Court considers application of DPA 2018 legal proceedings exemption

Riley v Student Housing Company (Ops) Ltd [2023] SC DNF 7

A Scottish Sheriff Court considered the data protection obligations of an employer in respect of its (former) employee (Riley) when defending an employment tribunal claim brought by another employee, Mr Adamson. Riley sought £75,000 in damages for distress and anxiety after the employer disclosed in the employment claim a number of matters comprising Riley’s personal data.

The case is significant as it is the first UK court decision on the scope of the legal proceedings exemption in Paragraph 5(3), Schedule 2 of the Data Protection Act 2018 (DPA 2018) and its interaction with the general prohibition on disclosing personal data under Articles 5(1)(a) and 5(1)(b) of the United Kingdom General Data Protection Regulation (GDPR).

Riley argued that the law requires an employer to take certain steps before making disclosures in legal proceedings that would identify another employee. In particular, he said Student Housing should have given him notice of and materials about the employment tribunal proceedings; and provided him with the opportunity to comment or give evidence on the allegations made against him.

Riley contended that Student Housing’s failure to take these steps constituted a breach of its duty to process his personal data fairly and transparently under Article 5(1)(a) GDPR; and a breach of the requirement not to process data in a way that is incompatible with the purpose for which it was collected under Article 5(1)(b) GDPR. Student Housing relied on the legal proceedings exemption in paragraph 5(3) of Schedule 2 to the Data Protection Act 2018 (DPA 2018) to justify its actions.

Was the employer exempted from its duty to comply with Articles 5(1)(a) and 5(1)(b)?

Paragraph 5(3) of Schedule 2 of the DPA 2018 provides that the general prohibition against disclosing personal data contained in the UK GDPR provisions do not apply: “where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure” – commonly referred to as the ‘legal proceedings exemption’.

The central issue concerned the meaning of the underlined wording, which has not previously been considered by a UK court:

• Riley argued its effect was that the employer must attempt to apply the UK GDPR provisions before seeking to rely on the exemption (i.e. by seeking his consent / input before making any disclosures); and

• Student Housing argued it was exempted from even attempting to apply the UK GDPR provisions, as otherwise the statutory exemption served no purpose.

The court held that Student Housing’s position was correct.

The court observed that, if Student Housing was required to take the steps Riley proposed, it would not be making the disclosure it intended to make. Rather, Student Housing might be compelled to make an alternative disclosure, e.g. a witness statement for Riley, which might even undermine its own position. Further, Riley’s proposal would result in an unacceptable burden on Student Housing of having to ‘look in two directions’ when engaging in legal proceedings: it would be unable to respond freely to the litigation at hand for fear of facing a potential follow-on claim under Article 5(1)(a) GDPR.

The court held that it cannot have been the intention of paragraph 5(3) of Schedule 2 DPA 2018 to impinge on data controllers’ right to a fair trial under Article 6 of the European Convention of Human Rights by fettering their discretion to conduct litigation as they see fit in pursuance of their legal rights.

Rather, the DPA 2018 recognises that there is a tension between data protection requirements and the demands of litigation; the exemption exists precisely because a balance must be struck between those competing pressures, and in favour of protecting the right to a fair trial. That is particularly so where other means such as anonymisation can be deployed in litigation to protect an individual’s privacy.

This decision appears to be the first to consider the legal proceedings exemption under DPA 2018 and, while it is a Scottish decision, the exemption applies throughout the UK. The decision will be welcomed by data controllers; had the decision gone the other way, the complexities of managing litigation involving personal data disclosure would have been greatly increased.

As a firm, we have experience in advising on cyber and data security risks. Visit Data Security Disputes to learn more.