Secretary of State for the Home Department & Anor v TLU & Anor

Information about unnamed family members may be private and confidential information about them where, in context, they can readily be identified from a named lead family member’s entry. Publication of that information can therefore constitute a misuse of their private information.

For the purposes of the Data Protection Act 1998, personal data includes information relating to an individual who can be identified indirectly from the data and other information held by, or likely to come into the possession of, the data controller. The practical observations in Durant do not replace that statutory test. Information in a family-return record may be about, and focused on, unnamed family members as well as the named lead applicant.

The Home Office inadvertently published a spreadsheet containing detailed information about 1,598 lead applicants in the family returns process. The first respondent, TLT, was named. His wife, TLU, and teenage daughter, TLV, were not named but were members of the family asylum claim and were identifiable from the entry and the surrounding context.

Mitting J held that publication misused TLU’s and TLV’s private and confidential information and unlawfully processed their personal data. He awarded damages. The Home Office appealed on liability from [2016] EWHC 2217 (QB).

The central questions were whether the spreadsheet contained the secondary claimants’ private information and personal data and, if not, whether they could recover under section 13 of the Data Protection Act 1998 for the admitted breach concerning TLT.

1. Appeal dismissed. Gross LJ, with whom McFarlane and Coulson LJJ agreed, upheld the judge’s findings that the spreadsheet contained information about TLU and TLV. Those findings were unimpeachable following a trial and established that the family members could readily be identified from TLT’s detailed entry in the context of the family returns process.

2. The absence of TLU’s and TLV’s names did not prevent the information being private or confidential information about them. It disclosed their identities by inference, their asylum claim, their connection with the family returns process and their general location. They had a reasonable expectation of privacy and confidence in that information. Its publication was accordingly a misuse of their private and confidential information.

3. Under section 1(1) of the Data Protection Act 1998, data is personal data where it relates to a living individual who can be identified directly or indirectly. TLU and TLV could at least be identified from the spreadsheet together with other information held by the Home Office. The information was also plainly about them, not merely about TLT.

4. Durant v Financial Services Authority [2003] EWCA Civ 1746 did not support a rule that only information naming or directly referring to a person can be personal data. Its observation was a practical working assumption, not a reformulation of the statute. Applying its considerations of biographical significance and focus, the court held that asylum and family-return information was highly biographical and could focus on several members of one family. TLU and TLV were therefore data subjects whose personal data had been processed.

5. Because TLU and TLV succeeded both in misuse of private information and under the Act, the court did not decide the hypothetical question whether section 13(2) would permit a person who was not a data subject to recover distress damages for a breach concerning another person’s data.

• Court of Appeal (Civil Division) — dismissed the Home Office’s appeal and upheld liability to TLU and TLV: [2018] EWCA Civ 2217.
• High Court of Justice, Queen’s Bench Division — Mitting J held that publication of the spreadsheet misused the secondary claimants’ private and confidential information and processed their personal data unlawfully, awarding damages: [2016] EWHC 2217 (QB).