Smeaton v Equifax CA[2013] EWCA Civ 108

(b) if the data subject has notified the data controller of the data
subject’s view that the data are inaccurate, the data indicate that
fact.
43. Equifax is a data controller for the purposes of the DPA and it therefore has a duty to
comply with the data protection principles. The data appearing in Mr Smeaton’s
credit file was between 22 May 2002 and 17 July 2006 inaccurate in the respect
discussed above. Although it does not matter on the facts of this case, the judge was
wrong to regard the data as having been also inaccurate between 12 March 2001 and
22 May 2002. Mr Beresford’s acceptance that had Equifax known of the stay
imposed it would have removed the entry, which the judge inappropriately
characterised as “a concession”, was simply an explanation of Equifax’s usual
practice. The stay did not affect the existence of the order. The entry was accurate
until the order was rescinded.
44. The judge was also in my view wrong to regard the mere fact that the data had
become inaccurate and remained accessible in its inaccurate form for a number of
years as amounting to a “clearly established breach of the fourth principle” –
judgment paragraph 106. Paragraph 7 of Part II provides that the fourth principle is
not, in circumstances where the data accurately records [erroneous] information
obtained by the data controller from the data subject or a third party, to be regarded as
contravened if the data controller has, putting it broadly, taken reasonable steps to
ensure the accuracy of the data. A conclusion as to contravention cannot in such a
case be reached without first considering whether reasonable steps have been taken.
As the facts of this case show, that may not always be a straightforward enquiry.
Perhaps often it will and it may not therefore usually be difficult to establish a
contravention. Once it is concluded that reasonable steps were not taken in this
regard, a consumer may seek compensation under s.13. It will then be a defence for
the data controller to show that he had taken such care as in all the circumstances was
reasonably required to comply with the requirement concerned. It may be that that
enquiry is in substance no different from that required under paragraph 7 of Part II in
the limited class of case to which that paragraph refers. However it should be noted
that in cases not covered by paragraph 7 a contravention may be established without
consideration of the reasonableness of the steps taken by the data controller. In such a
case reasonableness would arise only if a defence were mounted under s.13(3).
45. The judge concluded that Equifax did not take reasonable steps to ensure the accuracy
of its data. In order to test that conclusion it is necessary to examine the legislative
scheme relating to bankruptcy orders.
Insolvency Legislation
46. The legislation relating to bankruptcy orders has been laid down by Parliament in the
Insolvency Act 1986 and by the Lord Chancellor (acting together with the Secretary
of State and the Lord Chief Justice) in the Insolvency Rules 1986 (as successively
amended). 2 As far as this appeal is concerned, the key features of the legislation are as
follows (save where indicated, these features have existed throughout the period from
2001 to the present day).
2 See s.412 of the Insolvency Act 1986