M, R (On the Application Of) v The Chief Constable of Sussex Police

Under Part 3 of the Data Protection Act 2018, compliance depends on the substance and practical effect of the controller’s policy and safeguards. The Act does not require separate safeguards for children or sensitive data, and a recital to the Law Enforcement Directive cannot create substantive obligations. An appropriate policy document may cover different data categories and incorporate annexed material. Appropriateness requires a holistic assessment of the data, recipients, onward dissemination, vetting, child-related risks and justification for disclosure. Private, constrained sharing with a business partnership was not publication to the public under youth reporting restrictions. Intelligence that a person was at risk of sexual exploitation did not concern her sex life and was not sensitive personal data.

M, a vulnerable young person, challenged Sussex Police’s information-sharing arrangements with the Brighton & Hove Business Crime Reduction Partnership and specific earlier disclosures. Lieven J held that the 2018 agreement satisfied Part 3 of the Data Protection Act 2018 and awarded £500 for one disclosure, while rejecting the challenge to disclosure of bail conditions: [2019] EWHC 975 (Admin). M appealed on the safeguards, the treatment of bail conditions as private communications and damages. The Chief Constable cross-appealed the finding that intelligence about risk of child sexual exploitation concerned M’s sexual life and the related relief. The central issues were whether the arrangements were lawful and whether the disputed disclosures were prohibited or sensitive.

1. Disposition. The appeal was dismissed and the cross-appeal was allowed. The finding that information about M’s risk of child sexual exploitation concerned her sexual life was set aside. There was therefore no established breach on that basis and no basis for the award of damages; the challenge to the amount of damages did not arise.
2. Data protection safeguards. Part 3 of the Data Protection Act 2018 governs law-enforcement processing by competent authorities. The BCRP was not a competent authority and its own controller obligations arose under the GDPR and Part 2. Recitals to the Law Enforcement Directive assist interpretation but cannot create substantive requirements absent from its operative provisions. In particular, there was no separate statutory requirement for safeguards specifically addressing children or sensitive data.
3. The adequacy of the arrangements required an objective, holistic assessment of the nature of the data, recipients and onward dissemination, training and vetting, the interests of children, and the justification for disclosure. An appropriate policy document under section 42(2) must explain the procedures securing compliance with the data protection principles and the policies on retention and erasure. It may cover sensitive and non-sensitive data and incorporate annexed documents. The ISA 2018, its appendices and the LIA met those requirements. The restrictions on access, need-to-know controls, vetting, data-integrity agreements, retention limits and sanctions provided proportionate safeguards, including for sensitive data relating to a person aged 14 to 17.
4. A general finding that safeguards were appropriate was compatible with a specific breach caused by their failure in an individual instance. The safeguards set a minimum standard but were not absolute.
5. Publication. Sharing bail conditions with BCRP members, employees and contractors subject to contractual and other restrictions was a private communication, not publication to the public or a section of the public under section 49 of the Children and Young Persons Act 1933 or section 45 of the Youth Justice and Criminal Evidence Act 1999. The relevant distinction was between private communications and publication to the general public.
6. Sex life and Operation C. The natural meaning of sex life concerns a person’s own sexual behaviour, preferences and lifestyle choices, not the risk of sexual abuse or exploitation by others. Information about risk of child sexual exploitation therefore did not disclose M’s sex life. The Judge’s inference that reference to Operation C necessarily communicated sexual vulnerability lacked evidential foundation, although that alternative finding was immaterial to the outcome.

• Court of Appeal (Civil Division) — The appeal was dismissed and the Chief Constable’s cross-appeal was allowed.
• High Court of Justice, Queen’s Bench Division, Administrative Court — Lieven J held that the ISA 2018 satisfied the relevant data-protection requirements, awarded £500 for one unlawful disclosure and rejected the remaining complaints: [2019] EWHC 975 (Admin).