ST (A Minor) & Anor v L Primary School (Rev 2)

Disclosure of a child’s disability and behavioural information by a school engages privacy and data-protection rights. Without valid consent, processing sensitive personal data must satisfy the statutory fairness, lawfulness and necessity requirements. A school must consider less intrusive alternatives and balance the risks of harm against the proposed benefits.

Publication to other parents may interfere with the child’s and, in an appropriate case, the parent’s Article 8 rights. The interference must be lawful, necessary and proportionate. The same disclosure may constitute discrimination under Article 14 and misuse of personal information where there was a reasonable expectation of privacy and disclosure was unjustified.

The first claimant, a child with Down’s Syndrome, attended the defendant primary school. After incidents involving challenging behaviour, the headteacher sent a letter to approximately 60 year 5 parents identifying the child, her disability and behavioural difficulties. The child and her mother claimed breach of the Data Protection Act 1998, breach of Articles 8 and 14 of the ECHR under the Human Rights Act 1998, and misuse of personal information.

The principal factual issue was whether the mother had consented to the letter. The court also considered whether the disclosure was necessary for the school’s statutory functions, whether it interfered with the claimants’ privacy rights, whether it was discriminatory, and the appropriate remedies.

1. Consent and admissibility. The mother had not consented to the letter. The court admitted hearsay evidence after applying the relief-from-sanctions principles in Denton v White and gave it some weight. The school’s witnesses had confused a post-disclosure conversation with an alleged pre-disclosure approval.
2. Data protection. The letter involved processing personal data and sensitive personal data within the Data Protection Act 1998. In the absence of consent, the processing was neither fair nor lawful. The school failed to establish that disclosure was necessary for its statutory functions or legitimate interests. It had not considered less intrusive alternatives or properly balanced the potential harm to the child and her parents against the proposed benefits. The first data-protection principle was therefore breached.
3. Articles 8 and 14. The information disclosed about the child was protected by Article 8. Its publication to other parents interfered with her private life and was neither in accordance with the law nor necessary and proportionate. The disclosure also treated her differently because of her disability, contrary to Article 14 read with Article 8. The mother’s Article 8 rights were also engaged because her identity, daily life and wellbeing were closely connected with caring for and advocating for her disabled child. Alternatively, the facts fell within the ambit of Article 8 and involved discrimination by association.
4. Misuse of personal information. Both claimants had a reasonable expectation of privacy in the information. Prior knowledge by some recipients did not necessarily remove that expectation. Applying an intense focus and proportionality assessment, the school failed to justify the disclosure. The tort was established.
5. Remedy. The child recovered £1,500 for misuse of personal information and the mother £3,000. The child received a declaration for the Article 8 and 14 breaches but no HRA damages and no DPA compensation, because distress or other damage caused by the DPA breach was not proved. The mother likewise received declarations but no HRA damages. The alleged later exclusion from school and the mother’s shop were too remote. Exemplary damages were unavailable and, in any event, unjustified.

First-instance proceedings in the High Court. The court considered the earlier decision of the First-tier Tribunal but determined the issues afresh and was not bound by it.