In a decision handed down on 15 June 2018 (TLU and others v Secretary of State for the Home Department [2018] EWCA Civ 2217) the Court of Appeal dismissed the Home Office’s appeal against findings of liability for misuse of private information and for breach of the Data Protection Act 1998 (“the 1998 Act”).
The claims arose from the accidental online publication of a spreadsheet that formed part of the immigration family returns process. The appeal was concerned with findings made in relation to two of the six claimants, TLU and TLV. TLU and TLV were not themselves named in the spreadsheet, but were respectively the wife and daughter of the lead claimant, TLT, who was.
Background
In October 2013 the Home Office published online periodic data on what is known as the family returns process (ie the return of family members who have failed in their asylum applications). By mistake, the webpage included not only generic data but also a link to a downloadable spreadsheet containing the personal data of 1,598 lead applicants for asylum/leave to remain.
The spreadsheet remained available online for almost two weeks before the error was discovered and it was removed. During that period it was accessed on 27 occasions in the UK by non-Home Office IP addresses and on one occasion in Somalia. It was then uploaded to a US website where the webpage containing it was accessed on a further 86 occasions before being taken down nearly a month later.
The six claimants were all asylum seekers. Four of them, referred to by SSHD as “primary claimants” were lead family members who were named in the spreadsheet. In respect of them, liability for misuse of private information and for processing of data in breach of the first, second and seventh principles of the 1998 Act was admitted. It was further accepted that, subject to proof, damages were recoverable by those four claimants for distress both at common law and, following Vidal-Hall v Google Inc, under section 13 of the 1998.
Liability in relation to the other two – TLU and TLV (respectively the wife and daughter of TLT) – was disputed. SSHD referred to them as “secondary claimants” because they were not named in the spreadsheet.
The claims made by TLU and TLV relied on information entered on Row 1101 of the spreadsheet in relation to TLT. This consisted of a Home Office reference number, identification of TLT by forename and surname, a statement that his nationality was Iranian, his date of birth, and his age. It also stated that assisted return was being pursued. As to “removal case type” the spreadsheet stated “Family with Children – Voluntary”. It also acknowledged that asylum had been claimed.
Judgment at first instance
The issue on liability before Mitting J at first instance was whether TLU and TLV, as so-called “secondary claimants”, could, subject to proof of ‘distress’, recover damages at common law or under the 1998 Act.
The Judge answered this question with a firm “yes” ([2016] EWHC 2217 (QB)). He was satisfied that TLU and TLV could sue for both the common law and statutory torts. He expressed the position as follows:
“ …The family returns process had, as its object, the return of families with children under 18 who no longer had leave to be in the United Kingdom to their country of origin. The data collected related to that process. It was collected under the name of a lead applicant, in this case TLT….but it applied to all of them. The fact that they had claimed asylum with TLT was just as much private and confidential information about them as it was about him. Their identity could readily be inferred from his name, as could the general area in which, like him, they lived in the United Kingdom. Further, the Home Office held personal data similar to that held about TLT. [12]”
The Judge continued:
“This data was ‘used’ and therefore processed by transferring some of it – the fact that TLT had family members, including children who had claimed asylum and had reached a particular stage in the family returns process – to the spreadsheet. It was then further processed by the disclosure produced by the posting of the spreadsheet to the Home Office website. Anyone with knowledge of the family, by reference to TLT’s name, would be able to identify them. They were not anonymised or, in Scots legal terminology, ‘Barnardised’, so as to render dissemination of statistical information about them permissible because it was no longer personal data….. The processing of data in the name of TLT about his family members was just as much the processing of their personal data as his. Further, and for the same reasons, such processing also misused their personal and confidential information. TLU and TLV are therefore entitled to bring their claims and to be awarded damages, if appropriate, as is TLT on the same legal basis as him.”
Accordingly, Mitting J found the Home Office liable to all six claimants in both misuse of private information and for breach of the 1998 Act. Applying these principles to each claimant, Mitting J made awards ranging from £2,500 to £12,500, amounting to £39,500 in total. TLT (a “primary claimant”) and TLU (his wife, a “secondary claimant”) were each awarded damages of £12,500. Their teenage daughter, TLV, was awarded £2,500, having been protected by her youth and by the care which her parents took to shield her from knowledge of what was happening.
SSHD appealed, contending among other things that the Judge was wrong to hold that the data on the spreadsheet was TLU’s and TLV’s personal data within the meaning of the 1998 Act and was not their private or confidential information. None of the Judge’s findings of fact were disputed. TLU and TLV responded, maintaining that the Judge’s decisions should be upheld for the reasons that he gave, and with the further, interesting contention that, even if the data were not their personal data, they still had a right to compensation under section 13 of the 1998 Act. They argued that this right arose because section 13 provides for a right to compensation to “an individual” who suffers distress by reason of any contravention of the 1998 Act, and was not confined merely to a “data subject” who so suffers. (An appeal application by SSHD for permission to appeal on quantum was refused.)
The Appeal
The appeal was heard by Gross, McFarlane and Coulson LJJ Gross LJ, described the principal issues as follows:
- Did the spreadsheet contain TLU’s and TLV’s private and/or confidential information?
- Did the spreadsheet contain TLU and TLV’s personal data?
- Even if the information on the spreadsheet did not contain TLU’s and TLV’s personal data (but only that of TLT) are they in any event entitled to damages for the distress they suffered under section 13 of the 1998 Act for the admitted contravention of TLT’s rights.
In relation to Issue (1), the Home Office argued that Row 1101 of the spreadsheet contained information relating to TLT but did not convey anything about TLT or TLU. The fact that they were involved in the family returns process was not disclosed by Row 1101 and could only be derived from extraneous data. Accordingly, the number of potential claimants should be limited to the 1,598 lead applicants and should not extend to an unknown number of other family members. A “robust and realistic” approach was required. The names were either on the spreadsheet or they were not. TLV and TLU were not named on the spreadsheet and accordingly no private information relating to them had been misused by posting it on the Home Office website.
For TLU and TLV, it was argued that the short answer to the point was that the spreadsheet contained quarterly statistics for the “family returns process” and that their identities could readily be inferred from the information published in the spreadsheet. There was no serious dispute that they had a reasonable expectation of privacy or confidence in the information in question.
In relation to Issue (2), the Home Office argued that the words “relate to” in the definition of “personal data” in section 1(1) of the 1998 Act should be interpreted narrowly. The data in the spreadsheet did not “relate to” TLU or TLV on a true construction of those words. A narrow construction was called for, among other things, to permit straightforward compliance with subject access requests under section 7. There was no warrant for extending the meaning of those wordsto cover “implied data”. Particular reliance was placed upon the decision of the Court of Appeal in Durant v Financial Services Authority [2004] FSR 573.
For TLU and TLV, the argument was a straightforward one: was there information on the spreadsheet about TLU and TLV? The answer of “yes” was equally simple and compelled the conclusion that the information on the spreadsheet related to them. No question of “implied data” arose: the identities of TLU and TLV were ascertainable from the spreadsheet, as family members of TLT. There was no particular difficulty in locating personal data relating to an individual asylum applicant in a family returns process, not least because of the common family reference number.
Issue (3) arose for consideration only in the event that TLU and TLV failed on issues (1) and (2). In relation to Issue (3), TLU and TLV contended that, under section 13, any individual who suffers distress by reason of a contravention of the requirements of the 1998 Act is entitled to compensation. That individual does not have to be the subject of the unlawfully processed data. Accordingly, even if the spreadsheet did not contain TLU’s or TLV’s personal data, each could recover compensation as a result of the significant distress suffered because of the admitted contraventions in relation to their husband/father TLT.
The judgment of the Court of Appeal
Gross LJ with whom the rest of the Court agreed, held as follows:
On Issue (1) (at [31]): that the detailed information in the spreadsheet concerning TLT as the lead family claimant, in the context of the family returns process, meant that TLU and TLV could readily be identified by third parties. It followed that despite the fact that their names did not appear in the spreadsheet, it still contained information relating to and about them, and, as was admitted in the case of TLT, TLU and TLV had a reasonable expectation of privacy in respect of their information in it, which went to their identities and claims for asylum. Accordingly, the Court had “no hesitation” in holding that the Home Office’s publication of the spreadsheet misused TLU’s and TLV’s private and confidential information, and dismissed the appeal on the issue.
On Issue (2), Gross LJ began (at [32]) by stating that it would be surprising, on the facts, if the conclusion on this issue differed from Issue (1), and went on to explain that he had “no real doubt in coming to the same conclusion, albeit by a somewhat different route”. He went on to state (at [35]) that the Home Office submissions faced “insuperable hurdles” and that “the strength of the argument is overwhelmingly the other way”.
For data to comprise “personal data” it must “relate to” a living individual “who can be identified”, either directly (under limb (a) of the definition) or indirectly, by way of other information in possession of the data controller (under limb (b)). In relation to TLU and TLV, the indirect identification requirement was clearly satisfied ([38]). Unless driven to read the words “relate to” in some strained manner, the natural meaning of the statutory language pointed to the Home Office possessing data and other information relating to TLU and TLV, from which they could be identified. In this regard, he said:
“It can hardly be said that information as to the identity of TLU and TLV, together with the fact that they claimed asylum, is capable of being other than data ‘relating to’ them. To put it colloquially, it was about them. As a matter of statutory language and without more, I would therefore be minded to reject [the Home Office’s} key submission on this Issue” ([39]).
Durant did not assist the Home Office on the appeal. To the contrary, properly applied, it powerfully reinforced their case – namely that the spreadsheet contained data which related to them and from which they could be identified directly or indirectly, and thus comprised their personal data ([44]). Accordingly, the appeal on Issue (2) was also dismissed.
As to Issue (3), Gross LJ noted that this was potentially an issue of some nicety. Since, however, it only arose for decision in the event that TLU and TLV failed on Issues (1) and (2), and they had, in fact, succeeded, it was left for resolution to a case where a decision in relation to it was required and he declined to express a view ([48]).
Comment
The outcome of this appeal is an unsurprising one. In particular, the argument that the data contained in the spreadsheet was not the “personal data” of TLU and TLV applying the definition in s1(1) of the 1998 Act seemed doomed to fail from the outset.
In this regard, the high point for the Home Office was that the Court of Appeal was obliged to grapple with Durant, well-known to practitioners for its apparent (but, so we are repeatedly told, misunderstood) attempt to limit the definition of personal data to information which: (1) “is biographical in a significant sense”; and (2) has the putative data subject “as its focus”. Even more helpfully for the SSHD, Auld LJ at [27] stated that “it is likely in most cases that only information that names or directly refers to him will qualify [as personal data]”.
Unfortunately for the Home Office, Gross LJ found himself unable to accept that Auld LJ was “doing more than state a broad, practical working assumption” ([42]). In any event, he said, the data in the spreadsheet did, by inference, directly refer to TLU and TLV. The best that can be said about this is that the distinction between, on the one hand, a direct reference by inference and, on the other, an indirect reference, is clearly an issue of great subtlety which only greater minds than mine can discern.
The outcome would have been the same under Article 4 of the GDPR and section 3 of the Data Protection Act 2018, with the definition of “personal data” expanded to include information relating to individuals who can be identified directly indirectly by reference to an identifier such as a number.
The interesting argument raised on Issue (3) has not expired with the repeal of the 1998 Act. Article 82(1) of the GDPR provides that “Any person who has suffered … damage as a result of an infringement of this Regulation shall have the right to receive compensation”. Accordingly, it remains ripe for determination another day.
Lorna Skinner is a barrister at Matrix Chambers, specialising in media and information law.
Reblogged this on World4Justice : NOW! Lobby Forum..