ICO wants wider interpretation of Data Protection Act

New guidance has been published by the Information Commissioner's Office (ICO) in order to help the courts make fairer rulings on what constitutes 'personal data'.

The privacy watchdog said it had been aware for some time of the need to replace its original guidance on the 1998 Data Protection Act (DPA), following a landmark court ruling in 2003. It said it was important that definitions of personal data must be allowed to be quite wide in some cases.

As only a court can rule on what the definition in the DPA really means, guidance from the ICO is influential.

"We have been aware for some time of the need to replace our guidance on the implications of the Durant judgment... [and] produce guidance with a greater emphasis on what is covered than what is not," said the ICO.

The case that sparked this new guidance was brought by Michael Durant after he asked the Financial Services Authority (FSA) to investigate a dispute with Barclays Bank.

Mr Durant was not informed of the result of the investigation after it was closed in 2001 due to confidentiality restrictions. Following an unsuccessful application to the FSA for release of the information, Mr Durant then sumitted his request to the Court of Appeal under section 7 of the DPA 1998, claiming it was personal data that related to him.

But the court ruled that just because a document contained his name it was not necessarily defined as personal data.

The ICO said that the Court of Appeal ruling in this instance "was widely understood to have adopted a rather narrower interpretation of 'personal data' and 'relevant filing system' than most practitioners and experts had followed previously".

The new guidance states that many kinds of information can count as personal data, even in situations in which people may not consider it to be so. For example, information could count as personal data even if it does not include a person's name.

It also points out that there will be cases where it remains uncertain if data can be regarded as personal data, and that common sense should be used in these instances.

"There will be circumstances where the data you hold enables you to identify an individual whose name you do not know and you may never intend to discover," said the guidance. "Similarly, a combination of data about gender, age, and grade or salary may well enable you to identify a particular employee even without a name or job title."

The new guidance only applies to the processing of personal data. The ICO said that it will issue guidance on the meaning of 'relevant filing system' – another key part of the Durant case – in the near future.

As for Mr Durrant's case, after the House of Lords refused Mr Durant leave to appeal in November 2005, he has now taken his case to the European Court of Human Rights.

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!