The decision of the Court of Appeal in Johnson v Medical Defence Union (MDU) [2007] has established a limit on the extent to which data protection principles will be allowed to affect decision-making processes that involve a mix of human judgement and computerised systems.

The case concerned the termination of Johnson's professional liability cover after the application of the MDU's standard risk management policy. That policy was to assign a 'seriousness' score to each file opened for the member on the basis of the type of allegation or the advice sought by the member. No attempt was made to assess the merits of complaints to see whether they were well-founded.

In this case, Dr Roberts of the MDU reviewed the 19 files that had been opened on Johnson. A summary of the subject matter of each file was entered in an electronic risk assessment form and assigned a score by Dr Roberts. The subsequent decision-making process was based on the total 'score' in this form, known as a 'risk assessment review (RAR) form'.

Johnson's complaints were framed under the Data Protection Act 1998 – he attacked the fairness of the data processing, which he said was being carried out in the above process.

At first instance, it was held that the selection of information (from manual, microfiche and computer files) by Dr Roberts and her inputting the material into the RAR form was 'processing' under the Act, but that the processing had been carried out fairly.

The Court of Appeal, in a majority decision (Lord Justice Arden dissenting), departed from that analysis, and in a decision which significantly restricts the scope for complaints of unfair processing under the Act, the majority held that selection of material to be entered into the computerised RAR form was not the 'processing' of 'data' to which the Act applied, because the selection of the material was an act of human judgement.

Lord Justice Buxton, giving the leading judgment, held that Dr Roberts' actions were a series of different acts, only some of which amounted to processing of data – for instance, the recording of the information in the RAR form, and the transmission of the form to the relevant committee. Looked at in isolation, none of the acts of processing was itself unfair. The only source of possible unfairness lay in the decisions taken in the mind of Dr Roberts as to what to type into the RAR form. Once she had reached those decisions, the typing of that information, emailing of the document and so on could do nothing to add or subtract to any unfairness in the procedure.

The selection of the information to enter was not carried out by automatic means and the data was not part of a 'relevant filing system'; therefore the fairness requirement in the First Data Protection Principle did not apply to that stage of the procedure.

As Lord Justice Longmore said: "To my mind, when an individual decides what information to put into an automatic system, he or she is not automatically processing that information at all, either partly or wholly. An exercise of judgement by an individual is not automatic at all. Indeed it is the antithesis of automacity."

Johnson's case amounted to a complaint that the MDU's cover review policy was unfair because it did not take into account the right factors (such as whether complaints were well-founded), and/or did not consult him in the decision-making process to give him a chance to explain why those matters did not make him a risk. The Court of Appeal rejected this attempt to construct, on the back of the Act, what would have amounted to a private law equivalent of the public law duties of proper administration.

Buxton pointed to examples of the anomalies which would result if processing of data were given the wider meaning contended. For example, reservations and appointment lists are routinely held on computers, which involves entering the personal data of customers. If the decisions made every day in hotels, doctors' surgeries and barbers on the allocation of rooms or appointments are to be treated as processing of data, the data controller would have to answer for the fairness of the allocation under the first Data Protection Principle.

The Court of Appeal's decision makes it clear that, in cases where the data does not form part of a relevant filing system, the Data Protection principles will not apply to the whole of any process which involves the use of a computer at some stage – which means most business processes. Application of the judgment will involve a careful consideration of 'unfairness' complaints made under the Act to determine whether the potential for unfairness really stems from data prooessing steps, or rather from human actions and decisions taken outside the automated steps of the process.