Education Law – Child Protection and Confidentiality: Court Action and Data Protection Breaches

By : John McKendrick

This paper was given by John McKendrick at Veale Wasbrough on the 3rd May 2009. It attempts to provide a practical yet comprehensive guide for independent schools to help them better understand the litigation process.

1. Introduction

Despite following good advice and ensuring a rigorous adherence to the guiding principles of the Data Protection Act (hereafter “the Act” or “the DPA”) it is almost inevitable at some stage during the working life of a school bursar, a disgruntled parent or pupil will seek to take further action in relation to what they view to be an inadequate response to requests made under the Act.

Schools should be aware of the regulatory regime, the role of the courts, the procedures before those courts and the remedies available to claimants within the jurisdiction of the courts. They are significant.

This short paper attempts to provide a practical yet comprehensive guide for independent schools to help them better understand the litigation process.

2. Background

This paper considers what further action may be taken by a ‘subject’ i.e. someone who requests information from a data controller. For convenience, and given the context of this conference, this paper will often simply use the term ‘parent’ for the data subject (although in all likelihood the parent’s child will be the data subject, but parents are permitted to seek information on their behalf should they be too young to understand ) and the term ‘school’ for the data controller.

Parents may well remain dis-satisfied with the response provided by a school in relation to a data subject access request; the disgruntled parent, however, need not simply give in: the Act offers significant scope for actions before the courts, within the context of which a large number of remedies are available. Considerable care is required by any school faced with a claim for a breach of the DPA for the reasons developed below.

The procedure to be adopted before the Courts will vary depending upon whether or not a national security certificate has been issued in respect of the data in dispute. Unless your school is undertaking a rather unusual educational role, it is unlikely this will apply to any proceedings your school may face and as such it is not considered further.

Within the context of child protection, requests for information are common and because of the importance of the issues, parents will seek to find what information exists using a full variety of mechanisms; deploying the DPA against a school to obtain records or evidence for further proceedings against a school or within the family will be not uncommon.

A number of issues require to be considered within the context of defending contraventions of the Act in the courts. These include:

 the procedure;
 the courts’ powers under s. 15 (2) of the Act;
 the courts’ approach to determine whether or not there has been a breach;
 the courts’ discretion and the remedies available;
 the quantum of damages available for compensation.

3. The Procedure

A parent or pupil can issue a claim in England and Wales in either the county court or the High Court . Subsection 7 (9) of the Act states:

If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.

It is not clear whether proceedings should be commenced in the county or High Court. The obvious factors would appear to be the complexity and importance of both the claim and the information the subject of the claim. In the context of school access requests it is most likely these would be dealt with in the county courts. This has the added advantage that no judgment can become a precedent and there is no formal system of reporting the judgments of circuit judges; thus less formality or notice can attribute to such a decision.

It is unclear how the claim should be issued. The editors of Information Rights 2nd Edition, Thomson/Sweet and Maxwell take the view the Part 8 Civil Procedure Rules alternative claims procedure should be used. However in the case of Ezsias v The Welsh Ministers [2007] All ER (D) 65 the judge at the case management level transferred the claim from the Part 8 procedure to Part 7 of the CPR.

This may seem irrelevant and technical, yet is of importance. Part 8 is a slim lined procedure and is designed to be used where a claim involves substantially less questions of fact for the court to resolve. Crucially it does not require the defendant (e.g. a school) to file a defence. Part 7 CPR contains the rules for the standard claim form and is more detailed and elaborate and a defendant does have to file a defence and would be at considerable risk if this were not done. Caution is therefore required to consider how the claimant chooses to commence the claim before the courts. It would be advisable, even if the claim were issued under Part 8 to provide a defence in any event.

Thereafter the Civil Procedure Rules apply and the relevant procedural rules will be determined by whether or not it is a Part 8 or normal claim.

The general rules in relation to disclosure found in Part 31 have been applied in DPA claims before the court, but much care is required in relation to the terms of disclosure orders, given the very heart of the dispute before the Court will inevitably concern the decision by a school not to disclose certain data, information or documents to the parents.  In those circumstances it would be inappropriate for there to be an order for standard disclosure which would oblige the school to disclose harmful or relevant documentation along the normal disclosure principles.

4. Sub-section 15 (4) of the Act

For these reasons we must consider in some detail sub-section 15 (4) which states:

For the purposes of determining any question whether an applicant under subsection (9) of section 7 is entitled to information which he seeks (including any question whether any relevant data are exempt from that section by virtue of Part IV) a court may require the information constituting any data processed by or on behalf of the data controller and any information as to the logic involved in any decision-making as mentioned in section 7 (1) (d) to be made available for its own inspection but shall not, pending the determination of that question in the applicant’s favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery (or, in Scotland, recovery) or otherwise.

This sub-section is of obvious importance. It operates to permit the Court, without revealing the documentation or data the subject of the dispute, to consider the information to help it decide whether or not there has been a breach of the principles of the Act.

It is more often the case than not, the Court will want to consider the documentation in question, as without it, it can be very difficult to determine questions such as whether or not the data is personal or consider how it is filed.

There are also obvious limitations on such issues being explained in witness statements prepared by witnesses for the school, as these would be required to be disclosed to the parents and there is clearly a limit in how far a commentary in a witness statement can go before disclosing the contents of the data the subject of the dispute.

The sub-section also permits the Court to direct the defendant to produce a statement explaining its thought process in arriving at why data was not released and again this need not be disclosed to the other party. There is little doubt this is an unusual but necessary innovation to enable the court to determine the questions raised in a claim.

In Ezsias supra the Claimant alleged this procedure was unfair. The deputy judge is rationalising Parliament’s intention made clear, after referring to the case of Johnson v Medical Defence Union[2004] EWHC 2509, that:

Where a data controller wishes to withhold information from an applicant, this procedure [ss. 15 (2)] has obvious advantages over the directions conventional in other types of case where the parties plead their case, give disclosure of evidence (in the form of lists of documentation and service of witness statements), and there is then a trial of the issues disclosed on the pleadings on the basis of the disclosed evidence. “Disclosure of documents” in the former procedure is likely to be inappropriate, given that section 15 (2) confirms that a data controller cannot be required to give disclosure of documents he seeks to withhold pending a decision of the court on the propriety of that course. It is also likely (although not inconceivable) that the applicant will be able to make substantive submissions on the issue of disclosability – because he will not have seen the data that are the subject of consideration.

Schools must be alive to this procedure and be aware of using it and the effect this has on disclosure. These claims are not common in the county courts and it may well be the judge dealing with this matter is unaware of this statutory provision.

5. The Courts’ Approach to Claims

How does the Court go about considering whether or not a data controller has “failed to comply with the request in contravention of those provisions”?

The best guidance available was laid out by the Court of Appeal in the case of Durant v Financial Services Authority [2003] EWCA Civ 1746. The case concerned Mr Durant’s request for information in relation to a complaint he made to the Authority after he lost litigation against Barclays Bank, of which he had been a recent but dis-satisfied customer (there may be more claims like this!). He sought certain documents from the FSA, who refused to disclose them. He issued a claim alleging a breach of the Act in Edmonton County Court. The district judge hearing the claim dismissed it and he appealed to the resident circuit judge who upheld the lower judge’s decision. Mr Durant appealed to the Court of Appeal.

The important issue for the purpose of this paper was the Court’s consideration of the court’s function when considering an application under sub-section 7 (9). Was it to merely review the data controller’s decision in relation to the data in dispute or was it to take it own view as to whether or not the data should have been disclosed? The Court held the following:

Parliament cannot have intended that courts in applications under section 7 (9) should be able to routinely to “second-guess” decisions of data controllers, who may be employees of bodies large or small, public or private or to be self-employed. To so interpret the legislation would encourage litigation and appellate challenge by way of full rehearing on the merits and, in that manner, impose disproportionate burdens on them and their employers in their discharge of their many responsibilities under the Act.

This is clearly good news for schools faced with a DPA claim. In effect the courts are interpreting section 7 (9) in a way such as to restrict claims and too restrict the courts’ ability to overturn a decision by a data controller. The Court of Appeal made this clear when it stated:

…it does not follow that the courts should assume, if and when such a question reaches them, the role of primary decision maker on the merits.

The courts must therefore be slow to intervene and should not form their own view of the merits or primary facts but act instead to review the data controller’s decision to determine whether it is primarily lawful and reasonable. It is important to have this test at the forefront of any defence of a DPA claim.

Beyond this scheme for judicial decision making, the courts will simply proceed to review as lawful or otherwise the decisions of the school in relation to whatever the subject of the dispute is applying the principles under the Act as have been discussed earlier today.

6. Discretion and Remedies

Should there be a finding that a school has failed to comply with a request in contravention of the provision of the Act, the court may order him to comply. This is significant because the use of the word ‘may’ means the courts need not make an order against a school, found to be in breach of the DPA provisions. The courts have discretion and schools facing claims of this nature should use this provision as a further stage of their defence.

The scope of the judicial discretion has been the subject of brief judicial consideration in Durant supra. The judge in the High Court found that he would not use his discretion to make an order against the FSA. He stated:

First, I cannot see that the information could be of any practical value to the appellant. Secondly, the purpose of the legislation…is to ensure that records of an inaccurate nature are not kept about an individual. A citizen needs to know what the record says in order to have an opportunity of remedying an error or false information. In this case the appellants seeks disclosure not to correct an error but to fuel a separate collateral argument that he has either with Barclays Bank or with the FSA, litigation which is in any event doomed to failure. [Thirdly] I am entirely satisfied on the facts of the case that the FSA have acted at all times in good faith, and indeed there has been no suggestion to the contrary from the appellant; his argument is with Barclays Bank, not with the FSA.

The Court of Appeal did not need to consider the appeal in relation to the judge’s use of his discretion because they found there had been no breach of the Act. Auld LJ in the Court said this nonetheless:

..it might be difficult for a court to conclude under that provision [ss. 7 (4) (b)] that it was reasonable to comply with a data subject’s request so as to disclose such information, yet exercise its discretion under section 7 (9) against ordering compliance with the aspect of the data subject’s request. On the facts of this case, I need only say that, for the reasons given by the Judge, I can see no basis for disagreeing with his putative decision.         

This approach was markedly different to the Lord Justice who granted permission in the case who stated, when granting permission:

She [claimant counsel] submits – and I see the force of the argument – that the judge’s error was to circumscribe his discretion….[it would] be better expressed to allow disclosure unless good reason is shown why it should not be disclosed.

This demonstrates a considerable divergence of opinion between two experienced judges of the Court of Appeal. The matter was also considered by the High Court in  R (ota Lord) v Secretary of State for the Home Department [2003] EWHC 2073 Admin where Munby J took the view s. 7 (9) involved “the exercise of a pure, and on the face of it untrammeled judicial discretion”.

Taking the authorities together there is little doubt any defence under the DPA should seek to convince the court its discretion should be used against the claimant. In the school/child protection context there may well be compelling reasons why a court should not order disclosure, such as:

 the school having acted in good faith;
 the desire of a parent to use materials to further other litigation;
 the interest of the child;
 the interest of the school community as a whole;
 to discourage litigation in a difficult area of discretion for school staff.

Should the court be minded to use its discretion what are the remedies available to parents against the school? (These remedies would have to be specifically pled against the school). They are extensive and include:

 a subject access order (s. 7 (9)) – to order a school to comply with a valid subject access request;
 a preventing of processing order (s. 10 (4)) – to desist from processing data;
 an accuracy order (s. 14 (1) – to erase/rectify/destroy/block an inaccurate record of data;
 a communication order (s. 14 (3)) – if there has been inaccurate data, the court can order a school to inform third parties of the change in data following it being made accurate;
 compensation (s. 13). 

There is not space to consider each of these individually but schools must be aware they can be required to alter records or inform third parties of changes in records if ordered to do so.  Further consideration is required of compensation orders. Section 13 of the Act states:

(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if:
a. The individual also suffers damage by reason of the contravention, or
b. The contravention relates to the processing of personal data for the special purposes.
(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.

Damages are clearly available against a school. The ‘individual’ entitled to sue for damages need not be the data subject, it will be enough if a contravention of the Act has caused damage.

What constitutes damage? It is not defined in the statute but applying general principles of tortious liability it would cover pecuniary loss (profit or earnings) and non-pecuniary loss such as pain, suffering or loss of amenity. The role of the court would be to place the claimant back in the position they would be in had the breach not occurred. Interestingly in Johnson supra the Court was not prepared to award damages for loss of reputation, Buxton LJ held:

I am certainly not prepared to import those assumptions, peculiar to, and in the view of some an unedifying feature of, the English law of defamation into this wholly different chapter of law.

The courts have held that a claim for damages on the basis of being refused banking facilities on the basis on inaccurate data was arguable  and that the retention of data in breach of the Act which has an effect on a person is actionable .

Distress alone will not be sufficient unless a “special purpose” is involved. Special purposes under the Act are journalistic, artistic or literary and for obvious reasons the threshold is lower for data used in these contexts but this is unlikely to apply to schools.

There has been little judicial comment of the ss. 13 (3) defence, but it is there to be used and schools faced with a compensation claim should place considerable reliance on it. The most effective way to mount such a defence is to demonstrate to the court the school had in place adequate and proper procedures and that these were routinely revised and followed. Furthermore a school in this position should seek to demonstrate they are acting in line with the sector as a whole (in some form of Bolam compliance defence).

Lastly it is useful to consider one case which sought an order under s. 14 (rectification) which has particular relevance in the child protection context. In the case of P v Wozencroft [2002] EWHC 1724 Fam, the claimant was a litigant in person seeking access to his child. Dr Wozencroft was a consultant child psychiatrist who produced a report during the family law proceedings in which he was critical of P. The judge in the family law proceedings made orders in lines with Dr Wozencroft’s report and P unsuccessfully tried to appeal the decision. Several months later P made a data subject access claim against the doctor challenging inaccuracies in his report under ss. 14 DPA. Dr Wozencroft argued he was not the data controller but CAFCASS was and the issue went before the judge who held:

In my judgment it is clear that the claimant could never persuade the court to exercise its discretion to make an order for rectification under section 14 of the Act. This forum, is quite simply, wholly inappropriate for articulation of the issues which the claimant raises in relation to the defendant’s repot…..It is entirely inapt that over a year later there should be free-standing proceedings in this court in which the claimant seeks to do what he should have done at the hearing [by way of cross-examination].

Harsh words, but undoubtedly there has been a considerable degree of judicial frustration when faced with these types of claims and schools should use this to their advantage.

7. Quantum

 If all else fails and a school is ordered to make a payment for compensation they can take some comfort from the relatively small awards of damages in this area. The following are examples of judicial awards made under the Act:

Michael Douglas and Catherine Zeta Jones £ 50 each for distress in their case against OK!  (This was compared to damages of £ 3750 each under their breach of confidence claim although it appears the judge ordered so little under the DPA claim because it added very little in addition).  
 In Johnson supra Rimmer J assessed damages for distress at £ 5, 000 (a case involving a doctor not being provided with insurance, so in effect he could not work).

8. Conclusion

There is little doubt defending DPA claims before the courts is not straightforward. Great care is required to ensure schools make the most of the detailed layers of the Act to ensure they can benefit from all possible defences at the various stages of the courts’ consideration.

John McKendrick
Hardwicke Building