The decision of the Court of Appeal in Johnson v Medical Defence Union (MDU) [2007] has established a limit on the extent to which data protection principles will be allowed to affect decision-making processes that involve a mix of human judgement and computerised systems.
The case concerned the termination of Johnson’s professional liability cover after the application of the MDU’s standard risk management policy. That policy was to assign a ‘seriousness’ score to each file opened for the member on the basis of the type of allegation or the advice sought by the member. No attempt was made to assess the merits of complaints to see whether they were well-founded.
