The Court of Appeal has clarified that a person’s name will be personal data under the Data Protection Act 1998 “unless it is so common that without further information, such as its use in a work context, a person would remain unidentifiable despite its disclosure.” In the case in question, the names of three junior FSA employees, in the context of documents showing that they worked there, were held to constitute personal data.
The case related to the appellant’s Freedom of Information Act request for information about the handling of his earlier complaint that the FSA had failed to correctly regulate Egg PLC. The FSA provided some information but refused to provide the names of three junior employees who had worked on the complaint on the grounds that they were personal data.
Moses LJ considered it was beyond question that the employees could be identified from a combination of their names and the documents emanating from the FSA which showed they were working there. As a result it was straightforward that the employees’ names were personal data, despite the First-Tier Tribunal’s initial ruling that they were not. Moses LJ held that the difficulty emerged because the First-Tier Tribunal had wrongly applied the tests in Durant v FSA, a key case on the meaning of personal data, when there was no reason to do so. The Durant tests, essentially that data should be ‘biographical’ or have the data subject as its ‘focus’, were intended for more borderline cases and related to specific circumstances. In that case, Mr Durant was seeking disclosure of documents in which his name was mentioned on the ground that the documents related to his name. The court gave its support to the ICO’s technical guidance that: “it is not always necessary to consider ‘biographical significance’ to determine whether data is personal data In many cases data may be personal data simply because its content is such that is ‘obviously about’ an individual”.
The case shows that Durant will not apply to every analysis of whether information is personal data and in some cases, the facts may be so straightforward that applying Durant could lead to erroneous conclusions.
Efifiom Edem v Information Commissioner and Financial Services Authority [2014] EWCA Civ 92