The
Court of Appeal overturned a High Court decision on the issue of
the creation of personal data, though the practical result of both
rulings was the same.
David Paul Johnson took a case against the Medical Defence Union
(MDU), a non-profit body which provides indemnity policies for its
members. The MDU had refused to renew Johnson's policy after it
conducted a review of his case and Johnson argued that the
organisation had not processed his data fairly and had therefore
breached the Data Protection Act.
The MDU operates a scoring system of its own invention which
allocates points to certain complaints or allegations made against
a doctor, even if they are never proved or pursued.
By 2002 Johnson, who had been an MDU member since 1986, had
built up enough of these points to trigger a review of his policy
by the MDU. He had built up points by consulting the MDU over
professional issues, including complaints. He had never been the
subject of a claim of professional negligence.
His case had been judged after an MDU staff member had looked
through his files and collated information from them into a new
computer document. Most of the files were manual and fell outside
the Data Protection Act's definition of a "relevant filing system".
Three were computer based, though, and so their use was controlled
by the Act.
Johnson claimed that this task was processing, as defined and
controlled by the Act's first principle, which says that processing
of personal data must be fair and lawful. Johnson claimed that his
data was unfairly processed, in breach of the Act.
The High Court agreed that the activity carried out by the MDU
was processing under the Act, but said that it was unfair only in a
minor and inconsequential way, and that therefore there was no
breach.
Both parties appealed the judgment, Johnson arguing that the
processing was unfair and the MDU arguing that the High Court was
wrong to say that its actions counted as data processing.
The Court of Appeal said that the actions were not data
processing. "Mr Johnson, who agrees that he has no right in
contract or in any other chapter of English law to challenge [MDU
examiner] Dr Roberts's selection of the information contained in
his personal data, asserts that he can nonetheless mount these
proceedings because her act of analysis is covered by the First
Data Protection Principle," said presiding judge Lord Justice
Buxton in his ruling.
"I would not be prepared to conclude that the 1998 Act has had
that effect, and the other widespread effects suggested above,
unless I was driven to it. Far from that being the case, neither
the 1998 Act nor the Directive give any support to the appellant's
case. I would therefore hold that the Judge was wrong to find that
Dr Roberts's selection of the data amounted to processing of data
in the terms of the Act," he said.
Though one of the judges dissented, that remained the decision
of the Court. Johnson had applied for leave to appeal some aspects
of the case to the European Court of Justice, but the Court said
that it would not grant that leave because the case could be
decided on elements that did not need referral. "There are
substantial grounds why the appeal must fail in any event. That
being so, it would not be appropriate to occupy the time of the ECJ
on matters that cannot affect the outcome of the litigation," said
Buxton.
In arriving at its judgment the Court of Appeal distinguished
the 2003 ruling in Naomi Campbell's famous privacy battle against
Mirror Group Newspapers. That decision, also by the Court of
Appeal, was based on facts that were different in significant ways,
reasoned Buxton.
