More clarity but no shortcuts with data protection: Johnson, an orthopaedic surgeon of some 20 years and of unblemished record, learned that his medical insurers, MDU, had declined to renew his insurance cover for 2002. He made a subject access request to see MDU’s files pursuant to Section 7 of the Data Protection Act 1998 (DPA).
It went to the High Court, which made a number of important findings:
– Documents that, individually, would not be regarded as ‘personal’ to Johnson could become so when viewed all together – an example being the log of calls made by Johnson to the MDU advice line.
Sign up to our weekly round-up of HR news and guidance
Receive the Personnel Today Direct e-newsletter every Wednesday
– Documents produced electronically or on word processors, but subsequently held in paper form alone, are not to be treated as if they are electronically held and easily accessible. The form in which the data is stored at the date of the request dictates the nature of the search.
– MDU had the right to remove names of its staff or other third parties identified in its files if those identities did not necessarily form part of Johnson’s personal data.
