YSL v Surrey and Borders Partnership NHS Foundation Trust

A settlement of claims arising from disclosure of personal data bars later claims concerning the same disclosures, but does not extend to distinct processing, retention or erasure issues unless the agreement’s wording covers them. Healthcare providers may lawfully process and retain patient health data where processing is necessary for health or social care, public health, or the performance of public functions, subject to applicable confidentiality safeguards.

The right to erasure is displaced where retention is necessary for public-health purposes or for establishing, exercising or defending legal claims. A retention period is not disproportionate merely because a shorter period could have been selected. The data-protection accuracy principle concerns matters of fact and does not ordinarily permit challenges to clinical opinions or evaluations.

YSL brought claims against a mental-health NHS foundation trust concerning the collection, disclosure, storage and alleged inaccuracy of his patient data. He relied on the Data Protection Act 1998, Data Protection Act 2018, the EU and UK GDPR, article 8 of the Convention, and common-law privacy and confidentiality principles.

The Trust applied to strike out the claim as compromised by a 2016 settlement, abusive under the principles in Johnson v Gore Wood & Co [2002] 2 AC 1, and lacking merit. The central issues were the scope of the settlement, the lawfulness of processing and retaining health data, the right to erasure, the proportionality of a 20-year retention period, and whether alleged clinical opinions could be inaccurate data.

1. Disposition. The claim was struck out in part as an abuse of process and, in any event, failed on its merits. Judgment was entered for the Defendant. The Claimant’s summary judgment application was rejected.
2. The 2016 settlement objectively covered all claims arising from disclosure of the Claimant’s personal information by CAMHS staff, including disclosures by staff beyond the named clinicians. The disclosure allegations therefore could not be pursued. The settlement also covered the later complaint concerning a 2012 letter sent to the Claimant’s GP, mother and school. It did not cover distinct complaints concerning retention, processing of Surrey Police risk assessments, or erasure.
3. Applying Johnson v Gore Wood & Co [2002] 2 AC 1, the court adopted a broad merits-based approach to abuse of process. A later claim may be abusive where it should have been raised earlier, but the fact that it could have been raised is not alone conclusive.
4. Processing the Claimant’s sensitive health data was lawful under the Data Protection Act 1998, including Schedule 2 paragraph 5(d), Schedule 2 paragraph 6(a), and Schedule 3 paragraph 8. Processing under the EU GDPR, UK GDPR and Data Protection Act 2018 was lawful because it was necessary for the Trust’s public-health and healthcare functions and satisfied the special-category safeguards.
5. The Surrey Police risk assessments were received through the multi-agency sharing mechanism and uploaded for clinical assessment. The Trust was not responsible for the police’s disclosure and was not required to notify the Claimant personally before each receipt. Storage and processing were lawful.
6. The Claimant had no right to erasure under article 17(1) UK GDPR. Article 17(3)(c) applied because retention was necessary for public-health purposes, and article 17(3)(e) applied because the Trust needed to defend legal claims. The Trust also demonstrated compelling legitimate grounds for continuing processing after the Claimant’s article 21 objection.
7. Retention of medical records engaged article 8, but was justified under article 8(2). Applying the four-stage proportionality analysis in Bank Mellat v HM Treasury (No 2) [2014] AC 700, the 20-year retention period pursued important healthcare and patient-protection objectives, was rationally connected to them, and struck a fair balance. The court gave substantial weight to the NHSX Code and institutional expertise.
8. The accuracy principle concerns whether data are incorrect or misleading as to a matter of fact. Clinical diagnoses, opinions and evaluations were outside that principle. The Claimant’s pleaded accuracy complaint therefore disclosed no reasonable cause of action and had no real prospect of success.
9. The application to restrict publication or depart from open justice was refused. The anonymity order adequately protected the Claimant’s privacy, and no sufficient justification existed for handing down the judgment privately.

First-instance decision. No earlier appellate decision was stated in the judgment.