One of the difficulties users and practitioners have with the Data Protection Act 1998 is that there is so little case law on any of the provisions, it can be very hard to know how a court will react to the complicated structure and often unusual factual scenarios which can throw up potential claims. There are two reasons why there is so little case law. First, most damages claims under the DPA go to the County Court, where unless you were in the case it is hard to know that it happened or get hold of a judgment. Secondly, most damages claims are for small sums, which is it is more cost-effective to settle than fight.
Neither of those problems applied in MXA v Hounslow LBC, West Berkshire Council, Taunton Dean BC & Wokingham BC (QBD, 4 June 2014, not yet reported), in which M had filed claims in the High Court against a series of local authorities alleging that they held inaccurate and damaging information about him (presumably under sections 10 and 14 DPA, although the limited report available does not make clear). The local authorities applied to strike out the claims, and M failed to attend the hearing. M also alleged a breach of Article 8 ECHR in the data handling.
The facts as summarised are regrettably common. Harrow received information alleging that the step-daughter of M, E, was being physically and sexually abused by M. M complained about records of allegations of sexual misbehaviour towards a child in 2007 set out in a police report, which he denied. Harrow passed the information to Wokingham when E moved into that area. Wokingham recorded and reviewed the material and passed it on to West Berkshire when E moved again. Further allegations received by West Berkshire were sufficiently serious to require an investigation. M had signed forms consenting to the sharing and collection of information. Care proceedings were later initiated.
Perhaps not surprisingly, Bean J granted the application to strike out. He held that the local authorities were conducting child protection functions under their statutory duties (see, for example, the Children Act 1989). In relation to the fifth data protection principle that personal data should not be held for longer than necessary, Harrow had received a recent complaint and had been provided with police records of convictions and other allegations. The duty of the local authorities, as the baton passed to each of them, was to keep those records for as long as necessary to ensure E’s welfare. The welfare investigation was at an early stage and the local authorities would clearly be acting in breach of their duty if they shredded the information. M could not argue that the information was so historic and uncorroborated that it ought to have been wiped and not disseminated. It had not been disseminated to the public, but passed only to local authorities where the family had lived.
Data controllers recorded a variety of information including allegations and mere suspicions due to the nature of the investigation. The suggestion that the information should not have been recorded unless the data controller was satisfied of its truth to a civil standard was unsustainable, as to which Bean J cited Johnson v Medical Defence Union  EWCA Civ 262;  1 Info LR 110. Any claim based on the fourth data protection principle that information should be accurate and up to date was met by para 7 of Part II of Schedule 1 as the purpose for which the data was obtained was child protection. Reasonable steps had been taken to ensure its accuracy and the record indicated those matters which M had said were inaccurate. M had twice signed forms consenting to the retrieval of medical and criminal records.
Moreover, M’s section 10 claim to prevent processing likely to cause damage or distress was excluded by section 10(2) and para 3 of Schedule 2, as the processing was necessary to enable the local authorities to comply with their statutory obligations. They were doing no more than performing a proper statutory function.
Bean J also struck out claims of negligence, held that Articles 3 and 6 ECHR were irrelevant, and that there was an interference with M’s Article 8 rights but that it was plainly proportionate in order to protect E.
All of which goes to show that the DPA does not stop public authorities carrying out their important duties, even where underlying facts or allegations are disputed, and that on the occasions where the DPA makes it to court the judges can be trusted to understand both the context in which the authority must operate and that the DPA is intended to recognise that context. Perhaps DPA users have nothing to fear but fear itself after all.
11KBW’s Timothy Pitt-Payne QC acted for West Berkshire Council.