Driver v CPS

The High Court determined that an email sent on 5 June 2019 by a Crown Prosecution Service lawyer to a member of the public constituted processing of the claimant's personal data for law enforcement purposes and therefore fell within Part 3 of the Data Protection Act 2018. The court held that the CPS had breached the first, second and sixth data protection principles in Part 3 because the disclosure to the member of the public was not necessary or proportionate and the CPS failed to demonstrate adequate organisational safeguards.

The court rejected the claimant's claim for misuse of private information and his Human Rights Act 1998 claim because, on the particular facts, there was no reasonable expectation of privacy in the information disclosed (the fact that a charging file had been referred to the CPS), given the prior public reporting and the claimant's own conduct. The claimant was awarded modest non‑pecuniary damages of £250 and a declaration that the CPS breached Part 3 of the DPA 2018.

The claimant, a prominent local politician, complained that a CPS lawyer's email to a member of the public stating that a "charging file" had been referred to the CPS in relation to Operation Sheridan unlawfully processed his personal data, amounted to misuse of private information and breached his Article 8 rights under the Human Rights Act 1998. The CPS initially admitted a breach but later sought to resile, contending the email did not contain personal data, that processing was lawful, and that the information was already in the public domain.

Procedural posture and relief sought:

• The claim was heard at first instance in the Queen's Bench Division, Media and Communications List.
• The claimant sought damages (not exceeding £2,000) and declaratory relief for breach of the GDPR/DPA 2018, misuse of private information and breach of ECHR rights (extension of time pleaded for the HRA claim).

Issues framed and decided:

1. Whether the June 2019 email contained the claimant's personal data and, if so, whether the processing was for law enforcement purposes (so Part 3 DPA 2018 applied) or general processing (GDPR).
2. Whether the CPS contravened the DPA 2018 principles (first, second and sixth).
3. Whether the email disclosed private information in which the claimant had a reasonable expectation of privacy (the McKennitt two-stage test) and, if so, whether Article 10 outweighed Article 8.
4. Whether to extend time for the HRA claim and whether Article 8 was engaged.
5. Appropriate remedy if liability established.

Court’s reasoning in brief:

• The court accepted that the processing was for law enforcement purposes and therefore Part 3 of the DPA 2018 applied.
• The email, although not naming the claimant, was held to contain his personal data because reference to Operation Sheridan, taken together with widely available public material and the small number of suspects, allowed him to be identified.
• The CPS failed to prove that disclosure to this particular member of the public was necessary or proportionate in the sense required by Part 3; there was no pressing social need to update that enquirer and the CPS produced no evidence of any consideration of necessity, proportionality or internal policy application. Accordingly the first and second data protection principles were breached. The CPS also failed to demonstrate appropriate organisational measures, breaching the sixth principle.
• On misuse of private information and Article 8, the court concluded that on the particular facts (lengthy publicity about Operation Sheridan, the claimant's own press statement in 2016, the Fitzgerald litigation and the August 2018 reporting that a file had been sent to the CPS) there was no reasonable expectation of privacy in the fact that a charging file had been referred to the CPS and the MPI and HRA claims therefore failed. Time was not extended for the HRA claim because it would have failed on the merits.
• Given the limited distress found to have been caused by this breach, the claimant was awarded modest non‑pecuniary damages (£250) and a declaration of breach.

At first instance the court upheld the claimant's data protection claim under Part 3 of the Data Protection Act 2018 (finding breaches of the first, second and sixth data protection principles) and awarded damages of £250 together with a declaration of breach. The court dismissed the claims for misuse of private information and under the Human Rights Act 1998 on the basis that, in the particular factual context, there was no reasonable expectation of privacy in the information disclosed.