Personal Data in UK Law

The question is the meaning of the words "relate to" in the opening words of the definition, in particular to what extent, if any, the information should have the data subject as its focus, or main focus. Miss Houghton, on behalf of Mr. Durant, pitched Mr. Durant's entitlement to information under section 7 in very broad terms, relying on what she described as the extremely wide and inclusive definition of "personal data" in section 1(1).

As a matter of practicality and given the focus of the Act on ready accessibility of the information —whether from a computerised or comparably sophisticated non-computerised system —it is likely in most cases that only information that names or directly refers to him will qualify.

It follows from what I have said that not all information retrieved from a computer search against an individual's name or unique identifier is personal data within the Act. Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data.

There are two basic points to make about the scheme of sections 7(4)-(6), and 8(7), for balancing the interests of the data subject seeking access to his personal data and those of another individual who may be identified in such data. The first is that the balancing exercise only arises if the information relating to the other person forms part of the "personal data" of the data subject, as defined in section 1(1) of the Act.

In some cases, it has been said that the supply of information does not tell the data subject anything he or she did not already know. To take a simple example: everyone knows their own name and date of birth. A data subject may well make a SAR, not for the purpose of discovering his name or date of birth, but for the purpose of checking whether the data controller has correctly recorded them.

This goes further than section 7 (1) (b) which requires a description of the personal data. Even so, it is not an obligation to supply documents: Dunn v Durham CC [2012] EWCA Civ 1654, [2013] 2 All ER 213 at [16]. It is of critical importance to distinguish between the two. Although it may be more convenient and cheaper in some cases for a data controller to supply copy documents, there is no legal obligation to do so.

The exercise of these powers is subject to an intensive regime of statutory and administrative regulation. The principal element of this regime is the Data Protection Act 1998.