The legal right to access personal data

A critical analysis of the English and Welsh Courts application of the right to access in the 1984 and 1998 Data Protection Acts, set alongside the expectations of the law makers, to establish whether the Courts have diluted the intention of the executive.

This report considers the meaning of the legal right to access personal data, hereafter known as, the right of access, from a Data Controller [1].  The report will analyse the intention of the lawmakers in the development of the right.  The analysis will use the Data Protection Act 1984 [2] as a starting point (the 1984 Act), and the 1998 Data Protection Act (the 1998 Act) [3] as the concluding legislative reference on the introduction of the General Data Protection Regulation [4] (the GDPR) in 2018.

The report will give weight to the decisions of the English and Welsh Courts on matters relating to the right.  The analysis will determine whether there has been a dilution of lawmakers intention in the application of the right.

THE APPROACH

The analysis follows through the determination in English and Welsh Courts from cases arising from the right of access.  The report then sets aside that judgement alongside the known and validated view of the lawmakers to establish a correlation between the executive and the judiciary.  The analysis, whilst unable to apply an ‘algorithmic’ approach to determining the correlation between the executive and judiciary research, provided an approach that this paper follows:

Establish the political and legislative context that framed the 1984 and 1998 Data Protection Acts. This will be found in Chapter 3 and sets the context, but moreover, provides the report with a legislative benchmark in which to assess judicial interpretation later in the report.  This Chapter analyses the stated view of the lawmakers to developing the 1984 and 1998 Acts which the report shows provides direction to the judiciary in future cases.

Undertake an analytical assessment of the seminal Durant[5] case to determine the judicial interpretation of the right set aside the 1998 Act, Information Commissioner guidance, and the developing EU perspective. Chapter 4 provides a critical assessment of Durant, sets aside the reports legislative benchmark, provides an analysis based upon the reaction of lawmakers to that landmark judgement, and provides an assessment against the report question of

Undertake an analytical assessment of past case law, to determine the judicial interpretation of the right set out in the analysis of the judgement in Durant, the 1998 Act, the Information Commissioner guidance and the developing EU perspective. Chapter 5 provides evidence of judicial revising of Durant through later cases to provide a greater correlation between the judiciary and the lawmakers.

A concluding chapter, Chapter 6 which determines the judicial correlation between the right and legislative intent. To assist in that concluding the analysis will focus on three areas of the right of access and the judicial interpretation to make this judgement.  These are:

• The definition of Personal Data concerning the right of access.
• The inclusion of manual data in the right of access.
• The proportionality element of the search for personal data in the right of access.

Read the paper here. [This link will open a PDF document]

[1] As defined in General Data Protection Regulation [2016] OJ 2 119/33 Art.4.7.
[2] Data Protection Act 1984, s 35.
[3] Data Protection Act 1998, s 29.
[4] General Data Protection Regulation [2016] OJ 2 119/33.
[5] Durant v FSA [2003] EWCA Civ 1746.