Smith v Lloyds TSB Bank Plc

In this action the claimant is Terence William Smith. The defendant is Lloyds TSB Bank Plc ("Lloyds"). Mr Smith seeks disclosure under section 7 of the Data Protection Act 1998 ("the 1998 Act") of various items of information which, he asserts, concern him and are held by Lloyds.

In 1988 Mr Smith was the Managing Director and controlling shareholder of a company called Display Electronics Ltd ("DEL"). The company was involved in a development project in Middlesex. At some time in 1988, Mr Smith decided to transfer the banking for DEL from Barclays Bank Plc to Lloyds. At that time DEL owed Barclays more than £250,000. An agreement was entered into between Mr Smith, DEL and Lloyds under which the latter party would take over the funding of the development. One of the terms was that both Mr Smith’s personal borrowings (which at that time were very small) and DEL’s borrowings would be secured on the development and also by a mortgage on Mr Smith’s home. Eventually Lloyds called in its loans. As a result, not only has DEL gone into liquidation, but Mr Smith has lost his home. The bank also petitioned to make Mr Smith bankrupt. These events have resulted in a number of pieces of litigation between Mr Smith and Lloyds. Mr Smith unsuccessfully resisted the bankruptcy and possession proceedings. One of the assertions he made was that he and Lloyds had entered into an oral agreement to the effect that Lloyds would make available to DEL long term finance in a substantial amount. Lloyds has always denied the existence of any such oral agreement. There have been determinations against the existence of such an oral agreement in at least two actions. Mr Smith believes that certain documentation held by Lloyds will prove his contentions. His confidence that this is so has been reinforced by what he says he has been told by a retired manager of Lloyds with whom he negotiated the long term loan.

In the various proceedings in which Mr Smith has raised the existence of the alleged oral agreement there has been limited, if any, disclosure by Lloyds. As a result, Mr Smith says that the crucial documents evidencing the oral agreement have been withheld from the courts. The purpose of these proceedings is to secure access to them pursuant to the provisions of the 1998 Act. Thus he seeks a declaration that certain Notes and Memoranda recorded by Lloyds, whether filed under his own name or that of DEL or Display Electronics Group (which I take to be a name under which DEL operated), are Mr. Smith’s personal data in a relevant filing system, as defined in the 1998 Act and an order that Lloyds provide copies to Mr. Smith of certain documents.

In the terminology of the 1998 Act, Mr Smith is the data subject and Lloyds is the data controller. In 2001 Mr Smith made data requests under s 7(1) which provides:

Since Lloyds has not provided him with the documents (strictly the data within them) which he has requested, Mr Smith has made this application under s. 7(9) for an order that it comply with his request. It will be appreciated that Mr Smith can only obtain an order if the data controller has failed to respond to a request for "personal data" of the data subject.

On this application only a small number of issues have been raised for determination. The first is whether the material sought by Mr Smith is "data" within the 1998 Act. Second, if it is data, whether it is "personal data". Third, if both of those are answered in the affirmative, whether the court should exercise its discretion under s 7(9) to make the order sought.

The expression "data" is defined in s 1(1) of the 1998 Act as follows:

For present purposes, it is not necessary to consider subsection (d).

It will be seen that (a) and (b) refer to processing by automatic equipment. Processing is itself defined as follows:

Thus, for example, if information is "held" by automatic equipment, it will be treated as "data" for the purpose of the 1998 Act. In substance this means that information held in digital form in computerised databases is data within the legislation. On the other hand, the expression "data" also covers material which is not being processed by automatic equipment. This is covered by (c) above. In this case the question is not how it is or is to be processed, rather it is the form in which the information is kept. Thus the information must be part of, or intended to be part of, a relevant filing system. The latter is defined in s 1(1) of the 1998 Act as follows:

Thus information can be treated as data under the 1998 Act if it is kept in a qualifying filing system. The scope of this was considered by the Court of Appeal in Durant v Financial Services Authority [2003] EWCA Civ 1746. For present purposes it is sufficient to summarise Durant as holding that information kept in a non-computerised manual system is only to be treated as data if the filing system is sufficiently structured to allow easy access to information specific to the data subject. The data controller is not to be put to a great deal of effort in extracting the relevant information.

I should add that in my earlier decision Johnson v Medical Defence Union [2004] EWHC 347, I pointed out that the definition of data refers to information which "is" being processed or recorded and that, for that reason, the question whether information is data within the meaning of the 1998 Act is to be determined at the time when the data subject makes his data request. In this case that means that the relevant question has to be asked as of 2001. I understand that Mr Roughton, who appears on behalf of Mr Smith, wishes to reserve the right to challenge the correctness of Johnson if this case goes to the Court of Appeal. For present purposes I will assume that Johnson is correct.

The nature of the files held by Lloyds relating or referring to Mr Smith as at 2001 is now not in dispute. Lloyds has no computerised records relating to Mr Smith. Furthermore such documents as it retains are in the form of unstructured bundles kept in boxes. There will be some documents which at least mention Mr Smith within the bundles of documents relating to DEL. I understand Mr Roughton to accept that such files are not, of themselves, sufficiently structured to fall within the scope of "relevant filing systems" as explained in Durant. At first blush, this should mean that there is no data which can form the subject of a data request under s. 7.

However Mr Roughton runs two new arguments which were not raised in Durant or Johnson. First he runs what he calls his "once processed always processed" point. If the information was processed by the data controller at some time in the past on automatic equipment, it was data then. It must continue to be data now, even if it is no longer being processed in this way and the automatic equipment no longer exists. Thus, for example, if a series of letters about the data subject were typed on word processors and thereafter retained on computer hard discs, they would have been processed, i.e. held, on relevant automatic equipment. Even if the data controller has wiped all the hard discs clean some years ago and only retains hard copies of the documents in unstructured files, they still contain data within the meaning of the 1998 Act because, once processed always processed.

At least one version of this argument was rejected by me in paragraphs 30 to 34 of Johnson. Mr Roughton reserves the right to challenge those paragraphs in the Court of Appeal. However he argues that he has another way of presenting this argument which was not put in Johnson and was therefore not considered by me or by the Court of Appeal when it had before it and rejected the application in that case for permission to appeal. It is as follows. The 1998 Act must be construed as being consistent with the European Directive which it is intended to implement. That is Directive 95/46/EC of the European Parliament and of the Council of 24 of October 1995. In particular Mr Roughton relies upon Article 3 which provides:

Based on this, he argues that the definition of data in s. 1(1) of the 1998 Act should be construed as if it read, for example, "information which (a) is being processed wholly or partly by means of equipment operating automatically …" If that is done then it can be argued that Lloyds’ information relating to Mr Smith, which at one stage was held on digital computer discs, was once processed, i.e. held, on automatic equipment. Therefore, even though it is not so held now, it is partly processed by such equipment.

I do not accept this argument. Even if s 1 of the 1998 Act is treated as including the words from Article 3, it does not help Mr Smith. As I said in Johnson, the question of whether information is data has to be answered at the time of the data request. Mr Roughton's argument involves a subtle sleight of hand. What he is saying is that because the information was held on automatic equipment but now is not, this means that it is partly so held. However this runs together two situations which are separated by time. What is relevant for the 1998 Act is whether, at the time of the data request, the information is wholly or partly held by means of equipment operating automatically. That is not the position here. As of 2001 Lloyds did not hold information relating to Mr Smith either wholly or partly on automatic equipment. Rewriting the section makes no difference.

Mr Pitt-Payne, who appears for Lloyds, also argues that for Mr Roughton to succeed on this argument it would be necessary to show that the Directive intended to treat as data, information which was processed automatically before the date of the request and wholly manually at the time of the request. He says that it does no such thing. In particular he refers to Article 12 which, like the 1998 Act, emphasises that the issue of whether information falls within the scope of a data request has to be determined at the date of the request only. I agree.

Mr Pitt-Payne also points out that, even were Mr Roughton correct on this issue, it would not help his client. Access to the documents would be dependent upon it being possible to show that they had at some stage in the past been brought within the scope of the data protection legislation. Mr Roughton argues that he is able to do that by relying on the fact that some at least of the documents in the files must have been prepared on word processors and that, for that reason, they would have been retained in digital form. However Mr Pitt-Payne argues that this route is not open to Mr Roughton. In particular because the predecessor to the 1998 Act which was in force at the material time, namely the Data Protection Act 1984, had a specific exemption for word processing. In the circumstances of this case, that is an issue I do not need to resolve.

Mr Roughton’s second argument is more ambitious. He says that high quality scanning equipment exists and existed in 2001. He says that any selection of paper documents is scannable. As such it is easy to cause them to be indexed since they can be filed into a high speed scanning system at low cost. Once that is done they can be accessed and information they contain can be extracted selectively at very low cost. The argument was put most bluntly in the following passage in his skeleton argument:

In summary he is saying that, with modern technology, any pile of documents is capable of being turned rapidly into the digital equivalent. They should therefore be treated as being just as accessible as if they were in a computer database. He says that this is consistent with part of Recital (27) of the Directive:

Mr Roughton accepts that the ramifications of this argument, were it accepted, would be extensive. It would mean that all documents, no matter where held or how widely dispersed geographically, should be treated as if recorded digitally in a database. He does not shy away from this. He says that if, with modern technology, it is almost as easy to search documents as to search a database, why should the information in the documents be treated as outwith the 1998 Act. He accepts that, were his submission correct, to determine whether information is readily accessible to the data controller, one would need to know whether he possessed relevant scanning equipment or was sufficiently close to a bureau which offered scanning services. Presumably it would also be necessary to know how widely spread the documents were, how difficult it would be to get them together, how bulky they are and so on. He says that none of these are real problems here because all the documents which Mr Smith wants to see are contained in a limited number of unstructured files all of which Lloyds has gathered together for the purpose of these proceedings.

I do not accept this argument either. It would destroy the distinction between information processed by automatic equipment and information kept in relevant filing systems. For better or worse, that is a distinction the Directive and our 1998 Act draws. Indeed it seems to me that the reference to and definition of "relevant filing system" in the definition of data in s 1(1) would be rendered meaningless were Mr Roughton correct. Any pile of documents, whether filed or not, whether related to each other or not, whether kept miles apart or not, would be scannable and, on his argument, to be treated as covered by the 1998 Act.

Furthermore, I do not accept that his argument is consistent with Recital 27. On the contrary, immediately after the passage Mr Roughton relied on, the Recital states:

In other words the legislature has taken a policy decision not to bring unstructured files within the general scope of the Directive. That is impossible to reconcile with Mr Roughton’s argument. I would only add that I do not accept Mr Roughton’s assertion that the advent of high quality scanning equipment means that there is little practical difference between hard copy documents and digital databases containing their contents. On the contrary, in many cases the duty imposed on data controllers who happen to have large quantities of unstructured manual records would be enormous were he right. In cases where the data controller had unstructured files, he would have to scan all his documents.

I should add that Mr Pitt-Payne points out that this construction is also difficult to reconcile with s 68 of the Freedom of Information Act 2000 which added paragraph (e) to the definition of data in section 1(1) of the 1998 Act as of 1 January 2005.

The purpose of this amendment is to ensure that unstructured manual records held by public authorities are caught by the 1998 Act. This only makes sense if such records were otherwise excluded from the ambit of the legislation. If Mr Roughton were correct, there would be no need for the new subsection (e) at all.

For these reasons, I have come to the conclusion that there is here no data within the meaning of the 1998 Act and Mr Smith’s claim must fail accordingly.

In the light of this, it is not strictly necessary to deal with Mr Pitt-Payne’s second argument, namely that, if the documents here contained data within the meaning of the 1998 Act, it is not personal data. However, because this is a short point and can be dealt with very simply, I will express my views on it.

As noted above, a data subject can only use a data request to obtain personal data. The latter expression is defined in the 1998 Act:

The scope of this definition was considered in Durant. It is not necessary to go through the Court of Appeal’s lengthy analysis. For present purposes I think Mr Pitt-Payne’s summary of the guidance given by Durant is comprehensive enough. He says that Durant is authority for the propositions; (a) that not all information retrieved from a search against an individual’s name or unique identifier is personal data within the 1998 Act, (b) that mere mention of an individual in a document held by a data controller does not mean that the document contains personal data in relation to that individual, (c) that whether information is capable of constituting personal data depends on where it falls in a continuum of relevance or proximity to the data subject, (d) that in answering that question it is relevant to consider whether the information is biographical in a significant sense; and whether it has the putative data subject as its focus and, finally, (e) that personal data is information that affects the privacy of the putative data subject, whether in his personal, business or professional capacity.

Applying those principles here, it is clear that the documents held by Lloyds and the information contained within them are not personal to Mr Smith in the relevant sense. The files that do exist all relate to the loans to DEL. Although it is true that Mr Smith is mentioned in them, according to Lloyds that is only because he acted for and on behalf of the company and was closely associated with it. The documents are not biographical about Mr Smith to a significant extent. They deal with what loan was made to DEL and on what terms. Indeed, if one stands back and looks at what Mr Smith is trying to get by means of these proceedings, it is not documents about him but it is documents which deal with the terms of an alleged oral agreement under which Lloyds were to make £500,000 available to DEL.

It follows that I will dismiss Mr Smith’s claim for this reason also.

In these circumstances it is not necessary to consider Mr Pitt-Payne’s additional argument that, if all else failed, this was not a case where the court’s discretion should be exercised in Mr Smith’s favour because he intends to use any material obtained from Lloyds for the purpose of re-opening the arguments which he has advanced and lost in at least two earlier sets of proceedings.