Data Protection Doesn’t Do Oral Processing

We all sort of know that the Data Protection Act 1998 didn’t apply to stuff people say orally, don’t we? But pointing to an authority that said so is rather harder. Luckily, now we have one: Scott v LGBT Foundation Ltd [2020] EWHC 483 (QB).

The context was a sad one. Mr Scott was complaining about a situation in which he had gone to the LGBT Foundation for advice and therapeutic support. He had self-disclosed a number of matters to the staff there which indicated that he posed a serious risk to his own health and well-being. Internal advice was sought about departing from the usual confidentiality and because of a judgement that an intermediate safeguarding risk was posed, the Foundation spoke to Mr Scott’s GP to alert them of the issue and suggest follow up support be offered. The Foundation told Mr Scott this at the time orally, and in an email follow up. Communications with the GP were entirely verbal. A note of the concerns was made on Mr Scott’s GP file. Mr Scott was concerned that this information would be made available under vetting procedures for his employment, and that it had effectively ruined his career, although this appears to have been speculation at the time of the claim.

Sani J rejected a claim for breach of the DPA 1998. The DPA “does not apply to purely verbal communications”: at [55]. The reason is that data, as defined in section 1 and Article 2(1) of the Directive, needs to be recorded in electronic or manual form. Storage within someone’s mind, even with a view to later recording on a file, is not data within the DPA. Oral disclosures are protected instead by the law of confidence: at [56]-[63].

Sani J also held that the disclosure would in any event have met a Schedule 3 condition (any data being sensitive personal data in this context): disclosure was necessary to protect the vital interests of Mr Scott, because he was considered to be at material risk of self-harm, and been told that confidentiality might be overridden, and that there was no basis to apply a qualifier of “imminent” to the statutory test: at [65]-[72]. The DPA claim was struck out accordingly.

Mr Scott’s other claims were also struck out. Although a duty of confidence was owed to Mr Scott, it always had a qualifier attached to it that Mr Scott was aware of. They were not required to get his consent first, or to try and do so.  The Foundation was not a public authority for the purposes of the Human Rights Act 1998, and there was no reasonable expectation of privacy in the context to engage Article 8 ECHR either. If there was an interference, it was justified.

Robin Hopkins acted for the LGBT Foundation.

Christopher Knight