Johnson v The Medical Defence Union Ltd (1)

This is the judgment on a further interim application in an action brought by David Paul Johnson, a consultant orthopaedic surgeon, against the Medical Defence Union (“the MDU”). I set out the background to this action in a judgment dated 20 February of this year on an earlier interim application. Insofar as necessary, I repeat the relevant facts below.

The MDU is a body which provides medico-legal advice and support to its members, who are all members of the medical profession. There are at least two similar organisations offering similar services to medical practitioners in this country. One of the services provided by the MDU is access to professional indemnity insurance, written by a major insurance company. MDU members obtain a discount on their premiums. This policy is, so I understand, only available to MDU members. Insurance is also available through other insurance companies outside this discounted scheme.

The articles of the MDU contain a number of provisions in accordance with which it can refuse to continue the membership of any member. In particular, Article 11(a) purports to bestow on the MDU’s board of management an absolute discretion to refuse to renew the membership of any member subject to a requirement to give 42 days prior notice.

In January 2002, the MDU decided not to renew Mr. Johnson’s membership, in accordance with the provisions of Article 11(a). This had obvious repercussions for Mr. Johnson. He was forced to find alternative insurance cover because he was no longer eligible for the special insurance available through the MDU. Furthermore, Mr. Johnson was extremely concerned that what he regarded as his expulsion from the MDU would be likely to convey to others, including medical colleagues, the impression that he was either incompetent or had done something wrong which was sufficiently grave to justify exclusion from the MDU.

Mr. Johnson has been in practice for over 20 years and in all that time he has never been sued for negligence. Furthermore, in that period there have been only two occasions on which he has been reported to the General Medical Council. On both, the complaint was dismissed at a preliminary stage. He says that he is a highly competent surgeon and that, until January 2002, he had an unblemished reputation. That was changed, in his view, when he was excluded from the MDU.

The MDU denies that it has ever impugned Mr Johnson’s competence as a surgeon. Nevertheless, it says that it was entitled to refuse to renew his membership.

The MDU’s decision was based upon its assessment of certain information concerning Mr Johnson. He believes that that amounted to the improper processing of data relating to him which was not only damaging but also actionable under the provisions of the Data Protection Act 1998 (“DPA”). In order to better enable him to launch his claim, in January 2002 Mr. Johnson made what is known as an “access request” of the MDU under section 7 of the DPA. This action was commenced a year later. Mr Johnson said that the MDU failed to comply properly with his access request. That was added as one of the claims in the action. It was that assertion which lay behind the application which I heard, and in respect of which I gave judgment, earlier this year. In the terminology of the DPA, Mr. Johnson is the “data subject” and the MDU is the “data controller”. Some of the information held by the MDU is “personal data” relating to Mr Johnson.

In my earlier judgment I explained the relationship between the substantive claims made by Mr Johnson against the MDU and his claim relating to the access request as follows:

“10.

Mr. Johnson seeks three major forms of relief. First, because he considers the MDU to have failed to respond properly to his access request of 22 January 2002, he claims relief pursuant to section 7(9) of the DPA. That is to say, he asks for an order requiring the MDU to comply properly. Second, he applies under the provisions of section 10(4) of the DPA for an order, in effect, to prevent the MDU from improperly processing personal data about him and an order under section 14(4) of the DPA for the rectification, blocking or destruction of certain data. Third, he seeks financial compensation under the provisions of section 13(1) and (2) of the DPA for damage suffered by him and distress caused to him by the allegedly improper processing by the MDU of his personal data.

11.

Logically, the second and third heads of relief are dependent upon an identification of all personal data concerning Mr. Johnson processed by the MDU and a knowledge of how those data were used by the MDU. For that reason, at a case management conference before Master Moncaster on 12 August 2003, the parties agreed that the question of compliance with the access request should be dealt with as a preliminary issue. Accordingly, the Master made an order that the following preliminary issue be determined:

‘Whether and to what extent the defendant has complied with its obligations under section 7 of the Data Protection Act 1998, pursuant to the request made by the claimant of the defendant and dated 22nd January 2002.’”

In the application leading to my judgment, Mr Johnson said that the MDU had a number of documents which contained references to him. Some had been disclosed to him by the MDU, sometimes with redactions. Others had not been disclosed at all. He argued that all the non-disclosed documents were his personal data and that, pursuant to his access request, he was entitled to see them and to have the redactions removed. The MDU argued that it had fully and properly complied with the access request. The purpose of the preliminary issue ordered by the Master was to determine whether the MDU was correct or whether further material should be disclosed.

In my judgment of earlier this year, I held that the above question should be answered in the affirmative. The MDU had complied with its obligations under s 7 and no further documents need be supplied to Mr Johnson pursuant to his access request. The major ground for that decision was that the documents in issue were not and did not contain “personal data” of Mr Johnson. This was for two reasons. First the documents were held by the MDU in manual form and without sophisticated indexing. This meant that they were not recorded as part of a “relevant filing system” as required by s. 1(1)(c) of the DPA. For that reason they were not “data” within the meaning of the DPA and therefore not personal data. Second, many of the documents did not focus on Mr Johnson or were not about him. They were therefore not “personal” in the sense necessary to constitute personal data. On both of these points I placed particular reliance on the judgement of the Court of Appeal in Durant v. The Financial Services Authority [2003] EWCA Civ 174, [2004] FSR 573.

In the result, Mr Johnson was refused sight of the additional documents. I refused permission to appeal. So did the Court of Appeal.

The action has proceeded and a trial is now scheduled for January of next year. At a recent hearing before Master Moncaster, directions were given which required Mr Johnson to put in an amended Particulars of Claim within the next two weeks. The result is that the final definitive claim made by Mr Johnson has not been pleaded and the MDU has not had an opportunity to respond to it. Notwithstanding that, Mr Johnson has launched the current application, the major part of which consists of an application for specific disclosure. The disclosure sought is very wide. I do not understand Mr Roughton, who appears for Mr Johnson, to dispute that, in substance, it covers all the documents which were the subject of his client’s earlier unsuccessful application following from the access request.

This has given rise to a point which may be of some general importance in DPA cases. Mr Roughton argues that his client is seeking relief from wrongful processing of his personal data. His right to bring proceedings is created by the DPA but the conduct of such proceedings has to be in accordance with the provisions of the CPR including, in particular, the obligation on the parties to give disclosure of documents. That is what his client seeks here. The fact that Mr Johnson had unsuccessfully sought access to the very same documents through the regime created by s 7 of the DPA is more or less irrelevant.

Miss Reid, who appears for the MDU, does not suggest that the earlier application for disclosure makes this application an abuse of process (see Henderson v Henderson (1843) 3 Hare 100 and Yat Tung Investment Co Ltd v Dao Heng Bank Ltd [1975] AC 581). She argues that the statutory provisions which Mr Johnson used in his first application for sight of these documents is designed to balance the interests of the data subject (Mr Johnson) against those of the data controller (the MDU) and third parties. This includes express limitations on disclosure which the current application, if successful, would undermine. The legislature has indicated that disclosure should not be ordered in a case like this. Even if the court retains jurisdiction to order disclosure, the discretion should always be exercised in accordance with this legislative intent. Such orders against the data controller should not be made so as to circumvent the statutory restriction.

To determine this issue it is necessary to understand the structure and scope of this legislation. The DPA is concerned to control the way in which personal data about a data subject are gathered, processed and used. To this end, s 4(4) imposes a general duty on the data controller to comply with the “data protection principles” in relation to all personal data in relation to which he is the data controller. The data protection principles are set out in Part I of Schedule I to the DPA. They cover a wide field. For example the first four such principles are as follows:

“1.

Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-

(a)

at least one of the conditions in Schedule 2 is met, and

(b)

in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2.

Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

3.

Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

4.

Personal data shall be accurate and, where necessary, kept up to date.”

In addition to requiring the data controller to comply with the data protection principles, the DPA creates ways in which the data subject can interfere with the way in which the data controller handles or uses his personal data. For example ss 10(1) and 11(1) DPA provide:

“10.

- (1) Subject to subsection (2), an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons-

(a)

the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and

(b)

that damage or distress is or would be unwarranted.

11.

- (1) An individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing for the purposes of direct marketing personal data in respect of which he is the data subject.”

The data subject can also serve a notice requiring a data controller not to make certain decisions in certain circumstances (s 12). In the cases to which these sections apply it is not inevitable or a pre-requisite that the data controller has breached any of the data protection principles.

Furthermore, the DPA also contains provisions which create remedies for the data subject if the data controller has breached his duty under s 4(4) to comply with the data protection principles. If he is damaged or distressed by the breach, the data subject is entitled to financial compensation under s 13. If it is shown that personal data are inaccurate, under s 14 the court can order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data. It will be appreciated from what is set out above, that Mr Johnson seeks relief under both of these provisions in this action.

The data subject’s ability to make use of the safeguards given to him by ss 10 to 14 are dependent upon him knowing what personal data relating to him is controlled, and how it has been and will be processed or used, by the data controller. However, in the majority of cases the data subject will have little or no knowledge of these matters. He may not even know whether any personal data are held by the data controller. To overcome this, the DPA provides individuals with a mechanism by which they can find out what data, if any, are held by data controllers and, where such data are held, to what use they have been or will be put. To this end, s 7(1) provides:

“7.

- (1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled-

(a)

to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,

(b)

if that is the case, to be given by the data controller a description of-

(i)

the personal data of which that individual is the data subject,

(ii)

the purposes for which they are being or are to be processed, and

(iii)

the recipients or classes of recipients to whom they are or may be disclosed,

(c)

to have communicated to him in an intelligible form-

(i)

the information constituting any personal data of which that individual is the data subject, and

(ii)

any information available to the data controller as to the source of those data, and

(d)

where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.”

It will be noticed that s 7(1)(a) allows the individual to find out whether personal data about him are being processed and s 7(1)(b) allows him to find out how they are being processed if s 7(1)(a) is answered in the affirmative. There is no pre-condition that the individual believes or can demonstrate a prima facie case that the data controller has any of his personal data nor is there a pre-condition that, if any such personal data are held, the individual believes or can demonstrate a prima facie case that they are being processed improperly. S 7 is not concerned with whether the data controller is acting improperly.

Therefore the purpose of these provisions is to make the processing of personal data transparent. Because there is nothing in this to limit applications to cases where the data controller has acted in some way improperly, he may charge a fee for complying with a data request under this section (s. 7(2)(b)). The section also contains provisions which allow the data controller to refuse requests for information, at least in part, where compliance might disclose the identity of third parties:

“(4)

Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless-  

(a)

the other individual has consented to the disclosure of the information to the person making the request, or

(b)

it is reasonable in all the circumstances to comply with the request without the consent of the other individual.

(5)

In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise. 

(6)

In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to-  

(a)

any duty of confidentiality owed to the other individual,

(b)

any steps taken by the data controller with a view to seeking the consent of the other individual,

(c)

whether the other individual is capable of giving consent, and

(d)

any express refusal of consent by the other individual.”

The right to seek information under s 7(1) is backed up by a power given to the court by s 7(9) to order the data controller to comply:

“(9)

If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.”

In his Particulars of Claim, Mr Johnson has sought relief under s 10 (prevention of processing), s 13 (damages) and s 14 (rectification or erasure of data). He has also sought relief under s 7(9) (provision of information). It was the latter which was the subject of the preliminary issue hearing in relation to which I gave my earlier judgment in these proceedings.

The manner in which a court exercises its powers under s 7(9) is governed by s 15(2) which provides:

“15(2) For the purpose of determining any question whether an applicant under subsection (9) of section 7 is entitled to the information which he seeks (including any question whether any relevant data are exempt from that section by virtue of Part IV) a court may require the information constituting any data processed by or on behalf of the data controller and any information as to the logic involved in any decision-taking as mentioned in section 7(1)(d) to be made available for its own inspection but shall not, pending the determination of that question in the applicant's favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery (or, in Scotland, recovery) or otherwise.”

Miss Reid puts this at the heart of her objection on principle to Mr Johnson’s application for disclosure. She argues that the legislative intent, confirmed by the words of this subsection, is to prevent data subjects obtaining disclosure. Were Mr Johnson to succeed on this application, it would drive a coach and horses through s 15(2) and, in particular, the second half of it. The point is particularly clear here because it is not in dispute that the material which Mr Johnson wishes to have sight of pursuant to his application for disclosure encompasses all the material which he applied unsuccessfully to obtain under s 7 by his access request. It includes all those documents which, in applying s 15(2), I had to look at during the course of the last hearing and which Mr Johnson and his legal team were not allowed to see.

As attractive as this argument may appear, I do not think it is right. s 15(2) does not contain a general prohibition on a data subject obtaining disclosure in an action where he claims relief for breaches of the data protection principles. It is concerned solely with whether requests for information pursuant to an access request under s 7 have been complied with properly. That is a quite separate matter. As noted above s 7(4), (5) and (6) entitle the data controller to refuse to respond, at least in part, to a data subject’s request where confidential information relating to third parties is at stake. S 15(2) dovetails into this. It allows the court to see for itself whether such confidential information does exist and to consider for itself whether or not relevant personal data are held by the data controller. S 15(2) makes it clear that, for the purposes of determining whether the data controller was entitled to refuse to disclose any information to the data subject, the court can look at the information itself. However the data subject may not see this material. The purpose of this is obvious. A data controller’s entitlement under the DPA to hold back information from the data subject so as to protect the interests of third parties would be destroyed if all the data subject had to do was make an application for disclosure under s 7 and then ask to see the withheld material in order to verify for himself whether it has been withheld on proper grounds. It is for this reason that s 15(2) provides that the information sought by the applicant and held by the data controller shall not be disclosed to him or his representatives whether by discovery or otherwise, until after the court has determined the application in his favour.

As its introductory words make clear, s 15(2) is only concerned with applications under s 7(9). The latter is concerned only with finding out whether the data controller has, is using or intends to use personal data. It is not concerned with whether there has been a breach of the data protection principles by the data controller. As a consequence it has no direct bearing on whether there should be disclosure, or its extent, in proceedings where the data subject has made out an arguable case that there has been such a breach.

The difference in purpose of an order under s 7(9) and an order for disclosure under the CPR is also reflected in the difference in the materials to which they relate. As the Court of Appeal pointed out in Durant, whether information relating to an individual is personal data within the meaning of the DPA involves, inter alia, a consideration of whether it is “data” as defined in s 1 DPA. That, amongst other things, requires that the information be “recorded as part of a relevant filing system”. As the Court of Appeal explained, where information is retained in manual filing systems, it is only in a “relevant filing system” when the manual system is broadly equivalent to computerised systems in ready accessibility to relevant information. As noted above, these principles were applied by me in the earlier judgment in this case. The upshot of this is that documents which might be highly material to an allegation of breach of the data protection principles and would fall within the ambit of disclosure might well not be personal data within the meaning of the DPA and, for that reason, not within the scope of ss 7 and 15. For example, a data subject may complain that his personal data are inaccurate. The personal data held by the data controller may be based on earlier documents which are held manually. The latter documents may be of primary significance to the data subject’s assertion of inaccuracy but, because they are held in a manual system with insufficient organisation, not qualify as personal data for the purpose of the DPA. They would fall within the class of documents which are likely to be discloseable for the purpose of the data subject’s claim for damages and rectification but outwith the scope of ss 7 and 15. I can see no reason why the determination that the data subject cannot have access to such documents pursuant to an access request under s 7 should prevent such documents, if material to the data subject’s claim under ss 13 or 14, being disclosed in the course, and for the purpose, of proceedings under the latter two sections.

It follows that Mr Johnson’s application for disclosure in relation to his claims for breaches by the MDU of the data protection principles is not disposed of by the fact that he failed on his claim under s 7(9). The fact that, in determining the latter application, I looked at documents which, because of s 15(2), Mr Johnson and his lawyers were not allowed to see, does not mean that if some of those documents are relevant to his claims under ss 10, 13 and 14, Mr Johnson cannot seek disclosure of them.

However, I should make two points clear. First, I have said that s 15(2) has no direct bearing on whether there should be disclosure. In my view it does have some indirect impact. s 15(2), like s 7(4) to (6), emphasises the concern of the legislature that confidential information relating to third parties should not be disclosed to a data subject. When a court exercises its discretion to order specific disclosure, this concern must be borne in mind. It may, depending on all the circumstances of the case, reinforce the court in a decision either to refuse disclosure in whole or in part or to allow redaction of documents ordered to be disclosed. Second, as agreed with Counsel, I have only considered the broad question of principle, namely whether it is open to Mr Johnson to seek disclosure under the CPR notwithstanding the failure of his s 7(9) application and the terms of s 15(2). I have not considered what, if any, disclosure would be appropriate if, as I have found, there is no fetter on Mr Johnson making his application. A decision on what order to make is dependent upon a determination of what are the arguable claims Mr Johnson has made and what are the issues between the parties. Those matters will only be possible to evaluate in this case once the pleadings have been amended.

There is one other minor point which arises for determination at this stage. In June of this year, Mr Johnson served a lengthy request for further information and clarification of the defence pursuant to CPR Part 18. The MDU has declined to answer some of the questions asked. In some cases it said that the requests were too vague and in others they said that the request is for evidence. That may not be, of itself, a proper objection. The purpose of a request for information is to narrow the areas of dispute between the parties and to avoid surprise at the trial. The court is likely to be unwilling to order responses if they will not make a significant contribution to achieving these objectives and if they will do little but add to the costs of the litigation. When a party refuses to respond to such a request, the court must consider whether, in all the circumstances, a significant benefit will be secured by ordering some or all of them to be answered.

I was taken through the outstanding requests by Mr Roughton and Miss Reid. In most cases it appeared to me that little benefit would be secured by requiring the MDU to answer them. However that was not the case in respect of requests no. 23, 40 and 43. I will direct that they be responded to.