Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Riley v The Student Housing Company (OPS) Limited [2023] SC DNF 7
In Riley the Sheriff Court considered the data protection obligations on an employer in respect of his employee (Riley) when defending an employment tribunal claim brought by another employer, Mr Adamson. The case turned on the interpretation of UK GRPR Article 5(1)(a), (b) and paragraph 5(3) of Schedule 2 of the Data Protection Act 2018.
Riley sought £75,000 after the employer disclosed in proceedings brought by Adamson a number of matters which amounted to Riley’s personal data. Media coverage of the trial included six references to Riley by name, including that Adam “suffered at the hands of ex general manager Courtney Riley and his friends”. Riley’s argument was that the law requires an employer to take certain steps before making disclosure naming another employee in these circumstances the employe: should have told Riley about the tribunal proceedings; should have provided Riley with copies of the tribunal bundles; should have asked Riley to comment on the allegations; and should have invited Riley to provide a witness statement to the tribunal.
Article 5(1)(a) provides that personal data shall we processed lawfully, fairly and in a transparent manner. 5(1)(b) requires that they shall be processed for specified, explicit and legitimate purposes, and not processed for a manner which is incompatible with those purposes.
Paragraph 5(3) disapplies certain provisions where disclosure of the personal data is necessary for the purpose of legal proceedings “to the extent that the application would prevent the controller from making the disclosure”.
The Judge described the interpretation of Article 5(3) as being the “core issue in dispute”:
“What is the meaning of these words and how, if at all, do they qualify the exemption? Is their effect that the data controller must attempt to apply the listed GDPR provisions before seeking to rely on the exemption? This was the pursuer’s position. Alternatively, is the data controller exempted from even attempting to apply the listed GDPR provisions?”
The Judge held that the latter interpretation was correct. If an employer were obliged to consider additional disclosure of amendments to disclosure in legal proceedings, that would amount to preventing the employer from making the originally proposed disclosure.
Requiring an employer to go through the process suggested by Riley, including seeking a witness statement from the third party employee, would conflict with the employer’s freedom to run litigation in their own way. It may have the effect of obliging an employer to take a witness statement where it is contrary to its interests. It might limit the extent to which an employer can defend a claim brought against it. It might conflict with the right to a fair trial.
Separately, the Judge considered the test for causation in Article 82. The Court held that it is for a claimant to prove causation. Then the burden shifts to the defendant to establish a break in the causal chain. Article 82 does not create strict liability where a breach is established.
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
