It had to happen sooner rather than later: a case has reached the Information Tribunal that has required the Tribunal to consider head on what is “personal data” under the Data Protection Act 1998. To make matters less clear, the case was in fact an appeal under the Freedom of Information Act 2000 against the use of the section 40 (personal information) exemption.
A simple summary is that personal information has to be significantly biographical for it to be “personal data”. The Tribunal appears to have been highly critical of the Information Commissioner’s guidance as to what is “personal data”, suggesting that the guidance has broadened the scope of what was considered “personal data” by the Court of Appeal in Durant. See what you make of it here.
It’s depressing that nearly 10 years after the DPA was enacted, we still cannot get a determination of what it is all about.
