2023/16 Sheriff’s Court considers the ‘legal proceedings’ data protection exemption (UK)

Ali Vaziri

Ali Vaziri is a partner at Lewis Silkin LLP

2023/16 Sheriff’s Court considers the ‘legal proceedings’ data protection exemption (UK)

A decision of the Sheriff’s Court in Dunfermline, Scotland has applied a wide interpretation of the legal proceedings exemption to data protection obligations in the context of use of a non-party’s personal data in the Employment Tribunal (ET).

Summary

Background and facts

The claim was brought by Mr Riley against his ex-employer. Riley complained that his personal data had been used by his ex-employer when defending itself in Employment Tribunal proceedings brought against it by another former employee, ‘A’. Riley had been A’s line manager and in those Employment Tribunal proceedings A had made various allegations about Riley’s behaviour, including that he had used derogatory language that referred to A’s disability. A was successful in his claim. Riley was referred to 162 times in the ET’s written decision. That decision was subsequently reported in an online article published by The Sun newspaper where Riley was named six times.As a result, Riley claimed £75,000 for his ex-employer’s failure to comply with the UK General Data Protection Regulation (‘UK GDPR’). The claim was for anxiety/distress and loss of employability caused by his ex-employer’s alleged failure to take the following steps:

tell him about the ET proceedings;
provide him with copies of the bundles of documents referred to in court;
ask him to comment on the allegations made against him; and
invite him to provide a witness statement.

Riley said that his ex-employer’s failure to take these steps constituted breach of its duties, as a data controller, to process his personal data fairly and transparently (Article 5(a) UK GDPR) and in a way that is compatible with the purpose for which it was collected (Article 5(b) UK GDPR).The ex-employer’s defence was that it was exempted from those duties in reliance on the legal proceedings exemption (paragraph 5(3) of Schedule 2 to the Data Protection Act 2018). This exempts a controller from complying with various ‘listed’ provisions – including fairness and transparency, as well as purpose limitation – where disclosure of the personal data is necessary for the purpose of, or in connection with, legal proceedings, or is otherwise necessary for the purposes of establishing, exercising or defending legal rights.However, a controller is exempted only to the extent that applying the ‘listed’ provisions would prevent the disclosure from being made. Riley argued that this meant that a data controller must attempt to comply with those provisions before seeking to rely on the exemption. This would be by undertaking a two-stage evaluative process: (1) assess what the requirements of fairness and transparency demanded in the circumstances; and (2) only seeking to rely on the exemption if those steps would prevent disclosure. It would be an inherently fact-sensitive exercise.

Judgment

The Court rejected this argument. Instead, it found that the ex-employer was exempted from even attempting to apply the ‘listed’ provisions because any evaluative process would have the potential of inhibiting a party’s conduct of the litigation. Even if the process were narrowed simply to informing Riley that his personal data was to be used, the Court considered that requiring a litigant to undertake a process of identifying what action is necessary creates the mischief in itself, regardless of what steps are ultimately identified and how limited or extensive they might turn out to be.It held that a central tenet of an adversarial system, and therefore a vital characteristic of a fair hearing, is the right of a party to prepare and present its case as it deems fit. This includes when it comes to choosing who to call as a witness (in this case, it is notable that Riley was an alleged wrongdoer). Any process of seeking to comply with fairness and transparency, including through the steps identified by Riley, had the potential to impinge on a litigant’s right to a fair trial, and the purpose of the exemption was to ensure that the data controller’s duties do not impinge on that right.

Commentary

The outcome in this case is not altogether unexpected taking into account the far-reaching consequences to the adversarial process were a litigant required to undertake the two-stage process proposed – a point acknowledged by all involved. However, whether (and, if so, the extent to which) this reasoning can be read over to other situations where this exemption is engaged, or indeed to the application of other prejudice-based exemptions remains to be seen. Either way, it provides a nuance to the exemption which will be useful to controllers embroiled in litigation in that it suggests a very wide interpretation.Some points perhaps to note:

Whilst the legal proceedings exemption exempts a controller from many provisions in the Data Protection Act 2018, it will still need to comply with the lawfulness requirement. This includes having a lawful basis for the processing. Whilst in this case there was some debate about the correct lawful basis given that the ex-employer had mistakenly sought to rely on ‘vital interests’, it was conceded that the disclosure was lawful on a different basis.
The word ‘necessary’ is often overlooked when it comes to applying the various exemptions (and indeed much of the Data Protection Act 2018) – this requires that whilst the processing does not have to be essential, it must be a targeted and proportionate way to achieve the purpose. That was not a matter of dispute in this case, but worth keeping in mind.

Whilst the decision is interesting from a data protection perspective, it raises another big issue. The claimant in this case was attempting to grapple with the thorny issue of what happens when someone who is not involved in the litigation, and may know nothing about it, is referred to in the course of the proceedings and a resulting judgment. This is not unusual, especially in employment claims, but it can cause significant damage to that non-party’s rights and interests. As was seen here, the information can generally be republished without any legal recourse for the non-party, and is likely to become a matter of permanent public record, indexed by search engines.Making such information available about a non-party is likely to engage procedural rights at common law (i.e. a duty of fairness) and under Article 8 of the European Convention on Human Rights (ECHR) (right to a private and family life) given that reputation is an aspect of an individual’s right to personal autonomy protected by the ECHR. But at the same time, documents filed in proceedings are covered by the open justice principle and rights under Article 10 ECHR (freedom of expression). These issues were not touched on in the decision though the judge did refer to rule 50 of the Employment Tribunal Rules and the power to anonymise a judgment even after proceedings have concluded. The 2021 Employment Appeal Tribunal decision in the case of TYU – v – ILA Spa Ltd (EA-2019-000983-VP)[1] suggests that it is likely to be easier for individuals who are not a party to or a witness in the proceedings (and so had no expectation that they might be named in a public judgment) to secure such an order, as compared to the parties themselves.In this case, rather than attempt to put the genie back in the bottle by asking the ET to anonymise the judgment, the claimant chose instead to pursue a damages claim against his ex-employer. This strategy backfired and, as a result, there are now two available judgments publicly recording his behaviour instead of just one.

Comment from other jurisdiction

Romania (Teodora Manaila, Suciu – Employment and Data Protection Lawyers): The case displays an interesting crossroad between data processing (protection) and employment litigation. From a judicial perspective, it is worth noting that being named in a court case will bear no reputational risk in Romania as all case decisions are anonymized when indexed in the legal database by the court. Only the parties involved have full access to the identification data (name, surname) of any third party mentioned in the case file.In the context of advancing means of data processing, where the lifespan of data, particularly online data, is far longer than before, by applying the necessary principle mentioned by Mr. Vaziri to determine the purpose such public disclosure serves it may be concluded that a change of the standard publication practice is required. While we acknowledge that the option of separately requesting such anonymization is a viable option it only serves to resolve the effect, the impossibility of the third party of effectively being informed of such appearance in a pending litigation record remains the thorny issue.Though the United Kingdom has left the European Union, for the remaining EU members, the conclusions of the ECJ in case C 268/21 have to be taken into consideration when preparing any court strategy. While the decision focuses on the role of the court to perform a proportionality analysis that takes into account the interests of data subjects whose personal data are to be processed and balance them in relation to the interest of the parties to the procedure to obtain evidence, such considerations can also be extended to the parties involved.

Subject: Right to privacyParties: Riley – v – The Student Housing Company (OPS) LtdCourt: Sheriffdom of Tayside, Central and Fife at DunfermlineDate: 8 February 2023Case reference: [2023] SC DNF 8Internet publication: 2023scdnf8fae89516bca348848ab8c891d393b6c3.pdf (scotcourts.gov.uk)

Notes

[1] https://www.bailii.org/uk/cases/UKEAT/2021/2019_000983.html.

Onderwerpen

Download citeerwijze bij dit artikel

Auteursinformatie

Rechtbank Amsterdam ECLI:NL:RBAMS:2019:10052

AR Updates

Rechtbank Noord-Holland ECLI:NL:RBNHO:2018:7395

Gerechtshof 's-Hertogenbosch ECLI:NL:GHSHE:2019:780

ECJ 15 May 2025, case C-623/23 Melbán, Fixed-term work, Gender discrimination

EELC Updates

Ondernemingskamer Gerechtshof Amsterdam ECLI:NL:GHAMS:2021:1310