Unstructured files
A recent case takes another look at the extent to which the Data Protection Act 1998 applies to information held in hard copy form.
A recent case involving Lloyds TSB has had a look at the extent to which someone can obtain access under the Data Protection Act 1998 to information about them that is held on paper rather than on computer.
The case is Smith v Lloyds TSB Bank plc [2005] EWHC 246 (Ch). Very briefly, the facts were as follows:
- Mr Smith was the Managing Director and controlling shareholder of Display Electronics Ltd ("DEL"). DEL's borrowings from Lloyds TSB were secured by a mortgage on Mr Smith's home.
- Lloyds called in its loans. DEL went into liquidation. Mr Smith has lost his home and the bank petitioned to make Mr Smith bankrupt.
- This resulted in litigation between Mr Smith and Lloyds TSB. Mr Smith argued (among other things) that he and Lloyds TSB had entered into an oral agreement that Lloyds TSB would give DEL long term finance. Lloyds TSB denied this. The court found against the existence of such an oral agreement in two actions.
Mr Smith believed that documentation held by Lloyds TSB would prove his arguments, so he wanted to get hold of the documents that he believed existed. This case concerned his attempt to gain access to them by a subject access request under the Data Protection Act 1998.
Lloyds TSB admitted that it did have some documents, but that all of the documents that it still had were in unstructured bundles of paper kept in boxes. Some of these documents did mention Mr Smith. Lloyds TSB said (and this was not disputed) that it no longer had any records about Mr Smith held on computer.
Under the Data Protection Act 1998, information in hard copy form can be treated as personal data (and therefore subject to a right of access) only if it is kept in a "relevant filing system". The definition of a "relevant filing system" was looked at by the Court of Appeal in Durant v Financial Services Authority [2003] EWCA Civ 1746. The Court of Appeal decided that information kept in a non-computerised, manual filing system is only treated as personal data if the filing system is sufficiently structured to allow easy access to information specific to the data subject. In other words, the data controller (in this case Lloyds TSB) whould not have to go to too much trouble in finding and extracting the relevant information.
In addition, the High Court case of Johnson v Medical Defence Union [2004] EWHC 347 that the definition of personal data in the Data Protection Act 1998 refers to information which “is” being processed or recorded at the time when the data subject makes his data request. So, for example, data that used to be processed on computer (and therefore used to be subject to the Data Protection Act 1998) would no longer be subject to the Data Protection Act 1998 if it was all transferred to hard copy and then the relevant paperwork was just dumped in boxes without being sorted in a structured way into files.
As a result of this, Mr Smith lost his case. Because the only data about him that Lloyds TSB had was on paper, with all of the paperwork being stored in unstructured bundles in boxes, none of the data concerned was in a "relevant filing system" so none of it was covered by the Data Protection Act 1998.
