Just over a decade ago, the Court of Appeal said that courts should apply two tests or “notions” when deciding whether data was personal or not - biographical significance and focus. In Edem v Information Commissioner and the Financial Services Authority (FSA), the Court of Appeal has held that it is not always necessary to apply these tests.
In December 2009, Mr Edem asked the FSA for a copy of all the information it held about him as well as his complaint that the FSA had failed to correctly regulate Egg Plc. The FSA refused to provide some of it on the ground that it included personal data of three employees.
Mr Edem complained to the Information Commissioner who accepted that although he had a legitimate interest in knowing about the grade of staff who had handled his complaint, these members of staff would not expect their names to be released into the public domain. Mr Edem’s interest was therefore outweighed by the prejudice that disclosure would cause to the rights and freedoms of the three employees and would breach the first principle of the Data Protection Act 1998 (DPA).
Section 1(1) of the DPA defines “personal data” as data which relate to a living individual who can be identified from that data or from other information in the possession of the data controller “and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual …”
Decisions of First-Tier and Upper Tribunals
Relying on the decision in Durant v FSA, the First-Tier Tribunal (FTT) was guided by the two “notions” identified by the judge in that case - whether the information was biographical in any significant way; and whether the data subject was the focus of the information. The FTT found that it was not and upheld Mr Edem’s complaint.
The judge in the Upper Tribunal disagreed, holding that, although their names were not unique, the officials could be identified from their names, when taken together with other information.
Decision of Court of Appeal
And the Court of Appeal agreed with the Upper Tribunal. It held that the “notions” identified in Durant were of no relevance in this case, as they had nothing to do with the question of whether disclosure of a person's name was disclosure of personal data.
Instead it held that a “name is personal data unless it is so common that without further information, such as its use in a work context, a person would remain unidentifiable despite its disclosure”. In this case, the three names referred to in e-mails were obviously those of the three employees and “no further inquiry was needed”.
The FSA had correctly followed the technical guidance from the Information Commissioner’s Office which, the Court said, accurately set out the effects of the statutory scheme, as follows:
“It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him."