal.
5. It was agreed before us that it was not necessary to distinguish between the two appellants for the purposes of the present proceedings and that they could be treated as a single company. Accordingly we refer to both companies simply as "CCN" in this decision.
6. The essence of the dispute relates to the extraction from CCN's database for supply to its customers of certain types of what is called third party information. An example will be useful at this point.

An example

7. This example is based on a complaint received by the Registrar in June 1988. Although CCN did not accept that the facts of this actual complaint were precisely as detailed by the Registrar, they agreed that such a factual situation could indeed occur, and doubtless had. Because neither of the persons referred to gave evidence before us, and because personal matters are revealed, we use fictitious names.
8. In 1985 Mr Simon Jones, a chartered accountant, sold his house to a Mr J Watson. In 1988 Mr Jones applied to a building society for a cheque guarantee card. He was refused a card and informed that a credit reference had been sought from CCN. Mr Jones applied to CCN under section 158 of the Consumer Credit Act 1974 for a copy of his file. Among the information supplied was an entry showing a judgment awarded in 1987 against Mr Watson. The only link between Mr Jones and Mr Watson was that they were respectively vendor and purchaser of a house a few years earlier. Put in another way, the only link between them was that they had at different times lived at the same address. Mr Jones was distressed by this incident.
9. Section 159 of the Consumer Credit Act entitles a consumer who considers that an entry in his file is incorrect to ask the credit reference agency either to remove the entry from the file or amend it. CCN refused to remove the entry relating to the judgment but agreed to add a notice of correction stating that it did not refer to Mr Jones. They believed it would not have been right to remove the entry since it was an accurate record of the fact of the judgment against Mr Watson. But it appears that there would be nothing to prevent the same judgment surfacing in any future search against Mr Jones, albeit with the notice of correction appended to it. If there were to be other judgments against Mr Watson they too would presumably surface, but without any notice of correction.
10. It should be said that the supply of information relating to persons other than the applicant for credit ("third party information") is not an aberration and is not peculiar to the way CCN does business. It is, as will be made clear (paragraphs 19 et seq), the deliberate policy of CCN to act in this way, and as far as CCN is concerned such information is required by their customers, the grantors of credit.

The Registrar's duties and powers

11. As a result of this and other complaints, the Registrar took action. Various provisions in the Data Protection Act 1984 are relevant.
12. Set out in Part I of Schedule 1 to the Act are eight "data protection principles". The subject of dispute in these proceedings is the first principle, which reads as follows:

The information to be contained in personal data shall be obtained, and personal data shall be processed, fairly and lawfully.

13. The principle can be re-written in two parts:

(a) The information to be contained in personal data shall be obtained fairly and lawfully.

(b) Personal data shall be processed fairly and lawfully.

No issue was raised in these proceedings relating to the obtaining of information, nor was it suggested that the processing of personal data was carried out unlawfully. The case was concerned entirely with that part of the principle that can be reduced to: "Personal data shall be processed fairly". As far as this case is concerned this is the essence of the first principle.

14. A number of rules of interpretation of some of the principles will be found in Part II of Schedule 1. Those relating to the first principle are concerned solely with that part of the principle that deals with the obtaining of information, and are therefore not of relevance to this decision. However, some of the expressions to be found in the essence of the first principle are defined in section 1 of the Act, and will be referred to later (paragraphs 39 and 40).
15. Section 36(1) of the 1984 Act states that "It shall be the duty of the Registrar so to perform his functions under this Act as to promote the observance of the data protection principles by data users and persons carrying on computer bureaux". Subsection (2) of the same section goes on as follows:

(2) The Registrar may consider any complaint that any of the data protection principles or any provision of this Act has been or is being contravened and shall do so if the complaint appears to him to raise a matter of substance and to have been made without undue delay by a person directly affected …..

Pursuant to this duty – for we think that a matter of substance was raised – the Registrar considered the complaints relating to the use of the third party information.

16. We will describe in the next paragraph the action taken by the Registrar in considering the complaints. For the moment we will complete the reference to the Registrar's statutory powers. Section 10 deals with enforcement notices; the relevant subsections are as follows:

(1) If the Registrar is satisfied that a registered person has contravened or is contravening any of the data protection principles he may serve him with a notice ("an enforcement notice") requiring him to take, within such time as is specified in the notice, such steps as are so specified for complying with the principle or principles in question.

(2) In deciding whether to serve an enforcement notice the Registrar shall consider whether the contravention has caused or is likely to cause any person damage or distress.

(9) Any person who fails to comply with an enforcement notice shall be guilty of an offence; but it shall be a defence for a person charged with an offence under this subsection to prove that he exercised all due diligence to comply with the notice in question. It remains to say that sections 13 and 14 of the Act, and Schedule 3, relate to appeals to this Tribunal.

The Registrar's action

17. In his proof of evidence the Registrar, Mr Eric Howe CBE, stated that "From the early stages I regarded this as a case where education and persuasion were important". In May 1988 he called a meeting for representatives of industry, government and others to discuss the supply and use of credit reference information, a meeting which led to the formation of the Industry Forum on Data Protection. That Forum in September 1988 submitted Part I of a response to the Registrar's concerns about the supply and use of address-based "other name" and "similar name and address" information, Part II following in November 1988. These papers put forward proposals for changing some of the industry's methods. The Registrar put forward his own response to the Industry Forum in February 1989, saying that although he thought the industry's proposals were valuable, they did not go far enough. Further discussions followed, but the industry would not move as far as the Registrar would have liked, and in July 1990 he served a preliminary notice stating that he was minded to enforce an enforcement notice in the terms there set out. In August 1990 the enforcement notices the subject of this appeal were issued.

The enforcement notices

18. Counsel likened enforcement notices to injunctions. The operative words read as follows:

…. the Registrar hereby gives notice that in exercise of his powers under Section 10 of the Data Protection Act 1984 he requires [CCN] to ensure whether by amendments to any relevant processing system or otherwise:-

that from the 31st day of July 1991 personal data relating to the financial status of individuals ceases to be processed by reference to the current or previous address or addresses of the subject of the search whereby there is extracted in addition to information about the subject of the search any information about any other individual who has been recorded as residing at any time at the same or similar current or previous address or addresses as the subject of the search.

CCN's database

19. In order to explain how it is that what we have called third party information arises, it is necessary to describe the way in which the information obtained by CCN is stored and extracted. It is of course stored as data on computer. A statement describing the system of processing was agreed between the Registrar and CCN, and what follows is based on this statement and the evidence we heard.
20. CCN stores information which it regards as relevant to credit reference purposes on a number of separate computer "files", according to the source of the information. The following categories of information are kept:

Electoral Registers. These comprise the electoral rolls which are updated annually and contain the names and contain the names and addresses of all persons who are entitled to vote in elections in the United Kingdom. These are public documents.

Court Judgments. Details of those court judgments that are kept on public registers are obtained by CCN. They cover England and Wales (county courts), Northern Ireland (county courts), Scotland, the Isle of Man and the Republic of Ireland. These are kept on CCN's files for six years.

Bankruptcy. Information on bankruptcies obtained from the London, Edinburgh and Belfast Gazettes, and on bills of sale, are kept for six years.

Scottish Valuation Roll. This is a list, open to the public, of the valuation for rating purposes of all rateable properties in Scotland. Since 1989 it has not been updated except for commercial property.

CAIS (Credit Account Information Sharing). Members of this service pool detailed information on credit accounts including payment history and derogatory status information. Only those customers of CCN who participate in CAIS have access to this information.

CIFAS (Credit Industry Fraud Avoidance Scheme). Members of this service (the major credit grantors) supply information on individuals who have been identified as fraudulent. Only members of CIFAS have access to this information.

Postal Address File. The Post Office publishes the name and number of the house, the name and type of street, the postal town or district, and the post code of every address in the United Kingdom known to them. It is updated every quarter.

Searches. A record is kept of the fact that a customer of CCN has searched against an address. This will be revealed to customers making later searches which involve the same address: we were told that lenders find that this information helps them to identify attempted fraud, and also "credit-hungry" applicants who take on more credit commitments than they can pay.

A new record is created for each piece of information added to these files. The information is processed as received – for example there is no attempt to verify the address by reference to the postal address file. No enquiries are made to supplement the information received – for example, a county court judgment recorded against a surname only is entered in that way in CCN's file.

Search techniques

21. The information is supplied by CCN to its customers in response to searches made by them. The customer supplies CCN with such details as are available of name and current and previous addresses of the individual. Customers may search by post, telephone, telex, fax or magnetic tape, or they may have a remote terminal on their own premises through which they can access CCN's computer which automatically processes the details, the result being transmitted back to the customer's screen or printer.
22. Some of CCN's larger customers have established direct links between their main frame computers and CCN's computer. The customer's computer is programmed to interrogate the CCN database automatically by reference to the appropriate name and address details. This is usually done in the course of processing a credit application made by the individual to the customer, and the information obtained from CCN may be used, together with other information obtained by the customer from the individual, in an automated credit scoring system.
23. CCN provides different levels of search, and customers can select the level of information which meets their requirements. They may undertake one or more of the following types of search:

Electoral roll search: customers will receive details of the names of all persons currently registered on the electoral register at the current and any previous addresses which match those of the applicant for credit. Included in the search result will be details of any other applications made a the address in the past twelve months (with details of the type of credit sought by the applicant and the type of organisation making the search).

County court judgment and bankruptcy and related matters. Such a search will produce any information on these files which has been registered against one or more individuals, whatever their names, at the current and any previous addresses supplied by the applicant for credit. Included in the search result will be details of any other applications made at the address in the past twelve months.

Scottish valuation roll. A customer may search this file for Scottish addresses (current or previous). Details will be revealed about all individuals shown at the address in question: a description of the type of address and status of the proprietor together with the names of occupants and the rateable value.

CAIS search. CCN will provide to customers who belong to CAIS (Credit Account Information Sharing – see above), and who conduct a combined electoral roll and county court judgment etc search, full details (see above) of the credit account information recorded against any individual (whether or not the individual in respect of whom the enquiry is made) at any addresses which match the current and previous addresses provided by the applicant for credit.

CIFAS search. CCN will provide to customers who belong to CIFAS (the Credit Industry Fraud Avoidance Scheme – see above), and who conduct a county court judgment etc search, details of the names, categories of alleged fraud and the identity of the lender filing the information, about any individuals, whatever the name, living at an address which matches the current or previous address provided by the applicant for credit.

Rules governing searches distinguish between those made by operators using a remote terminal and those made by direct connection between computers. The former are presented with information in stages, and have to make a deliberate choice as to which records are required. In the latter case, selection policy rules are written into the program for the customer's processing system.

24. It is fair to say that there are problems in searching for names in some cases. For example, names are not unique, and there may be two or more persons with identical names at the same address (they may or may not be related). Names may not be fully recorded in the database; a county court, for instance, may have no more information about the name of a defendant than was provided by the plaintiff in instituting proceedings, so that the judgment may be recorded simply against a surname and gender. The customer who searches may not know the full name of the applicant for credit; this is particularly the case where the applicant, as occurs in the mail order industry, has provided merely a surname in illegible handwriting. The granting of credit
25. According to the agreed statement, any decision as to whether or not to grant credit to an individual is entirely a matter for the customer. CCN supplies the information to its customers to use in making that decision. It does not offer advice or express an opinion about the creditworthiness of an individual. Credit scoring and "Autoscore"
26. The information supplied by CCN to its customers may be in the same form in which it is held on CCN's files, but instead of supplying "raw data" arrangements can be made for CCN automatically to apply the customer's credit rules, CCN notifying the customer of the result as "accept", "reject" or "second opinion needed". Decisions of this type can be based on a policy, such as "reject all applicants under 18" or "second opinion for persons not on the voters' roll", or on a credit score.
27. Under the credit score system, a credit scorecard is developed for the customer, allocating points to different items of information, such as the marital status of the credit applicant, the time he has been in his present employment and at his present address, and whether he has a telephone. The information on CCN's files, including third party information, is allocated points, and the decision is made on the total points value or credit score.
28. The credit score can be arrived at by "manual" calculation, or it can be performed automatically. Automation has a number of advantages, including speed, accuracy and confidentiality. In addition the computerised data derived from application forms can be used to monitor the operation of the credit scoring system.
29. CCN provides an automated application processing service to its customers known as "Autoscore", which is integrated with CCN's scorecard development and credit referencing services. Its Autoscore customers communicate with CCN by way of computer terminals which are linked to CCN's computer.
30. It is important to describe how the Autoscore system operates. The customer's terminal operator sends the name and address of the applicant for credit. The computer searches the electoral register file and the postal address file and the address located on those files is displayed on the customer's terminal. The operator confirms that the address shown is correct, and the remaining files are then searched, creating a "credit search record" containing the data, including third party data, retrieved from CCN's files. This record is not displayed to the operator, who is asked to input the relevant items taken from the application form, forming a new "application record". A credit score is then calculated by CCN's computer from the data in the credit search record and the application record. The computer then sends the credit decision ("accept", "reject" or "second opinion needed") which is displayed on the customer's terminal. Each Autoscore system is individually created for a particular customer and incorporates that customer's lending criteria. We were told that although the customer's lending criteria operate on CCN's computer, CCN acts only on behalf of the customer, who makes his own lending decisions.

Third party information

31. Since the information generated by a credit enquiry is obtained by reference to an address, which may be the applicant for credit's present address or a previous address or, sometimes, another address which bears some similarity to one of these addressed, it is inherently likely to contain information about other individuals – "third parties". These individuals may be members of the applicant's family and share the same surname and, possibly, initials, or members of the family with different surnames, or persons living with the applicant for credit, or friends, or tenants or lodgers, or estranged spouses. They may have financial links with the applicant for credit, as is sometimes the case with spouses and children, but they may well be completely financially independent of the applicant. However, they may have nothing whatever to do with the applicant for credit, but simply be persons who have at some time lived at the same address as the applicant, at different times – "non-concurrent" – as in the example of Simon Jones we gave in paragraph 8 above.
32. The evidence we heard leaves us in no doubt that third party information is of value to a grantor of credit. It has predictive value. It cannot of course predict whether the applicant for credit will or will not pay, but added to the other information that is available it does help the credit grantor to classify applicants so as to establish an approximation of the percentage risk of default. A comparison was made by CCN between credit assessment and insurance, another area where statistics are used to establish the magnitude of risk. The Registrar's expert witness, a distinguished statistician, did not agree with the use of this comparison, pointing out that although in insurance the use of information about risk experience over large numbers might lead to an increase or decrease in premium for the individual, in credit assessment adverse information about just one other individual might lead to a rejection of the credit applicant.

We do not consider that the comparison with insurance advances CCN's case.

33. There is a paradox about the use of third party information. Its predictive value, we were told, does not depend on a known link between the third party and the applicant for credit. The witnesses for CCN, who included representatives of banks, mail order companies and other credit grantors, were adamant that third party information could be used and was statistically valid even though there appeared to be no causal connection with the applicant.
34. This was put in the following terms in his proof of evidence by Mr Peter Turvey, the well known actuary who was called by CCN: "The process of credit assessment does not base itself upon the identification of any causative link between the relevant variable and default. Neither age nor marital status, to take two examples, causes borrowers to default or the reverse, yet significant statistical correlations mean that both factors are effective in predicting the probability of default. Lack of any identifiable causative link is in no way unique to third party information. The fact that one can only surmise the underlying reason or reasons for the correlation does not reduce its predictive value in terms of risk. In the particular case of third party information I am satisfied that the observed correlation with credit risk is not coincidental".
35. Only one witness speculated at a reason for the connection. The managing director of a finance company in a large building society group told us that "In a household where there has been a history of bad debt, it is often found that the family member who personally has no adverse data registered against them may be used by those less creditworthy to obtain credit for them". However anecdotal this allegation of deliberate manipulation of identities may be, it is of course a much narrower situation than that covered by the general use of third party information. Other witnesses told us of the value of third party information, and address-based searches, in controlling and detecting fraud, given the ease with which first names and initials may be switched ("B" for "Bob" rather than "R" for "Robert", for example), or variants on surnames may be adopted.
36. Nevertheless, it is clear that the value of third party information to credit grantors arises where the details known about the applicant are not adequate. It was explained to us by a senior manager of Midland Bank plc, a witness called by CCN, that it was not the bank's practice to use third party information when considering applications for persona loans, for example, from existing customers, about whom adequate information is possessed already, but that it would be sought for new applicants. He agreed that use was made of third party information where it helped to supplement inadequate information. A major attraction of this information is that it is easy to obtain. The only information required about the credit applicant is the address and, if the applicant has been at that address for less than a specified period such as two or three years, the previous address. It is not even necessary to know the applicant's name. The address-based search will then produce information that, whether or not it relates to the applicant, can be used to arrive at credit decisions.
37. Because third party information is used for this purpose it was said by CCN to be relevant. On the other hand, the Registrar spoke of information about others which may have no relation to the applicant and would therefore be irrelevant. It is apparent that the word "relevant" is being used in tow different senses. By CCN it was used to mean "relevant to the question whether the credit applicant was a member of a group or class of persons of whom a certain percentage would be likely to default". In this sense we accept that third party information is to some extent relevant. It was at the same time used by the Registrar to mean "relating to the individual applicant for credit". In this sense third party information may or may not be relevant, and even if it is agreed to be relevant in the first sense it will often be irrelevant in this second sense. Moreover, it cannot be said exactly how predictive third party information is, for it is only one of a number of factors taken into account, and the weight given to any factor changes according to the stage at which it is introduced into the equation. We were told by CCN that no one was turned down by reason of third party information alone (this would in fact depend on the use made of the information by CCN's customers). On the other hand, the barrage of statistics directed at us was designed to demonstrate that if the credit industry was denied the use of third party information, as would be the effect of the enforcement notice, more bad risks would be able to obtain credit unless steps were taken to prevent this. In our judgment the presence of third party information can lead to an applicant being refused credit.

The Registrar's case

38. The essence of the Registrar's case is that extracting address-based information produces, and is designed to produce, irrelevant information in the sense in which the Registrar uses that word, and that this is unfair to the individual credit applicant. His expert witness, Professor R S Stainton, accepted that statistics used in estimating the risk of default were reasonably predictive, but emphasised that this was in the aggregate, and that information about one individual could not predict the future conduct of another individual. The legal basis of the Registrar's action is his finding that the extraction of third party information is unfair processing and therefore in breach of the first data protection principle, the essence of which, for present purposes, is: "Personal data shall be processed fairly".
39. "Personal data" is defined in section 1(3) of the Data Protection Act as "data consisting of information which relates to a living individual who can be identified from that information (or from that and other information in the possession of the data user), including any expression of opinion about the individual but not any indication of the intentions of the data user in respect of that individual". By section 1(2), "data" means "information recorded in a form in which it can be processed by equipment operating automatically in response to instructions given for that purpose". It was not argued before us that the information relating to or alleged to be relevant to an applicant for credit, retrieved from the database by CCN for supply to their customers, was not personal data, but argument did centre on the rest of the first principle: "processed" and "fairly". It is necessary to look at these terms in order to decide this appeal.

Processing

40. The word "processing" is defined in section 1(7) of the Data Protection Act as follows:

"Processing", in relation to data, means amending, augmenting, deleting or rearranging the data or extracting the information constituting the data and, in the case of personal data, means performing any of those operations by reference to the data subject".

41. Two words in the definition of "processing" stand out as potentially relevant to the facts of CCN's treatment of data. "Augmenting" could be used to refer to the treatment of data relating specifically to the credit applicant by adding together different pieces of information from different sources and by adding to it data relating to other individuals. We do not ignore the augmentation of data, but "extracting" in the phrase "extracting the information constituting the data".
42. Mr Donaldson's attractive argument for CCN may be summed up in this way. There exists information, such as the fact that a county court judgment has been made against a named individual, or the electoral register showing the names of persons residing at a particular address. That information is then transformed by the computer into data, which is information recorded in a form in which it can be processed automatically. That data may then be processed by being amended, deleted or re-arranged. The information constituting the data may then be extracted, and it is that process that we are concerned with. By eliminating those aspects of processing with which we are not concerned, the essence of the first principle becomes "Personal data" – or information constituting data – "must be extracted fairly". How then could the extraction of information be unfair? What could be unfair about the presentation of the information contained in the data on a screen, or on a sheet of paper? The real complaint made by the Registrar, he said, was that the use of the information was unfair. But that was not the province of the first principle, which does not refer to the use of data or information. Moreover, if there was any unfairness in the use of the data, that would be the result of the acts of CCN's customers, not of CCN, which was merely a conduit pipe for the supply of information. In other words, the argument is in effect that the extraction of information is value free.
43. We do not accept this argument, for several reasons. First, the argument virtually robs the first principle of any meaning in relation to the fairness or unfairness of that part of processing called extraction. We think that Mr Donaldson recognised this, for he sought to give an example of unfair extraction. Extraction could be said to be unfair, he put to us, if the information that emerged from the extraction process was an inaccurate or misleading version of the information contained in the data. He gave an example of a county court judgment for £20 being extracted and thrown on to the screen as a judgment for £20,000. That, he argued, would be unfairness in the extraction process, even if caused by a technical error or malfunction of the machine. It may be stretching words to call a computer error unfair, and perhaps that might also be said of an innocent mistake, but it seems to us that if the information extracted did not accurately represent the data relating to the data subject, and this was deliberate or reckless, that might be said to be unfair and would seem to show that extraction is not necessarily value free. This is particularly so in the light of the next point.
44. The second reason derives from the long title of the Act: "An Act to regulate the use of automatically processed information relating to individuals and the provision of services in respect of such information". We do not see the function of the Act as being the regulation of computers in the sense of fully automatic machines behaving automatically. Rather it is designed to regulate the use of such machines by human beings who feed information into them, extract information from them, and instruct machines what do to by computer programs or keyboard or other instructions. We find that at least to the extent that the extraction of information is under the control of people it can be unfair.
45. It is true that in this case it might be said that it is the use of the information after extraction that is arguably unfair, and that that use would not be caught by the first principle, nor, indeed, by any other of the data protection principles. And we agree that such use by CCN's customers, the grantors of credit, rather than by CCN, would not come within the scope of the enforcement notice. But in our view the program instructing the machine what to extract can be unfair if it is deliberately designed to extract certain information for the registered purpose. The unfairness, if there is unfairness (a question we consider below), lies in the instructions to extract, for the purpose of credit reference (the provision of information relating to the financial status of an individual), material irrelevant to the individual who is the subject of the credit reference. We use the word irrelevant here not in the sense of having no predictive value in the aggregate but as referring to a person whose activities are not related to the creditworthiness of the subject of the reference (the Registrar's meaning: see paragraph 37 above).
46. In this case there is no doubt that the extraction of information is the result of CCN's deliberate policy of searching for information by reference to addresses. In his written proof of evidence the Managing Director of CCN Credit Systems Ltd described the method of accessing the consumer database as follows: "CCN's customers request information from the consumer database by specifying to CCNM the individual and the address for which they require information, and the 'files' …. which it requires CCN to search. CCN searches the files specified for record which correspond to the address specified. The individual's name which was input by the customer is used by CCN to help identify the correct address, but once that address has been identified all the information on file at that address (for the files specified) is reported to the customer".
47. If we assume for the moment that there is unfairness here then we conclude, on the basis of the evidence we have heard, that it is the program for automatic processing that is unfair and not simply the use of the information after extraction that is unfair. There are two aspects of the automatic processing that we have particularly in mind. Most important is the program relating to the extraction of information. This is not to say that manual extraction of information by instructions given on a keyboard might not be regarded as processing and be unfair, but in this case the extraction is achieved by a complex computer program, which leaves us in no doubt that we are talking of potentially unfair processing. Evidence was given to us by CCN that if the enforcement notice was upheld by the Tribunal it could take CCN as long as 12 months to change their computer programs so as to comply. In addition, as we have seen, for a significant number of customers CCN will not merely supply the raw information which is extracted from the database but will "autoscore" the information by applying the customer's credit rules so as to notify the customer that they should "accept", "reject" or take a second opinion. To bring such systems, which have been developed by CCN's acknowledged expertise in matters of credit scoring, into compliance with the terms of the enforcement notice might, we were told, take between two and three years, though it was unreasonable to expect that it could be done in two years with outside help. In the light of this evidence there can be no question that CCN is "processing", whether fairly or unfairly, as defined in the Act.

Fairness

48. We now come to the crucial question whether the processing that we have described may be said to be unfair. It was urged on us by Mr Donaldson that we should not judge the question of fairness by considering simply whether what was done was fair or unfair in relation to the individual. Fairness, he said, involves a balancing of competing interests, so that in judging whether processing was fair we should set against any possible unfairness to the individual the advantages gained by other individuals, the benefits to the grantors of credit, and the public welfare. It is necessary to say something about these counterbalancing considerations.
49. We heard evidence from CCN's witnesses of what they thought would be the consequences of upholding the enforcement notice. They said that the absence of third party information would make it more difficult to predict the creditworthiness of applicants for credit. With less information available the judgments of credit grantors would be less reliable. It would be necessary to do one of two things. Either the number of applicants accepted for credit would remain the same and the number of defaulters would rise, or in an attempt to keep the number of defaulters constant it would be necessary to refuse credit to more applicants, many of whom would have turned out to be good payers. In either case, a consequence would be higher interest rates or reduced profits. One witness hinted that if the enforcement notice were upheld his company might well depart the consumer credit field to be replaced, he suggested, by less reputable lenders. Thus if it is thought unfair to the individual to classify him or her by reference to third party information, some individuals who now obtain credit would be denied credit, or some would pay more. We should not, argued Mr Donaldson, decide that the extraction of third party information was unfair without taking account of the present benefits to other applicants – and, indeed, perhaps the applicant himself who might not get credit in the absence of third party information – and to the credit grantors, as well as to the public interest in securing a supply of credit as widely available as possible.
50. We are very conscious of the benefits of reliable credit reference and credit scoring systems in preventing over-commitment by debtors, a measure very much for their benefit and that of the community, and in ensuring a well-managed credit system for the benefit of potentially sound debtors and of the credit and supply industries. We have no doubt that credit scoring systems work for the public good, but they must operate in a way that extracts information fairly.
51. The word "fairly" in the first principle is not defined in the Act, and no guidance is given as to its interpretation. In determining its meaning we must have regard to the purpose of the Data Protection Act. It is quite clear, from the Act as a whole and in particular from the data protection principles set out in Schedule 1, that the purpose of the Act is to protect the rights of the individual about whom data is obtained, stored, processed or supplied, rather than those of the data user. The Act was the result of concerns about the use of computer data, concerns voiced in Parliament and in the reports of a number of representative official committees and widely held throughout Europe (hence the Council of Europe's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data opened for signature on 28 January 1981 referred to in sections 37 and 41 of the Act).
52. In our view, in deciding whether the processing we have described is fair we must give the first and paramount consideration to the interests of the applicant for credit – the "data subject" in the Act's terms. We are not ignoring the consequences for the credit industry of a finding of unfairness, and we sympathise with their problems, but we believe that they will accept that they must carry on their activities in accordance with the principles laid down in the Act of Parliament.
53. Having taken due account of the evidence we have heard and the considerations urged upon us we have come to the clear conclusion that it is unfair for a credit reference agency, requested by its customers to supply information by reference to a named individual, so to program the extraction of information as to search for information about all persons associated with a given address or addresses notwithstanding that those persons may have no links with the individual the subject of the enquiry or may have no financial relationship with that individual. We believe this to be so even if the customer has requested address-based information and notwithstanding what is said to be its predictive value. We reject the notion that an organisation like CCN, with its wide specialist knowledge of and experience in credit reference and credit scoring, is a mere "conduit pipe". We believe the sort of processing carried out in this case is the very sort of activity at which the Act is aimed. We think it right to say that we accept that CCN did not intend to process data unfairly, and did not believe itself to be acting unfairly. But it is necessary to determine the question of fairness objectively, and in our view the case of unfairness has been made out.

The Registrar's Discretion

54. Section 10(2) of the Act states that "In deciding whether to serve an enforcement notice the Registrar shall consider whether the contravention has caused or is likely to cause any person damage or distress". We are satisfied from the evidence we have heard that the system of processing – and not just the use of information – has led to distress on the part of a number of individuals, and the Registrar was right to take this into account in deciding whether to issue an enforcement notice. We make no finding as to any damage caused to any person mentioned in this case, though we think it quite possible that damage might in some cases have resulted from the use of personal data which was unfairly extracted.
55. This does not mean that we take the view that the enforcement notice is justified in its entirety. The Registrar is not bound to serve an enforcement notice but has a discretion, and we consider that he should have exercised this discretion differently. Although we have concluded (see paragraph 52) that fairness is to be judged primarily by reference to the data subject, we have taken account of the interests of CCN and of their customers, the credit industry, in considering whether the Registrar has exercised his discretion properly. In our view there is a need to distinguish between different sets of circumstances in a way that is not to be found in the enforcement notice, and to this extent we find that the terms of the enforcement notice must be varied. This we propose to do by exercising our power under section 14(1) of the Act to substitute such other notice as could have been served by the Registrar.
56. The purpose of an enforcement notice is set out in section 10(1) of the Data Protection Act. It is a notice requiring a registered person to take such steps as are specified in the notice for complying with the principle in question, in this case the first principle. The enforcement notice served by the Registrar, cited in paragraph 18 above, in our view goes beyond what is needed to bring CCN's procedures into line with the requirement to process fairly. Although we think that it is unfair to extract information by reference to addresses indiscriminately, we do not take the view that every extraction of third party information is intrinsically unfair, and this is why we believe that the Registrar should have exercised his discretion differently.
57. If the only information extracted on an address-based search were other names, this would not trouble us. For example, a search confined to the Electoral Register will be by address and could reveal other names at the same address. In many cases this information will not be sufficiently informative to be unfair, unless it revealed other credit applications. But an address-based search that reveals county court judgments against persons with other names or CAIS information (Credit Account Information Sharing), for example of past credit defaults of persons with other names, would in our judgment be unfair extraction.
58. The respect in which the enforcement notice is too wide is that it requires CCN to cease to process personal data relating to the financial status of individuals by reference to addresses whereby there is extracted, in addition to information about the subject of the search, "any information about any other individual" residing at any time at such or similar addresses. This would prevent the extraction of information about other individuals who were honestly thought to be the same person as the subject of the search or whose financial standing was clearly linked with that of the subject of the search. The present search procedures are unfair, but if they were revised so as only to retrieve information about persons who were reasonably believed to be closely financially linked with the subject of the search we would not have found them to be unfair.
59. We appreciate that the Registrar takes the view that all address-based searches are likely to produce irrelevant (in his sense) third party information, but we do not believe that that is necessarily so. It is not for us to devise a method of extracting information that would confine itself to the relevant (in the Registrar's sense), but having seen the expertise possessed by CCN we would not wish to rule out the possibility that, perhaps on the basis of requiring their customers to obtain more information from applicants for credit where this is feasible, and by extracting by reference to names as well as by addresses, they may be able to do so. If they cannot do so, our version of the enforcement notice would no doubt have the same practical effect as the Registrar's; but if they can devise an appropriate extraction program they will be able to utilise that amount of third party information the extraction of which would not be unfair. We therefore do not rule out address-based searches, provided some means is devised of limiting the information thereby extracted to that relating to relevant (in the Registrar's sense) persons.
60. Let us consider the retrieval of information about individuals other than the subject of the enquiry ("the subject"). It would not be unfair to extract information relating to a person with the identical name as the subject who shares the same address as the subject. Such information might or might not relate to the subject, and at the least further enquiry would be justified. Nor would it be unfair to extract information about persons with a name or initials so similar to those of the subject that they might relate to the same person. (These situations, which are dealt with in proviso (a) in our version of the enforcement notice, would we think contravene the Registrar's enforcement notice if they were processed by reference to addresses). In these cases there would need, of course, to be a shared address with the subject. Reference was made before us to the idea of concurrence – being at the same address as the subject at the same time. This is a necessary condition to prevent unfairness. We realise that it is not always easy to be sure that the dates available are accurate, but we think that the risks of unfair extraction are so great that it is necessary to err on the side of caution. Except perhaps in very special circumstances we are of the opinion that it must be unfair to extract information about other individuals whose link with the applicant was an address at a different time from that when the applicant was there.
61. Would it be unfair to extract information about persons, clearly not the subject, who share the same surname as the subject and who might be members of the same family living with the applicant as members of a single household? Here we recognise that it is possible to hold different views. It would often be accepted, we think, that enquiry into the credit status of members of the subject's immediate family might yield information that was relevant in the Registrar's sense. It would not necessarily be the case, but it would not be possible to form any sort of judgment on this without having the information available. On balance, therefore, our finding is that the extraction of such information would not be unfair, though whether it is possible to program a search with the necessary precision we do not know. This we have dealt with in proviso (b) in our version of the enforcement notice.
62. It follows from the views that we have expressed in the last paragraph that we do not support a number of the complaints received by the Registrar from members of the public, complaints which influenced the Registrar. These include the person who complained of the record of a county court judgment against his son, who shared the same surname and initial, and other complaints where adverse information was revealed about sons and daughters, or brothers or sisters, where the information on record could genuinely lead one to think that there was a close family link.
63. On the other hand, it would not be fair to produce a program which automatically extracted, for the purpose of credit reference, information about persons with different surnames, whether or not living at the same address. It might be argued that such information could relate to the subject, using a different name whether for legitimate or fraudulent purposes, or to another person with a different name but a member of the subject's immediate family or household and financially linked, such as a spouse who uses a different name, or a person living with the subject though not formally married, or a married daughter or son in law or other in-laws. There are doubtless other possibilities as well. Although any of these situations could exist, we do not consider that an automatic extraction program made as a matter of routine would be fair. If sufficient facts were known, such extraction might well be fair, but if it is desired to extract such material it should not be as a result of an address-based search made as a matter of routine but as the result of a deliberate decision, based on the particular facts, to search for and extract such information. These are the considerations that have influenced us in determining the nature of the enforcement notice that we provide below by way of substitution for that served by the Registrar, and in particular proviso (c) in our version of the notice.

Time for compliance

64. The Registrar stipulated in his enforcement notices, dated 28 and 29 August 1990, that compliance must take effect by 31 July 1991. Only if this appeal were not determined before 31 July would section 10(6) of the Act extend the time for compliance, but it appears that CCN has not yet taken steps to comply with the Registrar's notices. Since we are altering the Registrar's notices, it would be appropriate to give consideration to a new period of time for compliance.
65. Taking into account the evidence we heard as to the time necessary for creating new computer programs and scorecards, it would be appropriate to allow sufficient time for the work to be done. A period of between 18 months and two years should be adequate, and accordingly the date for compliance should be 1 January 1993.

The enforcement notices

66. In accordance with the approach we have described, we conclude that the enforcement notices should now issue in the following form:

that from 1 January 1993 personal data relating to the financial status of individuals ceases to be processed by reference to the current or previous address or addresses of the subject of the search whereby there is extracted in addition to information about the subject of the search any information about any other individual who has been recorded as residing at any time at the same or similar current or previous address or addresses as the subject of the search; provided that nothing in this notice shall prevent the extraction of information about other individuals residing at the same present or previous address or addresses as the subject of the search ("the subject") concurrently with the subject –

(a) who have the same surname and forenames or initials as the subject or, where the forenames or initials are not known, the same surname or, where the precise surname is not known, a similar name, or

(b) who have the same surname as the subject or, where the precise surname is not known, a similar name, and who are reasonably believed to live as members of the family of the subject in a single household, or

(c) who do not have the same surname as the subject but, on the basis of information obtained before such processing, are reasonably believed to live as members of the family of the subject in a single household.

67. The result of the enforcement notices which we direct would be that address-based searches would be confined to the extraction of information relating to (1) the subject of the search himself or herself (original notice), (2) a person with similar names reasonably believed to be the subject (proviso, sub-paragraph (a)), (3) a person with the same surname, clearly not the subject, who is reasonably believed to be living as a member of the subject's family (we do not use this word in a technical sense) in a single household (proviso, subparagraph (b)) and (4) a person with a different surname in the circumstances set out (proviso, sub-paragraph (c)).
68. We may take one particular situation as an example of how the enforcement notice we direct would operate. One of the complaints received by the Registrar which was brought to our attention was from a lady whose son had not lived with her for over thirty years but who apparently used his mother's address for some purposes. When she applied for a credit card she was refused. She obtained a copy of her "file" from CCN, and found that it included details of a four-year-old county court judgment against her son, recorded as having been satisfied. She resented the fact that she was given details of her middle-aged son's personal affairs. She sought a notice of correction to indicate that she was not connected with the financial affairs of any other individual named on her file.
69. If the form of enforcement notice which we direct had been in force from the start, the information relating to the son's judgment would probably be validly extracted since the son would no doubt be reasonably believed to be living as a member of the subject's family in a single household. After the correction was added, the present position would be that the son's judgment would still be extracted and form part of the mother's file, albeit with the notice of correction appended. Under the new form of enforcement notice, the son's judgment with notice of correction would not be extracted since CCN could not reasonably believe, in the light of the notice of correction, that the son was living as a member of her family in a single household.

Conclusion

70. For the reasons set out above these joint appeals will both be allowed in part and enforcement notices in the terms set out in paragraph 66 above will be substituted for those served by the Registrar. Such enforcement notices are in a form which reflects our decision as to the merits of these appeals. It is, we consider, open to the Registrar, with the agreement of the appellants, to serve on the appellants fresh enforcement notices in modified wording to that set out above provided the new notices are in terms that accord with our decision on the merits.
71. No application was made for costs and in accordance with Rule 24 of the Data Protection Tribunal Rules 1985 we make no order as to costs.
72. We wish to place on record our thanks to Mr Carr and Mr Donaldson for their clear and helpful presentations.

Aubrey L Diamond

Chairman

15 February 1991