Following a recent claim considering what private and personal information is 'necessary' to be included in a safeguarding referral to a local authority, Charlotte Clayson looks at what we can learn from the recent case of Ali v Chief Constable of Bedfordshire Police.
For the linked case of Ali v Luton Borough Council, please click here.
Background
Ms Ali brought a claim against Bedfordshire Police in respect
of its sharing of her private and personal information with Luton Borough Council. The case examines whether disclosure of all or part of that information was necessary and whether Ms Ali had a reasonable expectation of privacy in the information. Claims were brought for breach of Retained Regulation (EU) 2016/679, the UK GDPR, misuse of private information, breach of confidence and breach of Ms Ali’s right to respect for private and family life derived from Article 8 of the European Convention on Human Rights (ECHR). Mr Justice Chamberlain concluded that in all the circumstances, the disclosure was not necessary - Ms Ali’s claims for breach of the UK GDPR, breach of the Human Rights Act 1998, and the tort of misuse of private information succeeded, and damages were awarded. Written by Charlotte Clayson, partner at Trowers & Hamlins LLP.
Ali v Chief Constable of Bedfordshire Police [2023] EWHC 938 (KB)
What are the practical implications of this case?
This case considers the way in which information can be disclosed by public bodies in pursuit of their statutory duties. Is that sharing (in whole or in part) always ‘necessary’, or are there other ways in which information can be disclosed without providing specific personal data? Public bodies may have
to consider the public interest in sharing the information as against the public interest in maintaining confidentiality, particularly in circumstances where safeguarding of children or vulnerable adults is identified as an issue.
While a short judgment, practitioners will be particularly interested in the decision on causation and quantum, particularly in ‘but for’ cases, where actions of third parties may break the chain of causation. Even where that is the case, damages may still be awarded on the basis of the distress that would have been caused by the defendant’s actions alone.
What was the background?
Ms Ali had concerns that her ex-husband was dealing drugs and feared for the safety of both herself and her children. She made a report to Bedfordshire Police (the Police), but did so on the very clear basis that she did not want to be identified as the source of the information. The concerns for her privacy and safety were explicitly raised by her, and were also readily apparent in the way that she made the report. Assurances were provided as to her anonymity.
In the circumstances, the Police were obliged to make a safeguarding referral to the social services department of Luton Borough Council (the Council) and that referral identified Ms Ali as the source of the report. The report was then unlawfully downloaded by an employee of the Council and passed to Ms Ali’s ex-husband, causing Ms Ali considerable distress.
A claim was brought against the Police for breach of Retained Regulation (EU) 2016/679 (the UK GDPR), breach of Article 8 ECHR, breach of confidence, and misuse of private information. It was argued that while there was a statutory duty on the Police to make the safeguarding referral, it was not necessary to disclose Ms Ali as the source of the information, particularly where Ms Ali had repeatedly sought assurances that her identity would not be revealed, and went to great lengths to ensure that her identity was protected.
The court considered the following key questions:
- did the Police have a proper legal basis under the UK GDPR to disclose the information?
- was the sharing of Ms Ali’s name ‘necessary’?
- was there a reasonable expectation of privacy?
- did disclosure amount to a necessary interference with Ms Ali’s Article 8 rights?
What did the court decide?
UK GDPR
While the Police had a duty to pass Ms Ali’s report onto the Council, it was not ‘necessary’ for Ms Ali to be identified in the process, contrary to Article 6(1) of the UK GDPR (the judge considered both Articles 6(1)(b) and 6(1)(c)).
No-one within the Police had considered the issue of anonymising the report at the relevant time and the Police had failed to demonstrate during the proceedings any need to disclose Ms Ali’s identity, whether to ensure the accuracy, credibility, or quality of the relevant report, or otherwise.
In addition, the disclosure amounted to a breach of the data protection principles set out in Articles 5(1)(a) and 5(1)(b) of the UK GDPR.
Misuse of private information and breach of confidence
The judge dealt with both types of claim together, preferring to characterise the scenario in question as a misuse of private information claim. In the circumstances, there was clearly a reasonable expectation of privacy in the fact that Ms Ali was the source of the report. That reasonable expectation of privacy was not outweighed by any countervailing interests.
Article 8 ECHR
The disclosure amounted to an interference with Ms Ali’s Article 8(1) ECHR rights. The Police did not establish that such interference was necessary, and the disclosure was therefore contrary to section 6 of the Human Rights Act 1998.
Quantum of damages
Ms Ali’s distress arose from the unlawful access to and disclosure of the information on the Council’s systems by a third party, rather than the disclosure by the Police alone. While this criminal act broke the chain of causation, Ms Ali would nevertheless have suffered some distress had she been made aware that her identity had been passed to the Council. The Police would have been responsible for that distress - Chamberlain J could ‘see no reason why the Police should be better off than they would have been […] merely because of [the] subsequent criminal disclosure’.
Damages were awarded for breach of the UK GDPR, in the sum of £3,000 (in the bottom half of awards for ‘less severe psychiatric harm’).
Case details:
- Court: King’s Bench Division
- Judge: Mr Justice Chamberlain
- Date of judgment: 25 April 2023
This article was first published by Lexis®PSL on 24 May 2023.
