Data Protection Burdens Eased

Originally published July 2004

The Data Protection Act has given rise to a number of problems. Quite apart from interpretation problems raised by Humberside Police in connection with the Soham murders, HR professionals have had the problem of deciding how much personal information should be disclosed under the Act. The Act appeared to impose significant obligations on the employer, but as Sejal Raja explains, as a result of a recent case the burdens have been eased.

"Öa barrage of detailed requests Ö"

Prior to the Court of Appeal's decision in the case of Durant -v- the FSA, employers were faced with a barrage of detailed requests by employees requesting copies of personal data held about them pursuant to Section 7 of the Data Protection Act. The request extended to items such as memoranda in which the employee happened to be mentioned. This was a tool used by claimants to obtain data during the course of litigation without going through the process of discovery.

However, the case of Durant -v- FSA provided welcome guidance as to what data was capable of falling within the definition of personal data pursuant to Section 7 of Data Protection Act. Subsequent to that case the Information Commissioner has issued guidance on two issues considered by the Court of Appeal in the Durant case.

What makes "data""personal"within the meaning of "personal data"?

The Data Protection Act applies only to "personal data". The Court of Appeal concluded that "personal data" is information that affects a person's privacy whether in his personal or family life, business or professional capacity.

In the circumstances, privacy is clearly central to the definition of personal data. A factor, employers should take into account is whether or not the information in question is capable of having an adverse impact on an individual.

The Information Commissioner suggested that where an individual's name appears in the information, the name will only be personal data where its inclusion in the information affects the individual's privacy. Simply because an individual's name appears on a document, the information contained in that document will not necessarily be personal data about the named individual.

It is more likely that an individual's name will be personal data where the name appears together with other information about the named individual such as address, telephone number or information regarding the individual's hobby. The Information Commissioner has...