Dr Gary Duke v Jackie Moores & Ors

On applications under CPR Parts 3 and 24, the court may determine a clear legal issue without a trial, but must not conduct a mini-trial or decide a case merely because one outcome appears likely. In misuse of private information claims, reasonable expectation of privacy is assessed objectively and may include the mode of transmission, tone, expression and recipient, not merely the information’s content. That expectation may nevertheless be outweighed by a proportionate disciplinary investigation. Information contained in a public judgment may attract no reasonable expectation of privacy. Processing personal data for an employment investigation may be necessary for the employment contract and lawful under Article 6 of the UK GDPR. Human rights claims under the Human Rights Act 1998 lie only against a public authority.

The claimant, a teacher employed by a further education college, brought claims for misuse of private information, data protection breaches and alleged breaches of Articles 8, 10 and 11 of the ECHR. The claims concerned private messages, a WhatsApp message, employment references, and alleged monitoring during disciplinary proceedings.

The defendants applied to strike out the claims and/or obtain summary judgment. The central issues were whether the claimant had a reasonable expectation of privacy, whether the college’s processing was lawful, and whether the human rights claims were properly maintainable.

1. The defendants’ application succeeded in full. The human rights claims and the data protection claims against the first to third defendants were struck out and dismissed. Summary judgment was entered for the defendants on the misuse of private information claims and the data protection claims against the college.
2. The approach to strike-out and summary judgment was adopted from HRH the Duchess of Sussex v Associated Newspapers Ltd [2021] 4 WLR 35 and Easyair Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch). The court must distinguish a realistic prospect from a fanciful one, avoid a mini-trial, and hesitate where fuller investigation could affect the outcome. It may decide a short point of law where the evidence is sufficient.
3. For misuse of private information, the court applied the two-stage approach described in Duchess of Sussex, with reference to ZXC v Bloomberg LP [2020] EWCA Civ 611 and Sicri v Associated Newspapers Ltd [2020] EWHC 3541 (QB). The claimant generally had a reasonable expectation that his Facebook private messages and WhatsApp group messages would remain within their intended communications. However, the timing, content, recipients and disciplinary context made investigation necessary. The expectation was therefore outweighed by the college’s rights, interests and obligations.
4. The alleged previous dismissals were recorded in a publicly accessible court judgment in proceedings to which the claimant had been a party. He therefore had no reasonable expectation of privacy in that information. The alleged monitoring and surveillance likewise disclosed no realistic privacy claim.
5. The college was the controller. Its processing was lawful under Articles 5 and 6 of the UK GDPR. The court applied the necessity principle discussed in Meta Platforms Inc and Others v Bundeskartellamt [2023] 5 CMLR 22. The processing was necessary for the employment contract, the college’s obligations to staff and students, and safeguarding duties.
6. The claims under Articles 8, 10 and 11 of the ECHR had no real prospect of success. Claims against the first to third defendants were also barred by section 6 of the Human Rights Act 1998. The defendants received costs, including summary assessment of the application costs at £27,250 and a payment on account of £40,000 for the proceedings. Permission to appeal was refused.

This was a first-instance application to strike out and/or obtain summary judgment. The claimant’s subsequent application for permission to appeal was refused.