The Court of Appeal has narrowed the definition of ‘personal data’ in the Data Protection Act with the effect of restricting the scope of the data protection and subject access rights in the Act.
The case holds that personal data is only involved in a document where the information affects the person’s privacy, and only relates to the person in question, when he or she is the focus of that document (ie not just mentioned peripherally in it).
The case involved a request for subject access, but its approach is applicable to the confidentiality guarantees in the Act as well.
The Court lays down that information will be biographical in a significant sense, in nature, (ie going beyond the recording of a person’s involvement in or presence at a matter or an event which has no personal connotations) and affecting a person’s privacy in his personal or family life, or business or professional capacity. The Information Commissioner has interpreted this in new guidance issued after the case as meaning that the information must be capable of having an adverse impact on the individual. For information to ‘relate’ to someone, the person in question cannot have merely figured in an event or had an interest in it – he or she must be the focus of the information being sought or alleged to be covered by the definition and the Act.
In relation to complaints about social services departmental performance, the case may mean that a response to the complainant, giving details about why members of staff have or have not done certain things, may not infringe the processing rules because it does not ‘relate’ to those staff members simply because it includes information about them.