Terence William Smith v Lloyds TSB Bank plc concerned a Subject Access Request under section 7(9) of the Data Protection Act 1998 (the “Act”) and raised three important questions on the interpretation of the Act:
can information, which has been manually processed and is not held in a relevant filing system, be “data” under the Act?
can such information be personal data if it indirectly relates to a data subject?
to what extent does the court have discretion over whether to compel the disclosure of personal data under section 7(9) of the Act?
Terence William Smith (“Smith”) was the managing director and a controlling shareholder of Display Electronics Limited (the “Company”). Smith and the Company entered into an agreement with Lloyds TSB Bank plc (“Lloyds TSB”) and Barclays Bank plc under which, Smith’s personal debts and the Company’s business debts would be amalgamated and transferred from Barclays to Lloyds TSB. Shortly after this arrangement, Lloyds TSB brought bankruptcy and liquidation proceedings against Smith and the Company, respectively. Smith resisted both proceedings, arguing that in 1988, Lloyds TSB orally agreed to supply Smith and the Company with a £500,000 mortgage to cover his personal debts, (which totalled approximately £8,000) the Company’s business debts (approximately £250,000) and to help fund a building project. Lloyds TSB succeeded in both proceedings. Smith attempted to reopen negotiations with Lloyds TSB by forcing them to disclose more information about the 1988 meeting. In 2001 he issued a Subject Access Request, requesting personal data held under his name, that of “Display Electronics Limited” or under “DEL”.
Lloyds TSB responded by sending Smith information from files held in his name only. It did not send the information filed under “DEL” or “Display Electronics”. In Lloyds TSB’s opinion the information was not “data” because it was in paper form in unfiled bundles. The information had not been processed automatically and was not part of a relevant filing system. Lloyds TSB further argued that, if it were “data”, the information it held related to the Company and not to Smith, so it was not “personal data”.
Smith filed proceedings, requesting that the Court compel Lloyds TSB to release all of the information under section 7(9) of the Act.
Laddie J dealt with each of the above questions:
1. Was the information “data”?
a. Smith’s Counsel argued that section 1(1)(a) of the Act should be read in conjunction with Article 3(1) of Directive 95/46/EC (the “Directive”), so that it should read:
“data means information which is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose”.
Thus, any information, which at the time of the Subject Access Request was wholly or partly processed automatically must be “data”. As the information in this case was created using a word processor in 1988, then it remained “partly processed” when the Subject Access Request was made in 2001.
The court disagreed. At the time when the Subject Access Request was made, there were no computerised records containing personal data on Smith. From the evidence, the information was all in unstructured bundles kept in boxes. Therefore, at the time of the request, the information was not “data” because it was not held in a “relevant filing system” and had not been “processed automatically”. It was not considered relevant that the information had been processed in the past. The Court opined that, data once processed, is not to be treated as always processed. The Court should ask whether the information requested was “data” at the time of request and not before. In addition, under the Data Protection Act 1984 “word processing” was exempted from the definition of “processing”, so even in 1988, the information was not “processed”.
b. Smith’s counsel argued that, according to the Directive, the Act and the judgment in Michael John Durant v Financial Services Authority ( EWCA Civ 1746) (“Durant”), information in a non-computerised manual system, if structured so as to allow easy access to data, will constitute a relevant filing system. He argued that under Article 2(c) of the Directive, it is the data itself that needs to be structured, and not the filing system. This means that, any bundle of documents could become a relevant filing system, if scanned by a scanner equipped with optical character recognition (“OCR”) software. His logic was that, scanning equipment is inexpensive and accessible; once scanned by OCR software, a document can be easily indexed and searched, so the data in that document is also easily accessible. If the document was intelligible and organised into sentences, then it would contain the necessary structure. Therefore, all documents, if intelligible, are within the scope of the Act.
The court did not accept this argument. If it were true, it would destroy the distinction between manual and automatic data. Moreover, any reference to, or definition of “relevant filing system” would be rendered meaningless. The argument was also inconsistent with Recital 27 of the Directive, which states that “files or sets of files as well as their cover pages, which are not structured according to specific criteria, shall under no circumstances fall within the scope of this Directive”. It was explained that, legislators in the UK and in Europe took a policy decision not to bring unstructured files within the ambit of the legislation. To do so, would place an enormous burden on data controllers, who would be forced to scan every document in their possession.
For these reasons, the information was not “data” as defined by the Act and the claim failed.
2. Was the information “personal data”?
Although the question of personal data did not need to be dealt with, the court provided a decision nonetheless.
Smith’s counsel adduced evidence, displaying that Lloyds TSB had grouped Smith’s and the Company’s finances together, and that it considered the two as part of the same whole. Smith’s counsel argued that the evidence was enough to show that the information was personal data, as it was sufficiently proximate to Smith. He further argued that the current test of personal data, established by Durant, is too narrow and does not follow the definition of personal data in the Directive. He stated that the European Commission has criticised the Durant judgment and the UK’s narrow interpretation of personal data.
The court did not agree. It concluded that, assuming that the judgment in Durant is correct, the information in this case was not personal data. The information contained in Lloyds TSB’s files related to a loan which was chiefly between the Company and Lloyds TSB. Smith accepted the loan on behalf of the Company, as director and major shareholder. The information regarding his personal debts was merely ancillary. The information held by Lloyds TSB was not significantly biographical, and Smith was not the focus of the information. Therefore, there was not sufficient proximity to Smith, for the information to be personal data. The court further explained that the Court of Appeal is the correct forum for contesting the judgment in Durant.
- To what extent does the court have judicial discretion?
There was argument from both sides on whether the court has discretion under section 7(9) of the Act. In particular, there was argument on whether the use of the word “may” conferred discretion, or if it actually meant “must”. Lloyds TSB also argued that if it disclosed its information on the Company, Smith would use it to reopen litigation, an abuse of process.
The court did not deal with judicial discretion or abuse of process as it did not think them relevant in this case. Therefore, these questions were left unanswered.
Laddie J granted leave to appeal on the questions of “data” and “personal data”. It is expected that the appeal will request guidance on whether “data” includes information processed in the past, and whether any document can be within the remit of the Act. Smith’s counsel also mentioned the European Commission’s criticism of the UK’s narrow interpretation of “personal data”. From this, it is expected that Smith will argue that “personal data” should include any reference to a person, whether proximate or not.
Smith plans to file for appeal within 28 days.
Further InformationTerence William Smith v Lloyds TSB Bank plc was held before Laddie J at the Royal Courts of Justice, 21 to 23 February 2005. This article was prepared and published before an official transcript of the case was available. We have not, therefore, been able to check the accuracy of these comments with the transcript.