Full case report
(1) TLU (2) TLV v (1) Secretary of State for the Home Department (2) Home Office
Reference  EWCA Civ 2217
Court Court of Appeal
Judge Gross, McFarlane, Coulson LJJ
Date of Judgment 15 Jun 2018
Data protection – Data Protection Act 1998 – Personal Data – Confidential Information
The Home Office accidentally uploaded a spreadsheet containing information relating to 1,598 people who were applying for asylum or leave to remain in the United Kingdom. The information included names, ages and nationalities. The spreadsheet was publically accessible for around two weeks and was downloaded by 22 different domestic and international IP addresses.
The Cs, TLT, TLU and TLV, were Iranian nationals and brought proceedings against the Ds in respect of misuse of their private and confidential data and under the Data Protection Act 1998 for the processing of their personal data. TLT was named in the spreadsheet; his wife and daughter, TLU and TVU, were not named. The issue of liability before the judge at first instance was whether TLU and TLV could recover damages at common law or under the Data Protection Act.
In his judgment, Mitting J had found for each of the claimants. He had held that the identity of TLU and TLV could readily be inferred from the name of TLT. The judge had ordered the Home Office pay damages to TLT and TLU of £12,500 and to TLV of £2,500 plus costs and interest in the case of TLU. Permission to appeal was granted on the issue of liability for TLU and TLV.
(1) Did the spreadsheet contain TLU’s and TLV’s private and/or confidential information?
(2) Did the spreadsheet contain TLU’s and TLV’s personal data?
The appeal was dismissed.
(1) The spreadsheet did contain information that was private and confidential information to TLU and TLV.
The information about TLT on the spreadsheet meant that TLU and TLV could readily be identified from it. The information went to their identities and their claims for asylum. The spreadsheet therefore contained information relating to TLU and TLV of which they had a reasonable expectation of privacy, regardless of the fact that they were not explicitly named.
(2) The spreadsheet did contain TLU’s and TLV’s personal data.
The wording of the statute should be taken at its natural meaning. The data on the spreadsheet “related to” TLU and TLV as they could be identified from the data. As such, despite not being named, the spreadsheet contained their personal data under the Data Protection Act 1998.
This case shows the wide scope of what can be classified as personal data and private information.
The Court of Appeal also declined to address the issue of whether TLU and TLV would be entitled to damages under section 13 of the Data Protection Act 1998 if they had been unsuccessful in relation to issues (1) and (2).
Treasury Solicitor for the Appellants; Bindmans for the Respondents
More from 5RB
5RB is the pre-eminent set in the area for handling defamation, privacy, contempt and data protection matters. Interviewees praise the set for having great depth and quality of counsel, and note that it boasts many of the top barristers in the field. Get the lowdown here.
New 22nd Edition of Clerk & Lindsell on Torts, published by Sweet & Maxwell. Further info here.