Data Protection in UK Law

As a matter of practicality and given the focus of the Act on ready accessibility of the information —whether from a computerised or comparably sophisticated non-computerised system —it is likely in most cases that only information that names or directly refers to him will qualify.

It follows from what I have said that not all information retrieved from a computer search against an individual's name or unique identifier is personal data within the Act. Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data.

It is information about his complaints and the objects of them, Barclays Bank and the FSA respectively. His claim is a misguided attempt to use the machinery of the Act as a proxy for third party discovery with a view to litigation or further investigation, an exercise, moreover, seemingly unrestricted by considerations of relevance.

The ventilation of the Data Protection Act 1998 issues which I have considered was solely in witness statements and in the course of the trial by argument. The point taken by Mr. Coppel in paragraphs 25 and 26 of his written outline closing submissions was not taken until then. In those circumstances it is perhaps unsurprising that the franchisor had not produced its certificate of registration under the Data Protection Act 1998.

In my opinion there is no presumption in favour of the release of personal data under the general obligation that FOISA lays down. The references which that Act makes to provisions of DPA 1998 must be understood in the light of the legislative purpose of that Act, which was to implement Council Directive 95/46/EC.

Even so, it is not an obligation to supply documents: Dunn v Durham CC [2012] EWCA Civ 1654, [2013] 2 All ER 213 at [16]. It is of critical importance to distinguish between the two. Although it may be more convenient and cheaper in some cases for a data controller to supply copy documents, there is no legal obligation to do so. This is, I think, borne out by article 12 of the Directive which requires the data controller to inform the data subject of the " categories of data concerned".