Upper Tribunal (Administrative Appeals Chamber)

You are here: BAILII >> Databases >> Upper Tribunal (Administrative Appeals Chamber) >> The Information Commissioner v The FSA and Edem [2012] UKUT 464 (AAC) (11 December 2012)
URL: http://www.bailii.org/uk/cases/UKUT/AAC/2012/464.html
Cite as: [2012] UKUT 464 (AAC)

[New search] [Printable RTF version] [Help]

The Information Commissioner v The FSA and Edem [2012] UKUT 464 (AAC) (11 December 2012)
Information rights
Data protection

Decision of the Upper Tribunal
(Administrative Appeals Chamber)

As the decision of the First-tier Tribunal (made on 16 April 2012 under reference EA/2011/0132) involved the making of an error in point of law, it is SET ASIDE under section 12(2)(a) and (b)(ii) of the Tribunals, Courts and Enforcement Act 2007 and the decision is RE-MADE.

The decision is: the Information Commissioner’s decision notice FS50312938 is in accordance with the law.

Reasons for Decision

A. Abbreviations

DPA: Data Protection Act 1998
FOIA: Freedom of Information Act 2000
FSA: Financial Services Authority

Durant: Durant v Financial Services Authority [2003] EWCA Civ 1746

B. The issue

1. The principal issue in this case is whether a person’s name constitutes personal data.

C. History and background

2. Mr Edem made his freedom of information request on 30 December 2009. He wrote to the FSA:

I hereby lodge an FIA 2000 information request for a copy of all information that the FSA holds about me and/or my complaint that the FSA had failed to correctly regulate Egg Plc.

The FSA refused to provide the information for a variety of reasons. I need only mention personal data. The FSA refused to provide some information on the ground that it was Mr Edem’s own data, which he could access under DPA. It refused to provide other information on the ground that it was the personal data of its junior employees.

3. Mr Edem complained to the Information Commissioner. By the time the Commissioner gave his decision, the FSA had disclosed further information to Mr Edem. All that was withheld was the name of three officials; the name of a fourth was released by mistake. On 26 May 2011, the Commissioner issued decision notice FS50312938:

20. The Commissioner accepts that the complainant has a legitimate interest in information about the grade of staff who handled his complaint. He accepts that such information would help reassure the complainant and the public that complaints to the public authority were being handled by staff of a certain grade.

21. The Commissioner notes that while the staff in question worked on the complainant’s complaint, they did not correspond with him about it. He also notes that the public authority has confirmed that they were not in public facing roles and that these individuals were of a grade below that of manager. It is the Commissioner’s view that these members of staff would have had no expectation that their names would be released into the public domain.

22. The Commissioner is also satisfied that disclosure of their names would not add anything further to the way in which the complainant’s complaint had been dealt with. Therefore any legitimate interest in the disclosure of the names of these individuals is outweighed by the prejudice disclosure would cause to the rights and freedoms of the individuals concerned.

4. Mr Edem exercised his right of appeal to the First-tier Tribunal. The tribunal decided that the names of the officials did not constitute personal data and ordered that they be disclosed. The panel identified the first question it had to ask: were the names of the officials their personal data? They decided that ‘the names of the three members of staff, taken together with information that they were employed by the FSA at a given date, and information as to the positions they held, may well be sufficient to identify them. However, even if they can be identified, it does not follow that the information is personal data.’ The panel then quoted from Auld LJ’s judgment in Durant and explained how they applied it:

32. Applying the Durant principles, is the information personal data? The names appear in a small number of internal e mails and documents in June and July 2004. The content is largely factual. The FSA has of course already disclosed the content of the e mails and documents. The names redacted are the names of the people who sent or received the e mails or who were parties to the internal discussions.

33. Where on the continuum of relevance or proximity to the data subjects at one end, and transactions or matters in which they may have been involved to a greater or lesser degree at the other end, does the Disputed Information fall? We have considered the ‘two notions’ put forward by Auld LJ. In our view, the Disputed Information is not biographical in any significant sense. The information does not go beyond the recording of the data subjects’ involvement in a matter that has no personal connotations. It simply concerns a transaction or matter in which the individuals in question were involved. Those individuals are in no way the focus of the information. The focus is an investigation into the handling of the Appellant’s complaint to the FSA.

34. The Disputed Information simply discloses the fact that they had been employed by the FSA and had been engaged in the regulation of a certain financial institution. We do not consider that the information adversely affects the individuals’ privacy, whether in their personal or family life, business or professional capacity.

35. We do not suggest that information about where an individual worked at some point in the past, together with some indication of his role, can never be personal data. There are a number of organisations, the nature of whose activities are such that information that a particular individual was employed by them, might well amount to personal data. If, for example, an individual was employed by an organisation licensed to conduct experiments on animals, that fact may well amount to personal data. If may disclose something about his likely opinion on the often contentious subject of animal rights, and could lead to harassment by so-called animal rights activists. In such a case, a compelling argument could well be made that the information is biographical and does affect the privacy of the individual concerned. That, however, is not the position in the present case.

36. For all these reasons, we do not consider that the Disputed Information is personal data. It follows that the information is not exempt under section 40(2) and must be disclosed.

5. The First-tier Tribunal gave permission for the Information Commissioner and the FSA to appeal to the Upper Tribunal. I gave Mr Edem permission. Although he had succeeded before the First-tier Tribunal, he was a respondent to the appeals by the other parties and had issues he wanted to raise.

6. I held an oral hearing of the appeal on 5 November 2012. Robin Hopkins of counsel appeared for the Information Commissioner and Jason Coppel of counsel appeared for the FSA. Mr Edem appeared and spoke on his own behalf. At the end of the hearing, Mr Edem had not completed his oral submissions. I gave directions for him to complete his arguments in writing and for counsel then to make their closing submissions in writing. I am grateful to all for their arguments at the hearing and in writing.

D. The legislation

7. The domestic law on data protection is international in origin. The original Data Protection Act 1984 implemented the 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. DPA implemented Directive 95/46/EC.

8. The scope of DPA is apparent from some of the basic definitions set out in section 1:

1 Basic interpretative provisions.

(1) In this Act, unless the context otherwise requires—

‘data’ means information which—

(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose,

(b) is recorded with the intention that it should be processed by means of such equipment,

(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, …

(d) does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as defined by section 68; or

(e) is recorded information held by a public authority and does not fall within any of paragraphs (a) to (d);

…

‘personal data’ means data which relate to a living individual who can be identified—

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual; …

9. These definitions show that DPA only applies to data. Data is a subset of information. Information is not defined, so it has its ordinary meaning. Data is distinguished from other information by what the person who holds the data is doing, or intending to do, with it. Personal data is a subset of data. In order to qualify as personal data, it must be possible to relate it to a living individual who can be identified from it. The link may be possible either from the data itself or from the data together with other information. If the data can only be related to an individual by the other information, it is not personal. That takes the case outside the scope of the data protection legislation, because the data plays no part in identifying a living individual.

10. The definition of personal data contains a number of elements. For present purposes, two are relevant: relation and identification. The relation element is that the data must ‘relate to’ a living individual. The identification element is that it must be possible to identify that individual from the data, on its own or in conjunction with other information. It is possible that:

· both elements may be satisfied – this will usually be the case when a business maintains a database of its customers and their details;

· the relation element is satisfied, but not the identification element – this will be the case if the data held is anonymous;

· the relation element is not satisfied, although the identification element is – this was the case in Durant.

11. Schedule 1 to DPA sets out the data protection principles. Paragraph 1 sets out the first principle, which is the only principle relevant to this case:

Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—

(a) at least one of the conditions in Schedule 2 is met, …

Schedule 2 sets out the conditions:

Conditions relevant for purposes of the first principle: processing of any personal data

1 The data subject has given his consent to the processing.E+W+S+N.I.

2 The processing is necessary—E+W+S+N.I.

(a) for the performance of a contract to which the data subject is a party, or

(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

3 The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.E+W+S+N.I.

4 The processing is necessary in order to protect the vital interests of the data subject.E+W+S+N.I.

5 The processing is necessary—E+W+S+N.I.

(a) for the administration of justice,

(aa) for the exercise of any functions of either House of Parliament,

(b) for the exercise of any functions conferred on any person by or under any enactment,

(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.E+W+S+N.I.

(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.

12. FOIA is linked to the 1998 Act through section 40:

40 Personal information.

(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2) Any information to which a request for information relates is also exempt information if—

(a) it constitutes personal data which do not fall within subsection (1), and

(b) either the first or the second condition below is satisfied.

(3) The first condition is—

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of ‘data’ in section 1(1) of the Data Protection Act 1998, that the disclosure of the information to a member of the public otherwise than under this Act would contravene—

(i) any of the data protection principles, or

(ii) section 10 of that Act (right to prevent processing likely to cause damage or distress), and

(b) in any other case, that the disclosure of the information to a member of the public otherwise than under this Act would contravene any of the data protection principles if the exemptions in section 33A(1) of the Data Protection Act 1998 (which relate to manual data held by public authorities) were disregarded.

(4) The second condition is that by virtue of any provision of Part IV of the Data Protection Act 1998 the information is exempt from section 7(1)(c) of that Act (data subject's right of access to personal data).

This section distinguishes between applications by persons seeking their own data and those seeking the data of other people. The former are covered by section 40(1), the effect of which is to ensure that all applications are dealt with under DPA. The latter are covered by section 40(2), the effect of which is to give DPA protection to the person who is the subject of the data.

13. Section 40(2) limits the scope of the data information to which the definition has to be applied. In this case, that means ‘information that the FSA holds about me and/or my complaint that the FSA had failed to correctly regulate Egg Plc.’

E. The caselaw

14. Counsel referred me to Durant, two decisions of the Court of Justice of the European Union and a decision of the House of Lords.

Durant

15. The First-tier Tribunal relied on and applied the decision of the Court of Appeal in Durant. Mr Durant applied to the FSA for a copy of his personal data. He argued that this included the contents of various files that referred to Barclays Bank and his complaint against it.

16. The case raised a number of issues. Auld LJ identified the only issue relevant to this case in paragraph 24:

The question is the meaning of the words ‘relate to’ in the opening words of the definition, in particular to what extent, if any, the information should have the data subject as its focus, or main focus.

Counsel for Mr Durant argued for ‘an extremely wide and inclusive definition’ that ‘covered any information retrieved as a result of a search under his name, anything on file which had his name on it or from which he could be identified or from which it was possible to discern a connection with him.’ Counsel for the FSA argued that it meant ‘have reference to, concern’ rather than ‘have some connection with, be connected to’.

17. Auld LJ said:

26. The intention of the Directive, faithfully reproduced in the Act, is to enable an individual to obtain from a data controller's filing system, whether computerised or manual, his personal data, that is, information about himself. It is not an entitlement to be provided with original or copy documents as such, but, as section 7(1)(c)(i) and 8(2) provide, with information constituting personal data in intelligible and permanent form. This may be in documentary form prepared for the purpose and/or where it is convenient in the form of copies of original documents redacted if necessary to remove matters that do not constitute personal data (and/or to protect the interests of other individuals under section 7(4) and (5) of the Act).

27. In conformity with the 1981 Convention and the Directive, the purpose of section 7, in entitling an individual to have access to information in the form of his ‘personal data’ is to enable him to check whether the data controller's processing of it unlawfully infringes his privacy and, if so, to take such steps as the Act provides, for example in sections 10 to 14, to protect it. It is not an automatic key to any information, readily accessible or not, of matters in which he may be named or involved. Nor is to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against third parties. As a matter of practicality and given the focus of the Act on ready accessibility of the information - whether from a computerised or comparably sophisticated non-computerised system - it is likely in most cases that only information that names or directly refers to him will qualify. In this respect, a narrow interpretation of ‘personal data’ goes hand in hand with a narrow meaning of ‘a relevant filing system’, and for the same reasons (see paragraphs 46-51 below). But ready accessibility, though important, is not the starting point.

28. It follows from what I have said that not all information retrieved from a computer search against an individual's name or unique identifier is personal data within the Act. Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person’s or body’s conduct that he may have instigated. In short, it is information that affects his privacy, whether in his personal or family life, business or professional capacity. A recent example is that considered by the European Court in Criminal Proceedings against Lindquist, Case C-101/01 (6^th November 2003), in which the Court held, at para. 27, that ‘personal data’ covered the name of a person or identification of him by some other means, for instance by giving his telephone number or information regarding his working conditions or hobbies.

29. This narrow meaning of personal data derives, not only from its provenance and form of reproduction in section 1(1), but also from the way in which it is applied in section 7. That section, picking up the definition of ‘data subject’ in section 1(1), sets out the basic entitlement of an individual to access to personal data ‘of which … [he] is the data subject’. I agree with Mr. Sales that the inclusion in section 1(1) of expressions of opinion and indications of intention in respect of him supports an otherwise narrow construction. If the term had the broader construction for which Miss Houghton contended, such provision would have been otiose. A similar pointer to the focus of attention being on the data subject rather than on someone else with whom for some reason he is involved or had contact is in the special provision for ‘sensitive personal data’ in section 2 of, and Schedules 1, para. 1(b) and 3 to, the 1998 Act, giving effect in large part to Articles 6 to 8 of the Directive.

18. The judge analysed the information in dispute and summarised his conclusion:

31. In short, Mr. Durant does not get to first base in his claim against the FSA because most of the further information he sought, whether in computerised form or in manual files, is not his ‘personal data’ within the definition in section 1(1). It is information about his complaints and the objects of them, Barclays Bank and the FSA respectively. His claim is a misguided attempt to use the machinery of the Act as a proxy for third party discovery with a view to litigation or further investigation, an exercise, moreover, seemingly unrestricted by considerations of relevance. It follows that much of Mr. Durant's complaint about redaction of other individual's names and details falls away, regardless of the outcome of the correct application of the provisions of section 7(4) – (6) for protection of the confidentiality of other individuals (see paragraphs 52-68 below).

19. Mummery LJ agreed with Auld LJ. Buxton LJ agreed with ‘everything that has fallen from my Lord’, but added some remarks on personal data:

78. By section 1 of the 1998 Act, personal data is [processed or recorded] information that (i) relates to a living individual who (ii) can be identified from those data either taken alone or in conjunction with other information. Much of the argument on behalf of Mr. Durant went straight to limb (ii), without considering the implications of limb (i). Plainly, Mr. Durant could be identified ‘from’, or perhaps more accurately in conjunction with, the information sought by him that is summarised by my Lord in his para. 24; the reason for hesitation being only that in some cases it is Mr. Durant's identity that leads to the information, rather that the information leading to Mr. Durant. Equally plainly, however, the requirement that the information should ‘relate to’ Mr. Durant imposes a limitation on that otherwise very wide claim.

79. The guiding principle is that the Act, following Directive 95/46, gives rights to data subjects in order to protect their privacy. That is made plain in recitals (2), (7) and (11) to the Directive, and in particular by recital (10), which tells us that:

‘the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principle of Community law’

The notions suggested by my Lord in his para. 28 will, with respect, provide a clear guide in borderline cases. A recent example of such personal data is information about the occupation, hobbies and in one case medical condition of named, and therefore identifiable, individuals, such as the Court of Justice addressed in Case C-101/01, Lindqvist, 6 November 2003.

80. But the information sought by Mr. Durant was by no stretch of the imagination a borderline case. On the ordinary meaning of the expression, relating to him, Mr. Durant's letters of complaint to the FSA, and the FSA's investigation of that complaint, did not relate to Mr. Durant, but to his complaint. The 1998 Act would only be engaged if, in the course of investigating the complaint, the FSA expressed an opinion about Mr. Durant personally, as opposed to an opinion about his complaint; a contingency for which, nonetheless, the draftsman of the Act thought it necessary to make specific provision. And on the purposive construction of the expression, as investigated in para. 78 above, access to that material could not possibly be necessary for or even relevant to any protection by Mr. Durant of his privacy. The excessive nature of his demands is perhaps best illustrated by the claim mentioned by my Lord in his para. 62, that Mr. Durant should be told the identity of all those at the FSA who had handled his complaint. In the formal FSA complaints process in which Mr. Durant engaged before bringing the present proceedings (see para. 10 above) that information may or may not have been relevant, though there is no indication that Mr. Durant or those who may have been advising him then sought it. It has nothing whatsoever to do with Mr. Durant's privacy, and proceedings under the 1998 Act cannot be used now, or at all, to extract it.

20. Mr Hopkins argued that Durant was concerned with the identification element. Mr Coppel argued that it was concerned with the relation element. I accept Mr Coppel’s argument. There was no identification issue in the case. Mr Durant could be identified from the information held by the FSA. Both counsel argued the case by reference to the relation element. Auld LJ accepted the narrower interpretation of ‘relate to’ at [29] and Buxton LJ analysed that element at [80].

21. The case is an authority that the narrower interpretation of ‘relate to’ is the correct one.

22. What of Auld LJ’s two notions? He said only that they ‘may be of some assistance.’ That indicates that they are relevant to the application of the statutory test. They were not presented as in some way defining the scope of personal data. Nor were they presented as exhaustive. They were presented as being generally helpful, but this was limited to cases where the individual’s name was the only possible personal data in the information being sought.

23. Buxton LJ limited the notions to borderline cases, which Durant was not by any stretch of the imagination. For him, Lindqvist exemplified a borderline case.

European decisions

24. In Durant, both Auld LJ and Buxton LJ referred to the decision of the Court of Justice of the European Union in Criminal Proceedings against Bodil Lindqvist (Case C-101/01) [2003] ECR I-6055. Mrs Lindqvist had set up an internet site for her local parish containing information about some of her colleagues in the parish. She gave names, jobs, hobbies and in one case some of the person’s employment and medical details. The Court decided that she had processed the personal data of her colleagues:

27. The answer to the first question must therefore be that the act of referring, on an internet page, to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constitutes ‘the processing of personal data wholly or partly by automatic means’ within the meaning of Article 3(1) of Directive 95/46.

25. In European Commission v Bavarian Lager Co Ltd (Case C-28/08 P), the Court of Justice of the European Union was concerned with the protection of personal data under Regulations (EC) 45/2001 and 1049/2001. Specifically, the issue was whether the Commission was entitled to withhold the names of persons present at a meeting. The Court decided:

68. It should be noted that … the General Court, in examining … the definition of ‘personal data’, correctly held that surnames and forenames may be regarded as personal data.

26. I reject Mr Edem’s argument that this case is not properly before me. It is irrelevant whether or not it was considered by the First-tier Tribunal. It is irrelevant that it was only raised in skeleton argument. And it is unfortunate, but irrelevant, that the wrong Court’s judgment was included in the bundle for the hearing.

27. These two European cases are authority that the names of the persons were personal data. The Court spoke in the context of, and by reference to, the facts of the cases. The names and other information were information about the living individuals revealed in a context that identified the persons by their location and their involvement in the parish or by their involvement in the business of the meeting.

The House of Lords

28. The decision of the House of Lords in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 concerned a request for the incidence of childhood leukaemia broken down into census wards. The data had been barnardised in an attempt to prevent individuals being identified. That issue does not arise in this case. The case is relevant for two reasons.

29. First, Lords Hope and Rodger commented on Durant. Lord Hope said at [20] that the issue was whether barnardised data was personal data and that ‘I do not think that the observations in Durant v Financial Services Authority … have any relevance to this issue.’ And Lord Rodger said at [74] that the only issue was whether individuals could be identified from the data, ‘So there is no need in this case to consider the kinds of issue which the Court of Appeal addressed in Durant v Financial Services Authority [2004] FSR 28.’ This confirms, or is at least consistent with, my analysis that Durant was concerned with the relation element.

30. Second, the House approved the practice of releasing data in an anonymised form. This is difficult to reconcile with the domestic legislation, but it accords with Recital 26 of Directive 95/46 (emphasis added):

(26) Whereas the principles of protection must apply to any information concerning an identified or identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person; whereas the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable; whereas codes of conduct within the meaning of Article 27 may be a useful instrument for providing guidance as to the ways in which data may be rendered anonymous and retained in a form in which identification of the data subject is no longer possible;