If you're confused by the scope of the Data Protection Act, you're not the only one. But in a new case - Durant v Financial Services Authority (IDS Brief 749) - the Court of Appeal has clarified what information comes within the meaning of 'personal data', and also when manual records can be deemed to be held in a filing system that come within the scope of the Act.

What was Mr Durant's complaint?

Mr Durant asked the Financial Services Authority (FSA) to investigate a complaint against a high street bank about documents that it disclosed in the course of litigation. The FSA did as asked, but failed to tell Mr Durant the outcome. He requested disclosure of the documents that the Authority held about his complaint. The Authority disclosed all the computerised files that mentioned him, but refused to hand over any manual files. 
Mr Durant asked the county court to order the FSA to hand them over, but it refused. He then appealed to the Court of Appeal.

Did the material amount to personal data?

The Court said that for information held on computer or hard copy to amount to personal data, it had to be relevant to Mr Durant (the data subject in this case) or relate closely to him.

For instance, something that was biographical that had Mr Durant as its focus; or something that affected his privacy, whether personally or professionally. Using that definition, the court decided, the information held on him by the FSA did not amount to personal data.

In other words, just because someone's name is mentioned in a document does not mean it has to be disclosed.

When is a filing system relevant?

The court then looked at whether the manual records held by the FSA had been held in a 'relevant filing system', bringing them under the scope of the Act.

It decided that to fulfil that definition, the manual filing system would have to operate in such a way that allowed files to be identified without having to make a manual search of them, as such.

The court specified that any file found by using a 'relevant filing system' had to be indexed in such a way so that the specific information that Mr Durant wanted could be easily pinpointed in the file, or sub-file.

In the end, the court said, that meant that a 'relevant filing system' was limited to one in which files are structured in such a way that you could easily ascertain at the start of the search whether specific information amounting to personal data about the individual requesting it, was held within the system.

It also has to have a reasonably sophisticated index or reference system to indicate where you would find information about the applicant in an individual file or files. 
That being the case, the court decided that none of the information requested by Mr Durant was held in a 'relevant filing system'. Having files that were organised chronologically was not enough.

So what's the relevance for employees?

This decision makes clear that this definition of 'personal data' can be applied to personnel files, whether they are held manually or in computerised format.

It also means that most manual personnel records are held within a 'relevant filing system'. However, equally, it probably also means that information not held in structured files does not fall within the scope of the Act.