Danielle Raine v JD Wetherspoon Plc

Personal information may be private and confidential as against an employer even where it concerns a third party’s contact account. The relevant question is whether the claimant provided, used or controlled the information in the employment relationship, not who owned the telephone or account.

A direct disclosure by the data custodian is capable of constituting misuse of private information and breach of confidence. Those causes of action are distinct from statutory data-protection claims. A recorded item of information may be processed under the GDPR even where its final disclosure is oral.

The two-stage privacy test remains applicable: reasonable expectation of privacy, followed where necessary by balancing against freedom of expression. A pre-existing funding arrangement and the separate QOCS regime do not determine whether misuse of private information is an excepted claim for success-fee purposes.

The claimant had formerly worked for the defendant and had supplied her mother’s mobile number as an emergency contact. The number was retained in a confidential personnel file. After the claimant’s violent former partner telephoned the defendant’s pub while falsely claiming to be a police officer, employees disclosed the number to him. He used it to contact and threaten the claimant.

The County Court found for the claimant in misuse of private information and breach of confidence, but rejected her DPA/GDPR claim. It awarded damages for exacerbation of existing psychological conditions and allowed recovery of the success fee. The defendant appealed on liability, damages and costs. The claimant challenged the dismissal of her statutory claim.

1. Appeal and respondent’s notice. The defendant’s appeal was dismissed. The claimant’s Respondent’s Notice succeeded, and the DPA/GDPR claim also succeeded. The application to set aside permission for the late Respondent’s Notice was rejected.
2. Misuse of private information. Applying the two-stage test identified in ZXC v Bloomberg [2022] UKSC 5, the claimant had a reasonable expectation that the contact details supplied for her personnel file would remain secure and private. It was immaterial that the number belonged to her mother’s mobile account. As between the claimant and the defendant, the information related to the claimant and had been provided by her for use in contacting her.
3. The claim was not an impermissible attempt to impose a free-standing data-security duty. Warren v DSG Retail Ltd [2021] EWHC 2168 (QB) concerned failure to prevent hacking, where the defendant had not itself disclosed or misused the information. Here the defendant’s employees positively disclosed the information to the third party. Grounds 1–3 therefore failed.
4. Breach of confidence. The information had the necessary quality of confidence, was subject to an obligation of confidence arising from the employment relationship, and was disclosed without authority. The obligation could continue after employment ended. The claimant had not authorised disclosure to police, emergency services or the former partner.
5. DPA/GDPR. Scott v LGBT Foundation Ltd [2020] EWHC 483 (QB) did not establish that oral disclosure is incapable of being processing. In Scott there was no recorded information or processing. Here the personnel file was accessed, the information extracted and recorded in writing, and it was then communicated orally. That fell within GDPR article 4(2), consistently with Holyoake v Candy [2017] EWHC 3397 (Ch) and Endemol Shine Finland Oy, Case 740/22.
6. Damages and success fee. The damages award was not perverse. The Recorder had distinguished causation of new injury from exacerbation of existing psychological injury. CPR 44.13 did not determine whether misuse of private information was an excepted claim for success-fee purposes; QOCS was a separate issue, and CPR 44.17 applied to the pre-commencement funding arrangement. The decision to allow the full success fee was not wrong in principle.

• High Court (King’s Bench Division): appeal from the County Court at Manchester dismissed. The claimant’s Respondent’s Notice was allowed, and the DPA/GDPR claim succeeded.
• County Court at Manchester: following trial on 4 July 2023, judgment handed down on 12 July 2023 for the claimant in misuse of private information and breach of confidence, with the DPA/GDPR claim dismissed. A costs ruling was given on 9 October 2023.