Liability For Misuse of Private Information

This is a timely reminder of the steps organisations should be taking when dealing with personal data, and gives a useful indication of the extent of an organisation's liability in this area.

ST (A Minor) v L Primary School

ST had been enrolled in to Year 5 at L Primary School and started there in February 2013. She had Down's Syndrome and was in receipt of a Statement of Special Educational Needs. The school put a detailed support programme in place for her.

In February and March 2013, the school recorded a number of incidents involving ST's behaviour, including trying to bite, kick and pull the hair of staff members and throwing objects across the room. There was then a 'major incident' on 13 March 2013, which had involved ST throwing objects, hitting legs and hands, and pulling hair.

The school was contacted by a number of parents who raised concerns about ST's behaviour.

On 14 March 2013, the school sent a letter about ST to all of the Year 5 parents (around 60 in total), in an attempt to reassure parents that staff were equipped to deal with the behaviour. The letter included ST's name, her year group and her disability, and referred to the fact that her behaviour could be regarded as "disturbing" and could lead to "safety" concerns.

After a number of further incidents in June and July 2013, the school concluded that it could not meet ST's needs and withdrew her place in July 2013.

ST's mother (RF), amongst other things, commenced County Court proceedings against the school on behalf of both herself and ST.

RF alleged she had not consented to the letter being sent, and that the sending of the letter therefore amounted to a breach of the Data Protection Act 1998 (as it then was), breach of the Human Rights Act 1998 and misuse of private information. This was disputed by the school.

Consent

Neither side could produce any contemporaneous evidence on the issue of consent. However the court found that, on the balance of probabilities, RF had not consented to the letter being sent.

Of particular relevance in this case was the fact that, when ST was enrolled at the school, her parents had signed a standard form in which they refused to allow ST's photograph or name to be used by the school, for example the school's website or in publicity material. As not all parents had done this, this was considered to be relevant since it showed that ST's parents were especially keen to protect ST's privacy.

The court held that the information in the letter amounted to sensitive personal data about ST, and that the 'processing' of that sensitive personal data in the letter was neither lawful, fair nor necessary. In particular:

• the Court had found that RF had not consented to the letter about ST being sent
• the school had not explored other alternatives that might have been available before sending the Letter
• the school had failed to balance the risks of potential harm to ST and her parents with the potential benefits of sending the letter

This part of the claim was relevant to ST only, as the letter did not contain any personal data of RF's. As there was no clear evidence that ST had been told about the letter and had been distressed by it, no award of damages was made in respect of this part of the claim.

Misuse of Private Information

However, the court also held that both ST and RF had a reasonable expectation of privacy about information in the letter, and that the disclosure of it by sending the letter could not be justified. The court therefore considered it appropriate to award compensation to ST and RF for the misuse of private information.

In assessing the level of damages, the court made specific reference to the case of TLT -v- Home Office (which analysed in some detail the amounts that could be awarded in these kinds of cases) and awarded:

• £1,500 to ST: this was to reflect the sending of the letter itself, as there was limited evidence of the direct impact on ST
• £3,000 to RF, which the court considered properly reflected the distress RF had suffered

Breach of the Human Rights Act

The court also declared that the school had infringed ST and RF's human rights, on the basis that:

• the information in the letter was protected by ST and RF's right to privacy and family life
• publication of this information in the letter was an interference with that right
• the interference was not justified

What Does This Mean for Your Organisation?

This case is a timely reminder that to ensure that you:

• Have proper and up to date records/audit trails in place to document consent that is given or withheld by data subjects regarding the use of their personal data. In this case, the school argued that RF had consented to the letter being sent, but was unable to provide any contemporaneous evidence to support this.
• Constantly review whether the way in which you are processing personal data is consistent with the consent that has been given/withdrawn, and/or is fair, lawful and necessary.
• Think about whether there are any possible risks of harm associated with the processing of personal data, and weigh these up against the benefits.
• Consider whether there are any alternatives available, especially in particularly sensitive situations.

It is also worth noting that the damages awarded in this case were relatively low. Whilst the amounts awarded will vary greatly from case to case depending on the specific private information in question and the distress (if any) caused to the claimant, the case is a useful example of how much these kinds of claims can be worth.

For specialist information law advice, please contact Ben Holt on 07715 048666, or complete the below form.