Court of Appeal

Published April 10, 2007

Johnson v Medical Defence Union Ltd (No 2)

Before Lord Justice Buxton, Lady Justice Arden and Lord Justice Longmore

Judgment March 28, 2007

The selection of information from various manual and electronic files and its compilation on a computer did not constitute the creation of data capable of being processed under the Data Protection Act 1998.

The Court of Appeal so stated, inter alia, in a reserved judgment dismissing by a majority the appeal of the claimant, David Paul Johnson, and allowing the cross-appeal of the defendant, the Medical Defence Union Ltd, from the dismissal by Mr Justice Rimer in the Chancery Division (The Times April 4, 2006) of Mr Johnson’s claim for compensation for the unfair processing of data under the 1998 Act.

The claimant was a consultant orthopaedic surgeon. He had been a member of the defendant, a mutual society providing, inter alia, professional indemnity cover.

The claimant’s record caused the union to carry out a risk assessment review, which involved a risk manager considering the claimant’s files. Twelve files were manual, none of which amounted to a relevant filing system under section 1 of the 1998 Act; three were held in electronic form; one was held on a computer compact disc; and one was held on a microfiche file.

The risk manager selected information from the files and entered it into a computer-created document, namely a risk assessment review form. Subsequently, a committee of senior clinicians, having considered the form, decided to terminate the claimant’s membership.

The claimant sought compensation under section 13 of the 1998 Act on the ground that the defendant processed his personal data unfairly in breach of the first data protection principle and that that had led to his expulsion. The claim included compensation for damage to his professional reputation.

At trial, the question arose whether the selection of information constituted processing under the 1998 Act.

The defendant contended that the risk manager had not been engaged in any automatic processing of the data. In relation to the electronic files, she had not made her selection by any automatic process but had applied her own nonautomatic judgment to the computer database; and in relation to the manual files, they did not come into the picture because they were not part of a relevant filing system.

The issues before the judge were:

(i) Did the risk review involve any processing of the claimant’s personal data?
(ii) If so, was the processing unfair?
(iii) If so, had it been shown that, if the processing had been fair, the termination decision would probably not have been made?
(iv) if the claimant succeeded thus far, what, if any, compensation would he be entitled to?

The judge’s conclusions respectively were: (i) yes; (ii) only in a minor and inconsequential respect; (iii) and (iv) did not arise, but if they did the answers to them would be (iii) yes, on the balance of probabilities, and (iv) £10.50 for pecuniary loss, £5,000 for distress; and if, contrary to the judge’s view, damage to reputation was a valid head of claim under the 1998 Act, £1,000 in that respect.

On appeal, the claimant challenged finding (ii), and the judge’s approach to, and thus the level of the sums awarded under (iii) and (iv). The defendant cross-appealed against finding (i) as to processing and against findings (iii) and (iv) on the ground that, in any event, no damages were recoverable.

Mr Martin Howe, QC and Mr Ashley Roughton for Mr Johnson; Mr Richard Spearman, QC and Miss Jacqueline Reid for the Medical Defence Union.

LORD JUSTICE BUXTON said that the first question was whether the selection of information by the risk manager in the circumstances case constituted “processing” under the 1998 Act.

The 1998 Act had to be interpreted in the light of Directive 95/46/EC (OJ November 28, 1995 L281/31) which it sought to transpose into domestic law.

There were differences of wording between the two instruments but nothing turned on the differences; nor was it submitted that the 1998 Act inadequately transposed the Directive.

Furthermore, although a leading principle of the Directive was that data should be handled in such a way as to protect the privacy of the data subject, in the light of R (Countryside Alliance) v Attorney-General ( The Times June 30, 2006; [2006] 3 WLR 1017), it was not submitted that the treatment accorded to the claimant infringed article 8 or any other article of the European Convention.

Having had extensive regard, inter alia, to section 1 of, and Schedule 1 to the 1998 Act, as well as Campbell v MGN Ltd([2003] QB 633), the conclusion was that neither the 1998 Act nor Directive 95/46/EC supported the claimant’s case.

Accordingly, the judge had erred as to the first issue in holding that the selection of the data amounted to processing of data in the terms of the 1998 Act. It followed that the cross-appeal on that issue would be allowed and that was sufficient to dispose of the proceedings.

Lady Justice Arden gave a dissenting judgment on issue (i). Lord Justice Longmore agreed with Lord Justice Buxton as to issue (i) and the result.

Solicitors: Withers LLP; Fladgate Fielder.

Times Recommends

• The best legal yarns this Christmas
• Legal school 'earned £1m by exploiting bar course'
• Axe may fall on 5,000 more City lawyers