In Johnson v Medical Defence Union the Court of Appeal has dismissed an appeal against a decision rejecting a claim by an orthopaedic surgeon that the Medical Defence Union (MDU) had unfairly processed his personal data. The claim centred on the MDU's risk management policy, which involved a risk manager manually selecting information from files relating to complaints made about the surgeon and putting the selected information onto a computer. The surgeon argued that the manual selection was unfair because, according to the policy, his views and explanations were not taken into account. The case is of most interest in relation to the court's construction of what constituted "processing" for the purpose of the Data Protection Act 1998, with the majority of the Court of Appeal taking the view that risk manager's manual selection of the files did not amount to processing.