![]() |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] [DONATE] | |||||||||
England and Wales High Court (Chancery Division) Decisions |
||||||||||
|
THE FUTURE OF BAILII DEPENDS ON USERS LIKE YOU
If you want to be able to use BAILII in the future, please consider making a donation to celebrate BAILII's 25 years of providing free access to law.
Your donation, no matter the size, will help BAILII maintain the legal databases that you and many other users rely on. If every visitor this month gives just £5, it will have a significant impact on BAILII's ability to continue providing this vital service.
| ||||||||||
|
You are here: BAILII >> Databases >> England and Wales High Court (Chancery Division) Decisions >> Johnson v The Medical Defence Union Ltd (1) [2004] EWHC 2509 (Ch) (09 November 2004) URL: https://www.bailii.org/ew/cases/EWHC/Ch/2004/2509.html Cite as: [2005] 1 WLR 750, [2005] 1 All ER 87, [2005] WLR 750, [2005] FSR 28, [2004] EWHC 2509 (Ch) |
||||||||||
[New search]
[Context
]
[View without highlighting]
[Printable RTF version]
[Buy ICLR report: [2005] 1 WLR 750]
[Help]
CHANCERY DIVISION
Strand, London, WC2A 2LL |
||
B e f o r e :
____________________
DAVID PAUL JOHNSON![]() |
Claimant |
|
| - and - |
||
| THE MEDICAL DEFENCE UNION LIMITED |
Defendant |
____________________
Miss Jacqueline Reid (instructed by Messrs. Fladgate Fielder) for the Defendant
Hearing date: 1 November, 2004
____________________
Crown Copyright ©
Mr. Justice Laddie:
Johnson
, a consultant orthopaedic surgeon, against the Medical Defence Union ("the MDU"). I set out the background to this action in a judgment dated 20 February of this year on an earlier interim application. Insofar as necessary, I repeat the relevant facts below.
Johnson
's membership, in accordance with the provisions of Article 11(a). This had obvious repercussions for Mr.
Johnson
. He was forced to find alternative insurance cover because he was no longer eligible for the special insurance available through the MDU. Furthermore, Mr.
Johnson
was extremely concerned that what he regarded as his expulsion from the MDU would be likely to convey to others, including medical colleagues, the impression that he was either incompetent or had done something wrong which was sufficiently grave to justify exclusion from the MDU.
Johnson
has been in practice for over 20 years and in all that time he has never been sued for negligence. Furthermore, in that period there have been only two occasions on which he has been reported to the General Medical Council. On both, the complaint was dismissed at a preliminary stage. He says that he is a highly competent surgeon and that, until January 2002, he had an unblemished reputation. That was changed, in his view, when he was excluded from the MDU.
Johnson
's competence as a surgeon. Nevertheless, it says that it was entitled to refuse to renew his membership.
Johnson
. He believes that that amounted to the improper processing of data relating to him which was not only damaging but also actionable under the provisions of the Data Protection Act 1998 ("DPA"). In order to better enable him to launch his claim, in January 2002 Mr.
Johnson
made what is known as an "access request" of the MDU under section 7 of the DPA. This action was commenced a year later. Mr
Johnson
said that the MDU failed to comply properly with his access request. That was added as one of the claims in the action. It was that assertion which lay behind the application which I heard, and in respect of which I gave judgment, earlier this year. In the terminology of the DPA, Mr.
Johnson
is the "data subject" and the MDU is the "data controller". Some of the information held by the MDU is "personal data" relating to Mr
Johnson
.
Johnson
against the MDU and his claim relating to the access request as follows:
"10. Mr.Johnson
seeks three major forms of relief. First, because he considers the MDU to have failed to respond properly to his access request of 22 January 2002, he claims relief pursuant to section 7(9) of the DPA. That is to say, he asks for an order requiring the MDU to comply properly. Second, he applies under the provisions of section 10(4) of the DPA for an order, in effect, to prevent the MDU from improperly processing personal data about him and an order under section 14(4) of the DPA for the rectification, blocking or destruction of certain data. Third, he seeks financial compensation under the provisions of section 13(1) and (2) of the DPA for damage suffered by him and distress caused to him by the allegedly improper processing by the MDU of his personal data.
11. Logically, the second and third heads of relief are dependent upon an identification of all personal data concerning Mr.Johnson
processed by the MDU and a knowledge of how those data were used by the MDU. For that reason, at a case management conference before Master Moncaster on 12 August 2003, the parties agreed that the question of compliance with the access request should be dealt with as a preliminary issue. Accordingly, the Master made an order that the following preliminary issue be determined:
'Whether and to what extent the defendant has complied with its obligations under section 7 of the Data Protection Act 1998, pursuant to the request made by the claimant of the defendant and dated 22nd January 2002.'"
Johnson
said that the MDU had a number of documents which contained references to him. Some had been disclosed to him by the MDU, sometimes with redactions. Others had not been disclosed at all. He argued that all the non-disclosed documents were his personal data and that, pursuant to his access request, he was entitled to see them and to have the redactions removed. The MDU argued that it had fully and properly complied with the access request. The purpose of the preliminary issue ordered by the Master was to determine whether the MDU was correct or whether further material should be disclosed.
Johnson
pursuant to his access request. The major ground for that decision was that the documents in issue were not and did not contain "personal data" of Mr
Johnson
. This was for two reasons. First the documents were held by the MDU in manual form and without sophisticated indexing. This meant that they were not recorded as part of a "relevant filing system" as required by s. 1(1)(c) of the DPA. For that reason they were not "data" within the meaning of the DPA and therefore not personal data. Second, many of the documents did not focus on Mr
Johnson
or were not about him. They were therefore not "personal" in the sense necessary to constitute personal data. On both of these points I placed particular reliance on the judgement of the Court of Appeal in Durant v. The Financial Services Authority [2003] EWCA Civ 174, [2004] FSR 573.
Johnson
was refused sight of the additional documents. I refused permission to appeal. So did the Court of Appeal.
Johnson
to put in an amended Particulars of Claim within the next two weeks. The result is that the final definitive claim made by Mr
Johnson
has not been pleaded and the MDU has not had an opportunity to respond to it. Notwithstanding that, Mr
Johnson
has launched the current application, the major part of which consists of an application for specific disclosure. The disclosure sought is very wide. I do not understand Mr Roughton, who appears for Mr
Johnson
, to dispute that, in substance, it covers all the documents which were the subject of his client's earlier unsuccessful application following from the access request.
Johnson
had unsuccessfully sought access to the very same documents through the regime created by s 7 of the DPA is more or less irrelevant.
Johnson
used in his first application for sight of these documents is designed to balance the interests of the data subject (Mr
Johnson
) against those of the data controller (the MDU) and third parties. This includes express limitations on disclosure which the current application, if successful, would undermine. The legislature has indicated that disclosure should not be ordered in a case like this. Even if the court retains jurisdiction to order disclosure, the discretion should always be exercised in accordance with this legislative intent. Such orders against the data controller should not be made so as to circumvent the statutory restriction.
"1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4. Personal data shall be accurate and, where necessary, kept up to date."
"10. - (1) Subject to subsection (2), an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons-
(a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and
(b) that damage or distress is or would be unwarranted.
11. - (1) An individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing for the purposes of direct marketing personal data in respect of which he is the data subject."
Johnson
seeks relief under both of these provisions in this action.
"7. - (1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled-
(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,
(b) if that is the case, to be given by the data controller a description of-
(i) the personal data of which that individual is the data subject,
(ii) the purposes for which they are being or are to be processed, and
(iii) the recipients or classes of recipients to whom they are or may be disclosed,
(c) to have communicated to him in an intelligible form-
(i) the information constituting any personal data of which that individual is the data subject, and
(ii) any information available to the data controller as to the source of those data, and
(d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking."
"(4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless-
(a) the other individual has consented to the disclosure of the information to the person making the request, or
(b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.
(5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.
(6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to-
(a) any duty of confidentiality owed to the other individual,
(b) any steps taken by the data controller with a view to seeking the consent of the other individual,
(c) whether the other individual is capable of giving consent, and
(d) any express refusal of consent by the other individual."
"(9) If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request."
Johnson
has sought relief under s 10 (prevention of processing), s 13 (damages) and s 14 (rectification or erasure of data). He has also sought relief under s 7(9) (provision of information). It was the latter which was the subject of the preliminary issue hearing in relation to which I gave my earlier judgment in these proceedings.
"15(2) For the purpose of determining any question whether an applicant under subsection (9) of section 7 is entitled to the information which he seeks (including any question whether any relevant data are exempt from that section by virtue of Part IV) a court may require the information constituting any data processed by or on behalf of the data controller and any information as to the logic involved in any decision-taking as mentioned in section 7(1)(d) to be made available for its own inspection but shall not, pending the determination of that question in the applicant's favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery (or, in Scotland, recovery) or otherwise."
Johnson
's application for disclosure. She argues that the legislative intent, confirmed by the words of this subsection, is to prevent data subjects obtaining disclosure. Were Mr
Johnson
to succeed on this application, it would drive a coach and horses through s 15(2) and, in particular, the second half of it. The point is particularly clear here because it is not in dispute that the material which Mr
Johnson
wishes to have sight of pursuant to his application for disclosure encompasses all the material which he applied unsuccessfully to obtain under s 7 by his access request. It includes all those documents which, in applying s 15(2), I had to look at during the course of the last hearing and which Mr
Johnson
and his legal team were not allowed to see.
Johnson
's application for disclosure in relation to his claims for breaches by the MDU of the data protection principles is not disposed of by the fact that he failed on his claim under s 7(9). The fact that, in determining the latter application, I looked at documents which, because of s 15(2), Mr
Johnson
and his lawyers were not allowed to see, does not mean that if some of those documents are relevant to his claims under ss 10, 13 and 14, Mr
Johnson
cannot seek disclosure of them.
Johnson
to seek disclosure under the CPR notwithstanding the failure of his s 7(9) application and the terms of s 15(2). I have not considered what, if any, disclosure would be appropriate if, as I have found, there is no fetter on Mr
Johnson
making his application. A decision on what order to make is dependent upon a determination of what are the arguable claims Mr
Johnson
has made and what are the issues between the parties. Those matters will only be possible to evaluate in this case once the pleadings have been amended.
Johnson served a lengthy request for further information and clarification of the defence pursuant to CPR Part 18. The MDU has declined to answer some of the questions asked. In some cases it said that the requests were too vague and in others they said that the request is for evidence. That may not be, of itself, a proper objection. The purpose of a request for information is to narrow the areas of dispute between the parties and to avoid surprise at the trial. The court is likely to be unwilling to order responses if they will not make a significant contribution to achieving these objectives and if they will do little but add to the costs of the litigation. When a party refuses to respond to such a request, the court must consider whether, in all the circumstances, a significant benefit will be secured by ordering some or all of them to be answered.