Yao Bekoe v The Mayor and Burgesses of the London Borough of Islington

Financial information covering bank accounts, mortgage accounts and balances may constitute private information giving rise to a reasonable expectation of privacy. A public authority must identify a lawful basis before accessing and disclosing such information; a general safeguarding duty does not itself establish that basis.

Where relevant evidence or documents are absent, the court may draw adverse inferences from the evidential gap, particularly where records have been destroyed or should ordinarily have existed. A data controller must respond to a data subject access request without undue delay and within the applicable statutory period, disclose relevant personal data, and maintain appropriate security. Damages for misuse of private information may compensate loss of control independently of distress, and overlapping privacy and data-protection breaches may justify one combined award.

The claimant brought claims against a local authority for misuse of private information and breaches of the General Data Protection Regulation. The misuse claim concerned the authority’s access to and disclosure of information about the claimant’s bank accounts, mortgage accounts and balances during earlier possession proceedings.

The data-protection claim concerned delayed and incomplete responses to a data subject access request, likely undisclosed personal data, and the destruction or loss of a legal file and other records. The authority relied, among other matters, on its safeguarding functions and the need to investigate suspected fraud. The court had to determine whether the access and disclosure were lawful, whether GDPR obligations had been breached, and the appropriate compensation.

1. Misuse of private information. The claimant had a reasonable expectation of privacy in a comprehensive collection of financial information. The relevant question was whether that expectation was outweighed by a countervailing interest, applying the approach in ZXC v Bloomberg LP [2022] UKSC 5. The information accessed went substantially beyond what was necessary for the possession claim.
2. Lawful authority. The defendant did not establish that its access to the information was authorised by its alleged enquiry under section 42 of the Care Act 2014. The absence of evidence from relevant officers justified the conclusion that the defence was unsupported. The defendant also failed to show that the interference with Article 8 rights was in accordance with the law.
3. Adverse inferences. Applying the principles discussed in Active Media Services Inc v Burmester Duncker & Joly GmbH & Co KG [2021] EWHC 232 (Comm) and Wisniewski v Central Manchester Health Authority [1998] P.I.Q.R P324, the court could draw inferences from missing witnesses and destroyed or unavailable documents. It was likely that further personal data had been held by the defendant but not disclosed.
4. GDPR breaches. The defendant admitted delay in responding to the data subject access request. The court found continuing failures to disclose personal data and inadequate security for personal data, including the lost or destroyed legal file. The defendant had therefore breached Articles 5, 12 and 15 of the GDPR.
5. Compensation. Damages for misuse of private information included loss of control of the information independently of distress, applying Gulati v MGN Ltd [2015] EWHC 1482 (Ch) and Lloyd v Google LLC [2021] UKSC 50. The defendant’s subsequent conduct aggravated the distress. Because the claims and their effects substantially overlapped, a single combined award was appropriate.
6. The claims succeeded. Judgment was entered for the claimant in the sum of £6,000.

First-instance judgment. No prior appellate decision is stated in the judgment.