Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Select an area of expertise to find out more about our experience.
Find out more about our barristers and business support teams here.
Driver v Crown Prosecution Service [2022] EWHC 2500 (KB)
In Driver the Claimant complained that the CPS had sent an email to a member of the public which confirmed that a charging decision was to be taken in respect of himself. He claimed damages for breaches of the GDPR or in the alternative Part 3 of the Data Protection Act 2018 (concerning law enforcement processing), misuse of private information (“MPI”) and breach of Article 8 of the Human Rights Act 1998.
Mr Driver had been involved in Lancashire politics for many years. An investigation was undertaken into potential fraud at Lancashire County Council, but after two years he was no longer a suspect, which he announced by public press release. However, allegations were made that he had conspired to pervert the course of justice and intimidate witnesses for which he was arrested with three other suspects. There was a judgment (in another case) that put the events into the public domain and the events were reported widely in the press, from which the court concluded that any reasonable reader would have understood that a charging decision was to be made by the CPS about the Claimant. A member of the public wrote to the CPS about the case and in response the CPS confirmed, without reference to any names, a charging file was with the CPS for consideration. That member of the public publicised the information.
An issue in the case was whether the CPS’s response amounted to processing personal data. The court found it did. The Claimant could be indirectly identified. Given the small group of suspects, and the fact that the Claimant was one of those suspects, the email about a charging decision in relation to those suspects was “obviously about” him.
Striking about the case is that in relation to the processing, the CPS did not lead any evidence from the writer of the email, substantially hampering the CPS’s ability to meet the burden of showing that disclosure was necessary to process this data for a legitimate interest (i.e. a pressing social need). There was also no evidence from the CPS that it had in place appropriate organisational measures to protect against unauthorised or unlawful processing. The case firmly demonstrates the need to justify processing by evidence, even in law enforcement processing.
The MPI claim failed, with time for the Article 8 claim not being extended because on the substance was bound to fail for the same reasons as the MPI claim. The investigation had been widely reported, the Claimant had volunteered information into the public sphere about his association with the investigation, a court judgment had been published and it was “blindingly obviously” that the Claimant would have known that a charging decision would be taken. Consequently, there was no objective reasonable expectation of privacy.
Finally, for a “very modest degree of distress” Mr Driver was awarded £250. Mr Driver was unable to prove his visits to the GP for anxiety and depression were for the disclosure, as opposed to being subject to investigations for the preceding six years. It is sensible to be alive to what damage can truly be attributed to the processing as opposed to other surrounding factors.
Judgment: click here
A monthly data protection bulletin from the barristers at 5 Essex Chambers
The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.
