Isma Ali v The Chief Constable of Bedfordshire Police

A public authority disclosing personal data must establish that the particular disclosure was necessary for a permitted purpose. Necessity is determined by the court, giving appropriate weight to the authority’s assessment. If no contemporaneous balancing exercise occurred, that assessment carries less weight, although necessity may be established by later evidence. Assurances of anonymity, the availability of anonymised information and the absence of evidence that identification was needed are material considerations. A disclosure may breach data-protection principles, misuse private information and Article 8 where the countervailing safeguarding interests do not outweigh the individual’s expectation of privacy. A deliberate criminal disclosure by a later recipient may break the chain of causation, but the original controller remains liable for distress caused by its own disclosure.

The claimant gave Bedfordshire Police information about her former husband and repeatedly requested that her identity as the source should not be disclosed. The Police nevertheless sent an unredacted safeguarding referral to Luton Borough Council. An employee of Luton later unlawfully accessed the report and disclosed it to the former husband.

The claimant sued the Police for breaches of the GDPR, misuse of private information, breach of confidence and incompatibility with Article 8 ECHR. A related claim against Luton had been dismissed: [2022] EWHC 132 (QB). The central issues were whether identifying the claimant as the source was necessary, whether the disclosure was otherwise justified, and what loss was caused by the Police’s breach.

1. Liability. The claims for breach of Articles 5(1)(a) and (b) GDPR, misuse of private information and breach of s. 6 of the Human Rights Act 1998 succeeded.

2. The Police had to show that disclosing the claimant’s identity as the source was necessary for a purpose in Article 6 GDPR. That was a question for the court, applying an approach analogous to the human-rights assessment in R (Begum) v Denbigh High School Governors [2006] UKHL 15. The Police’s failure to consider anonymisation at the time was not fatal, but reduced the weight to be given to its assessment. The burden nevertheless remained on the Police, which could rely on ex post facto evidence.

3. The burden was not discharged. The claimant had repeatedly sought anonymity and had been assured that her identity would not be revealed. There was no evidence that Luton needed to know the source to assess credibility, that an anonymised report would have reduced the quality or urgency of the referral, or that the source could not have been described as reliable and directly informed. Suspicion as to the source was materially different from knowledge of it.

4. The claimant had a reasonable expectation of privacy in the fact that she had informed the Police about her former husband. The safeguarding interests did not outweigh that expectation. The same conclusion applied to the Article 8 interference. The case was more appropriately analysed as misuse of private information than breach of confidence, although the result was materially the same.

5. For GDPR damages, the later employee’s deliberate and criminal disclosure broke the chain of causation for the claimant’s resulting severe distress. The Police were nevertheless liable for distress that would have resulted from their own disclosure to Luton. The appropriate award was £3,000. Alternatively, the same sum would have been awarded for loss of control over private information and, if necessary, as just satisfaction for the Article 8 breach.

6. There was judgment for the claimant in the sum of £3,000.

The judgment was at first instance. The related claim against Luton Borough Council was dismissed by a Deputy High Court Judge: [2022] EWHC 132 (QB).