MR JUSTICE WARBY
Approved Judgment
NT1 & NT2 v Google LLC
Some key points of data protection law
22.
The DP Directive and the DPA impose duties on “data controllers”, that is to say
those who make decisions about how and why “personal data” relating to “data
subjects” is “processed”. “Personal data” is a broad notion, comprising a wide range
of information which relates to an individual and is processed by computer.
“Processing” is a very widely defined concept, encompassing almost any dealings
with personal data, including holding the data and disclosing it or the information in
it: see DPA s 1(1). The statutory duty imposed on a data controller by DPA s 4(4) is,
subject to section 27(1),
“… to comply with the data protection principles in relation to
all personal data with respect to which he is the data
controller.”
23.
The data protection principles are listed in DPA Schedule 1. The principles relied on
by the claimants are the First, Second, Third, Fourth, Fifth and Sixth (of eight):
“1. Personal data shall be processed fairly and lawfully and, in
particular, shall not be processed unless—
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the
conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more
specified and lawful purposes, and shall not be further
processed in any manner incompatible with that purpose or
those purposes.
3. Personal data shall be adequate, relevant and not excessive
in relation to the purpose or purposes for which they are
processed.
4. Personal data shall be accurate and, where necessary, kept
up to date
5. Personal data processed for any purpose or purposes shall
not be kept for longer than is necessary for that purpose or
those purposes.
6. Personal data shall be processed in accordance with the
rights of data subjects under this Act.”
24.
The term “sensitive personal data”, which appears in the First Principle, is defined by
DPA s 2 and includes:“… personal data consisting of information as to ... the data
subject [‘s] —
…
(e) … physical or mental health or condition …
…