This is a timely reminder of the steps organisations should be taking when dealing with personal data, and gives a useful indication of the extent of an organisation's liability in this area.
ST had been enrolled in to Year 5 at L Primary School and started there in February 2013. She had Down's Syndrome and was in receipt of a Statement of Special Educational Needs. The school put a detailed support programme in place for her.
In February and March 2013, the school recorded a number of incidents involving ST's behaviour, including trying to bite, kick and pull the hair of staff members and throwing objects across the room. There was then a 'major incident' on 13 March 2013, which had involved ST throwing objects, hitting legs and hands, and pulling hair.
The school was contacted by a number of parents who raised concerns about ST's behaviour.
On 14 March 2013, the school sent a letter about ST to all of the Year 5 parents (around 60 in total), in an attempt to reassure parents that staff were equipped to deal with the behaviour. The letter included ST's name, her year group and her disability, and referred to the fact that her behaviour could be regarded as "disturbing" and could lead to "safety" concerns.
After a number of further incidents in June and July 2013, the school concluded that it could not meet ST's needs and withdrew her place in July 2013.
ST's mother (RF), amongst other things, commenced County Court proceedings against the school on behalf of both herself and ST.
RF alleged she had not consented to the letter being sent, and that the sending of the letter therefore amounted to a breach of the Data Protection Act 1998 (as it then was), breach of the Human Rights Act 1998 and misuse of private information. This was disputed by the school.
Neither side could produce any contemporaneous evidence on the issue of consent. However the court found that, on the balance of probabilities, RF had not consented to the letter being sent.
Of particular relevance in this case was the fact that, when ST was enrolled at the school, her parents had signed a standard form in which they refused to allow ST's photograph or name to be used by the school, for example the school's website or in publicity material. As not all parents had done this, this was considered to be relevant since it showed that ST's parents were especially keen to protect ST's privacy.
The court held that the information in the letter amounted to sensitive personal data about ST, and that the 'processing' of that sensitive personal data in the letter was neither lawful, fair nor necessary. In particular:
This part of the claim was relevant to ST only, as the letter did not contain any personal data of RF's. As there was no clear evidence that ST had been told about the letter and had been distressed by it, no award of damages was made in respect of this part of the claim.
However, the court also held that both ST and RF had a reasonable expectation of privacy about information in the letter, and that the disclosure of it by sending the letter could not be justified. The court therefore considered it appropriate to award compensation to ST and RF for the misuse of private information.
In assessing the level of damages, the court made specific reference to the case of TLT -v- Home Office (which analysed in some detail the amounts that could be awarded in these kinds of cases) and awarded:
The court also declared that the school had infringed ST and RF's human rights, on the basis that:
This case is a timely reminder that to ensure that you:
It is also worth noting that the damages awarded in this case were relatively low. Whilst the amounts awarded will vary greatly from case to case depending on the specific private information in question and the distress (if any) caused to the claimant, the case is a useful example of how much these kinds of claims can be worth.