Pamela Underwood & Anor v Bounty UK Limited & Anor

A data controller is not liable under the Data Protection Act 1998 merely because a third party obtains personal data through an unauthorised act, where the controller has not itself disclosed or made the data available to that person. Compliance with the Seventh Data Protection Principle is fact-sensitive and requires appropriate, rather than absolute, protective measures.

Misuse of private information requires a positive act or interference by the defendant. Permitting access to premises, without itself providing the information or authorising its acquisition, is insufficient. The tort also requires misuse of information of sufficient seriousness.

The claimants brought claims against Bounty UK Limited and Hampshire Hospitals NHS Foundation Trust for misuse of private information and alleged breaches of the Data Protection Act 1998. Bounty had been permitted to distribute promotional packs and offer services on hospital premises. During a bedside visit, a Bounty representative probably obtained the second claimant’s name and gender from documents, but not his date of birth. Most other information had been supplied by the first claimant when she registered with Bounty.

Bounty did not participate in the proceedings and judgment in default had been entered against it. The trial concerned whether the NHS Trust was liable for permitting Bounty representatives access to the ward and for failing to prevent the unauthorised acquisition of information. The central issues were whether the Trust had processed or misused the claimants’ information and whether its protective measures were adequate.

1. Data protection claim dismissed. The Trust had not directly disclosed the claimants’ information, authorised the representative to inspect the documents, or processed the information in contravention of the Data Protection Act 1998. The representative’s inspection was unauthorised and unlawful conduct for which the Trust was not liable.
2. The placing of the NIPE form and feeding record in the patient’s bedside area did not amount to disseminating or otherwise making the information available to Bounty. Those documents were made available for the legitimate care and treatment of the patients, not to the public or to Bounty.
3. The Seventh Data Protection Principle required a fact-sensitive assessment of whether appropriate technical and organisational measures had been taken. It did not require hospitals to withhold all limited patient information needed for safe and effective care. The necessary standard involved a sensible accommodation of competing rights and interests. The Trust had not breached that Principle.
4. Misuse of private information claim dismissed. The applicable two-stage test was whether the claimant had a reasonable expectation of privacy and, if so, whether that expectation was outweighed by countervailing interests. The essential question here was whether the Trust itself had committed an act of misuse or interference. It had not. The Trust provided no information to Bounty, and the representative’s unauthorised conduct was undertaken without the Trust’s consent or knowledge. Mere permission for access to the ward was insufficient.
5. In any event, the information obtained from the documents was limited to the second claimant’s name and gender. It was insufficiently serious to engage the tort. Judgment was therefore entered for the Second Defendant. No issue of remedies arose. The claim for exemplary damages should not have been pleaded without a proper evidential basis, since such damages are wholly exceptional.

First-instance judgment. No appellate history was stated in the judgment.