It now seems that "personal data" means one (narrow) thing when you're trying to get information which a government agency has about you, but quite another (broader) thing if you're being prosecuted for breaching data protetion laws. Surprise surprise...
Yes, this is oldish news (which I first read on Out-law), but I want to do my bit to publicise the discrepancy.
The Out-law article summarises the position, but basically when Michael Durant tried to use the Data Protection Act to get info held by the UK Financial Services Authority about him, the court said he had no right to it because merely mentioning a person in a document does not amount to “personal data” under the Data Protection Act, so they didn't have to give him the information (see this other article).
Yet when Jacqueline Rooney was prosecuted under the Data Protection Act for giving her sister information she had found using police computers about a police officer (who'd had a relationship with her sister), the court said that she had unlawfully disclosed personal data and she was convicted. She'd only told her sister that he'd moved, but not where he had moved to (according to this more detailed article).
Now I don't condone what she did and I think the result of that prosecution was the right one - people just shouldn't be able to use personal information held in government databases for their own private purposes. But I do think that Mr Durant should have been given access to the info about him held by the FSA - the court there should have had a wider view of personal data, as wide as the one in the Rooney prosecution, in fact. But, the court said what it did and the House of Lords refused to hear his appeal, so that's that (unless he's still appealing to Europe?).
The Out-law article points out:
"When it was someone looking for information from the FSA it was a narrow definition: the court said 'no, that is not personal information'," said Cullen. "But when it is a criminal case involving misuse of personal data the court used a very wide definition of personal data, which is interesting."
So, it seems there's one law for government and other organisations from whom we seek information about ourselves, and quite another for us mere citizens!
Tags:
No comments:
Post a Comment