Scott v LGBT Foundation Ltd

A purely verbal disclosure does not constitute the processing of personal data under the Data Protection Act 1998, whose scheme depends on recorded information. In any event, disclosure of sensitive information to a healthcare professional may be lawful where necessary to protect the data subject’s vital interests; the statutory condition does not require imminent risk. A duty of confidence may contain an express or implied qualification permitting a limited disclosure made to protect welfare. A private charity does not become a hybrid public authority merely because it provides services of public benefit or receives public funding. Statutory powers, duties, governmental character and the nature of the particular function remain important. A claim under the Human Rights Act 1998 therefore requires the defendant to fall within section 6.

The claimant alleged that the defendant charity unlawfully disclosed information about his suicidal thoughts, self-harm risk and drug use to his GP after an intake assessment. He brought claims under the Data Protection Act 1998, the common law of confidence and the Human Rights Act 1998.

The defendant applied for summary judgment and striking out. The court considered whether the oral disclosure was subject to the DPA, whether it breached confidentiality, and whether the charity was a hybrid public authority for the purposes of section 6 of the HRA.

1. Disposition. Summary judgment was granted to the defendant and all causes of action were struck out. The claim was dismissed.
2. Summary judgment and strike out. The court applied the principles identified in Global Asset Capital Inc v Aabar Block SARL [2017] EWCA Civ 37, including the requirement for a realistic prospect of success, avoidance of a mini-trial, consideration of evidence reasonably available at trial, and determination of suitable points of law. There was no material factual dispute and the issues could be decided finally without a trial.
3. DPA claim. The oral disclosure was not itself processing of personal data. Section 1 of the DPA defines data by reference to automatic processing, recording for such processing, filing systems or accessible records. Information retained only in the staff member’s mind did not fall within that scheme. Durant v Financial Services Authority [2003] EWCA Civ 1746 supported the requirement for recorded information.
4. Alternatively, the disclosure would have satisfied the DPA conditions concerning the protection of vital interests. No requirement of imminent risk could be read into those conditions. On the evidence, the claimant’s suicidal ideation, contemplated method of self-harm and drug use justified a limited notification to his GP, and consent could not reasonably have been expected.
5. Breach of confidence. The information had the requisite quality of confidence and a duty of confidence was owed. However, the referral forms and oral explanation qualified that duty where there were serious concerns about welfare. The limited disclosure to the GP fell within that qualification. Even if consent had formally been requested and refused, the disclosure would have been lawful on the claimant’s accepted construction.
6. HRA claim. The defendant was neither a core nor hybrid public authority. Applying the multifactorial approach discussed in Fearn v Tate Gallery Board of Trustees [2019] EWHC 246 (Ch), public funding and services of public benefit were insufficient. The charity had no statutory powers, duties or functions, was not governmental, and the intake assessment had no statutory basis. R (on the application of A) v Partnerships in Care Limited [2002] EWHC 529 (Admin) was distinguishable because the private hospital there was subject to specific statutory duties.
7. The court additionally considered that the disclosure did not interfere with Article 8 rights and would, if necessary, have been justified under Article 8(2). Those observations were unnecessary to the decision.