YSL v Surrey and Borders Partnership NHS Foundation Trust [2024] EWHC 391 (KB)

“Since April 2011, D has been engaging in a pattern of unauthorized data collection about C, gathering excessive amounts of information without C's knowledge or consent. The collected data covers an extensive range of personal details, including intimate aspects of C's private life like his bathroom and eating habits, hobbies, sexual orientation, racial identity, medical data, and even future reproductive intentions. At this time C did not consent to the “treatment” nor was he aware of what was going [on] ...”

“… any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;”

“Tue 05 Jan 2016 08:20 … MM Acrobat Document: accreq [YSL] 1073953.pdf - Subject Access Request”

“… we note that in your recent Part 36 offer you made a request that all the documentation held by the Trust relating to be erased. Our client is not as a matter of law able to action this request. We would refer you to the Guidance: Requesting amendments to health and social care records issued by the National Information Governance Board for Health and Social Care.”

“Providing care and treatment is often complicated and based on trust between you and the professionals providing it. Professionals will usually make decisions about care or treatment based on what happened or what was done previously. For this reason, it is important to you and the professionals that the whole record (including any amendments, who made them, and why) is available. Completely removing one or more pieces of information from a record so that no one knows it was ever there can be like taking a chapter out of a book - the following chapters often do not make sense.”

“I [YSL of address] agree to accept the sum of £6,000 in full and final satisfaction and discharge of all claims that I may have against Surrey & Borders Partnership NHS Foundation Trust arising out of the disclosure of my personal information to third parties by staff at the Trust Children & Adolescent Mental Health Services including [Dr JW and Dr DG] whilst I was under their care in 2011 and 2012.”

“I accept that our communication with you should have been better. We did not acknowledge your original letter of claim dated 17 June 2016 until 15 July, and the next communication with you appears to be your email sent on 5 September attaching a Part 36 offer to accept £40,000. In that email you mentioned a second letter of claim sent to the trust, which we received on 6 September. However, we did not acknowledge your second letter until 5 October. I apologise for failing to keep you better informed about the progress of our investigations. I note that we eventually concluded settlement of your claims for £6,000 on 23 November 2016. I apologise again for our shortcomings in communication, but I do not believe that your position has been prejudiced by any delays. Your claims were brought under a variety of headings, including the Defamation, Data Protection, Human Rights, Equality and Children’s Acts, and all causes were taken into consideration in arriving at a settlement. Martin Forshaw of Weightmans has explained that your defamation claim was always, in law, bound to fail, and that the law will not allow you to bring further claims arising from essentially the same facts on which you have already been compensated.”

“… believes that the continued processing and retention of their Personal Data is unlawful and the Defendants failure to comply with contents of the request is also lawful. The Defendant unlawfully obtained and processed the Claimants Data. Including (but not limited to) failing to comply with the lawfulness, fairness and transparency requirements and failing to ensure the accuracy of Data.”

“I am writing to notify you of my intent to bring legal action against your organization for serious breaches of the Data Protection Act 1998 (DPA), misuse of private information, breach of confidentiality, and violation of Article 8 of the European Convention on Human Rights (ECHR). I believe your actions amount to unlawful sharing and covert collection of my personal data without my knowledge or consent. My entitlement to remedies stems from your violation of the aforementioned statutes and rights. Specifically, I recently became aware of a letter ‘dispatched’ by [Dr DG] on 8th June 2012 and ‘typed’ on 4th July 2012, sent to my General Practitioner, my mother, and my school. This letter, outlining personal, sensitive information about my mental and emotional health, academic progress, and family relationships, was shared without my consent or knowledge. These actions were taken within England and Wales, making it the most appropriate forum for this dispute. I am self-funding this litigation.”

“Please note that I reserve the right to expand the claims once disclosure takes place and upon further investigation of the circumstances surrounding this matter.”

“Damages (including aggravated damages) for breaches of the Claimant's article 8 human rights, misuse of private information, breaches of the Data Protection Act 1998 and 2018 and breach of the GDPR and UK GDPR. An Injunction to restrain the Defendant, whether by itself, its officers, servants or agents, or otherwise howsoever, from processing information about or relating to the Claimant. Such further or other relief as is just and appropriate.”

“38. The Defendant, whilst the DPA 2018 and the GDPR or the UK GDPR were in force, collected, compiled and stored the Claimant’s personal data and information relating to (or purporting to the relate to) the Claimant. The processing includes those relating to: (a) Surrey Police reference […] authored by [PC M]; (b) Surrey Police reference unknown authored by [PC F]. 39. The obtaining of information (unlawfully and without the Claimant’s knowing) was not an isolated incident but rather a continuous and chronic course of conduct that has gone on for over a decade. 40. Further or alternatively, the Defendant has breached the Claimant’s right to data protection as set out in Article 8 of the EU Charter of Fundamental Rights (the ‘Charter’), the GDPR, the UK GDPR and DPA 2018: (a) the information and data constituted the Claimant’s personal data pursuant to Article 4 (1) of the GDPR and the UK GDPR and section 5 of the DPA 2018 since they were, or they contained or claimed to contain, information relating to the Claimant; (b) the compilation, adaptation, dissemination, disclosure, making available and storage of the Claimants data and information constitute the processing of the Personal Data by the Defendant within the meaning of Article 4 (2) of the GDPR and the UK GDPR and section 4 and 5 of the DPA 2018; (c) the Defendant was the data controller within the meaning of Article 4 (7) of the GDPR, the UK GDPR and section 5 and 32 (1) (a) of the DPA 2018 in respect of each of these processing operations; (d) in obtaining and storing the Claimants personal data and information, the Defendant has failed and continues to fail to process the Personal Data in compliance with the GDPR, the DPA 2018 and the UK GDPR and has failed to give effect to the Claimant's rights under the GDPR, the DPA 2018 and the UK GDPR; (e) by processing the Claimant’s personal data as aforesaid, the Defendant acted in breach of its statutory duty pursuant to Article 5 of the GDPR and the UK GDPR and section 34 of the DPA 2018 to process the Claimant’s personal data and information in accordance with the data protection principles set out in the GDPR and the UK GDPR. In particular, in breach of Article 5 (1) (a) of the GDPR and the UK GDPR and section 34 (1) (a) of the DPA 2018, the Defendant’s processing was unlawful and unfair: (1) the Claimant did not consent to the sharing of their personal data; (2) there was no other lawful basis for processing and obtaining of the Claimant’s personal data pursuant to Article 6 of the GDPR and the UK GDPR or section 35 of the DPA 2018. In particular, the processing did not serve a legitimate interest of the Defendant, or any third party nor was it shared for law enforcement purposes. Further, even if (which is denied) such a legitimate interest or lawful basis existed, it was overridden by the interests and fundamental rights of the Claimant. (3) the processing was manifestly unfair and was not transparent. At no stage prior to the processing was the Claimant informed as to what would be taking place in respect of their personal data and information. It will be inferred that this was a deliberate decision taken by the Defendant in order to prevent the Claimant from having the opportunity to object. 41. The Defendant failing to inform or gain consent from the Claimant as to what would be taking place in respect of their personal data and information, meant the Claimant was unable to exercise their rights as stated in paragraph 36, 36(a), 36(b), 36(c), 36(d), 36(e), 36(f), 36(g), 36(h), 36(i), 37, 37(a), 37(b), 37(c), 37(d) and 37(e). It will be inferred that this was a deliberate course of action taken by the Defendant in order to cause a detriment to the Claimant. 42. Paragraph 24, 25 26, 26(a), 26(a)(i), 26(a)(ii), 26(a)(iii), 26(a)(iv), 26(b), 26(c), 28, 30 and 30(a) is repeated. Particulars (a) In breach of Article 5 (1) (a) of the GDPR and the UK GDPR and section 34 of the DPA 2018, the Defendant has failed to process the Personal Data lawfully or fairly. The Claimant will rely in particular on the following facts and matters: [Omitted]”

“44. Further or alternatively, the information and data processed by the Defendant is self-evidently private and confidential and/or fall within the scope of the Claimant’s private and family life, home and correspondence under Article 8 of the ECHR; alternatively, the Claimant had a reasonable expectation that the information obtained and data processed by the Defendant were private and would remain so. In further support of this contention, the Claimant will rely upon the following facts and matters: (a) any information provided by the Clamant to Surrey Police was obviously provided with Clamant believing that they had a reasonable expectation of privacy and confidentiality; (b) further, the information and data purports to convey the Claimant’s deepest and most private thoughts, feelings and information about their life; and (c) the Claimant intended the any information about them to be and remain private, and certainly did not expect it to be published and distributed to multiple third parties and stored on the Defendant’s systems, without any warning.”

“52. The Claimant wrote to the Defendant on 08 September 2021 to activate and pursue his right to object in line with Article 21 GDPR and UK GDPR. 53. In breach of Article 12(4) the Defendant failed to respond or action the request without delay and at the latest within one month of receipt of the request. 54. in breach of Article 12(4) of the GDPR and UK GDPR, when determining not to take action following the Claimant’s requests set out in his email dated 08 September 2021, the Defendant did not inform the Claimant of how their interests outweighed the Claimant’s for not taking action in response to his requests, or of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.”

“(f) Processing and retention of the Claimant’s data was and is in accordance with the NHSX Records Management Code of Practice and the Defendant’s Data Protection Policy. (g) Processing and retention of the Claimant’s data was and is required in relation to the Defendant’s liability insurance for the investigation and defence of complaints and legal claims.”

“59. 20 years is unquestionable an enormous amount of time for the Claimant’s information and data to processed. 60. The Defendant has not provided a legitimate reason, and which overrides the interests of the Claimant or justifies such a long interference of Claimant’s private life. Reason[s] for the 20-year retention of the Claimant’s data have included: (a) that the service is open to the Claimant; (b) the NHSX Code of Practice retention of these records will be retained for 20 years after last contact. 61. Having a retention schedule do[es] not in itself cause it to be necessary to retain data. 62. The Claimant or a reasonable [person] would have never expected retention for such a long period of time without warning. 63. Without prejudice, to the fact that the data processed is inaccurate or the accuracy has been challenged. Storing data for two decades will keep the information accurate or give a picture of the persons current life so further breeches the Accuracy Principal of the GDPR and UK GDPR.”

“19. The Defendant contends that I compromised any claim for the deletion of my personal information by the Trust when I agreed to a settlement in previous negotiations specifically stelling the “disclosure”

“1. The court must consider whether the [respondent to the summary judgment application] has a 'realistic' as opposed to a 'fanciful' prospect of success. 2. A 'realistic' [statement of case] is one that carries some degree of conviction. This means a [case] that is more than merely arguable. 3. In reaching its conclusion the court must not conduct a 'mini-trial'. 4. This does not mean that the court must take at face value and without analysis everything that [the respondent] says. In some cases it may be clear that there is no real substance in factual assertions made, particularly if contradicted by contemporaneous documents. 5. However, in reaching its conclusion the court must take into account not only the evidence actually placed before it on the application for summary judgment, but also the evidence that can reasonably be expected to be available at trial. 6. Although a case may turn out at trial not to be really complicated, it does not follow that it should be decided without a fuller investigation into the facts at trial than is possible or permissible on an application for summary judgment. Thus the court should hesitate about making a final decision without a trial, even where there is no obvious conflict of fact, where reasonable grounds exist for believing that a fuller investigation into the facts of the case would add to or alter the evidence available to a trial judge and so affect the outcome of the case. 7. On the other hand it is not uncommon for an application under Part 24 to give rise to a short point of law or construction and, if the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and that the parties have had an adequate opportunity to address it in argument, it should grasp the nettle and decide it. The reason is quite simple: if the respondent's case is bad in law, he will in truth have no real prospect of succeeding on his claim or successfully defending the claim against him, as the case may be. Similarly, if the applicant's case is bad in law, the sooner that is determined, the better. If it is possible to show by evidence that although material in the form of documents or oral evidence that would put the documents in another light is not currently before the court, such material is likely to exist and can be expected to be available at trial, it would be wrong to give summary judgment because there would be a real, as opposed to a fanciful, prospect of success. However, it is not enough simply to argue that the case should be allowed to go to trial because something may turn up which would have a bearing on the question of construction.”

“GW contends that Mr Johnson has abused the process of the court by bringing an action against it in his own name and for his own benefit when such an action could and should have been brought, if at all, as part of or at the same time as the action brought against the firm by WWH. The allegations of negligence and breach of duty made against the firm by WWH in that action were, it is argued, essentially those upon which Mr Johnson now relies. The oral and documentary evidence relating to each 23action is substantially the same. To litigate these matters in separate actions on different occasions is, GW contends, to duplicate the cost and use of court time involved, to prolong the time before the matter is finally resolved, to subject GW to avoidable harassment and to mount a collateral attack on the outcome of the earlier action, settled by GW on the basis that liability was not admitted. This form of abuse of process has in recent years been taken to be that described by Sir James Wigram V-C in Henderson v Henderson3Hare100, 114–115: ‘In trying this question, I believe I state the rule of the court correctly, when I say, that where a given matter becomes the subject of litigation in, and of adjudication by, a court of competent jurisdiction, the court requires the parties to that litigation to bring forward their whole case, and will not (except under special circumstances) permit the same parties to open the same subject of litigation in respect of matter which might have been brought forward as part of the subject in contest, but which was not brought forward, only because they have, from negligence, inadvertence, or even accident, omitted part of their case. The plea of res judicata applies, except in special cases, not only to points upon which the court was actually required by the parties to form an opinion and pronounce a judgment, but to every point which properly belonged to the subject of litigation, and which the parties, exercising reasonable diligence, might have brought forward at the time.’ Thus the abuse in question need not involve the reopening of a matter already decided in proceedings between the same parties, as where a party is estopped in law from seeking to relitigate a cause of action or an issue already decided in earlier proceedings, but, as Somervell LJ put it in Greenhalgh v Mallard[1947] 2All ER255, 257, may cover: ‘issues or facts which are so clearly part of the subject-matter of the litigation and so clearly could have been raised that it would be an abuse of the process of the court to allow a new proceeding to be started in respect of them.’” ‘In trying this question, I believe I state the rule of the court correctly, when I say, that where a given matter becomes the subject of litigation in, and of adjudication by, a court of competent jurisdiction, the court requires the parties to that litigation to bring forward their whole case, and will not (except under special circumstances) permit the same parties to open the same subject of litigation in respect of matter which might have been brought forward as part of the subject in contest, but which was not brought forward, only because they have, from negligence, inadvertence, or even accident, omitted part of their case. The plea of res judicata applies, except in special cases, not only to points upon which the court was actually required by the parties to form an opinion and pronounce a judgment, but to every point which properly belonged to the subject of litigation, and which the parties, exercising reasonable diligence, might have brought forward at the time.’ ‘issues or facts which are so clearly part of the subject-matter of the litigation and so clearly could have been raised that it would be an abuse of the process of the court to allow a new proceeding to be started in respect of them.’”

“The second subsidiary argument was that the rule in Henderson v Henderson3Hare100did not apply to Mr Johnson since the first action against GW had culminated in a compromise and not a judgment. This argument also was rightly rejected. An important purpose of the rule is to protect a defendant against the harassment necessarily involved in repeated actions concerning the same subject matter. A second action is not the less harassing because the defendant has been driven or thought it prudent to settle the first; often, indeed, that outcome would make a second action the more harassing.”

“In construing this provision, as any other contractual provision, the object of the court is to give effect to what the contracting parties intended. To ascertain the intention of the parties the court reads the terms of the contract as a whole, giving the words used their natural and ordinary meaning in the context of the agreement, the parties’ relationship and all the relevant facts surrounding the transaction so far as known to the parties. To ascertain the parties’ intentions the court does not of course inquire into the parties’ subjective states of mind but makes an objective judgment based on the materials already identified.”

“My entitlement to remedies stems from your violation of the aforementioned statutes and rights. Specifically, I recently became aware of a letter ‘dispatched’ by [Dr DG] on 8th June 2012 and ‘typed’ on 4th July 2012, sent to my General Practitioner, my mother, and my school. This letter, outlining personal, sensitive information about my mental and emotional health, academic progress, and family relationships, was shared without my consent or knowledge. These actions were taken within England and Wales, making it the most appropriate forum for this dispute. I am self-funding this litigation.”

“12. … letters by [Dr SW] and [Dr DG], which were sent to several parties including the Claimants GP, Family and/or school. This was done without the Claimants knowledge or consent. Pending full disclosure, the precise extent of publication and republication of the letters is unknown. … 16. [Dr SW] and [Dr DG] not only processed, collected and shared personal information and data, they failed to ensure the accuracy of said information and data and included several degrading and crass comments of their own. 17. [Dr SW] and [Dr DG]’s letters were also used by the Claimants School to degrade and discredit abuse perpetrated by the School on the Claimant. 18. [Dr SW] also made repeated reference the claimant being autistic, a claim which she [shared] and distributed to multiple parties, but never directly to the Claimant. [Dr SW]’s unlawful and unethical conduct has led to not only continues distress, but also negatively affected the Claimants family relationships, quality of education and development.”

“6. The Trust therefore submits that: (i) The parties intended to compromise ‘all claims’ in relation to disclosure to third parties by CAMHS staff, which included all claims YSL had already raised in correspondence and all other such claims he may have had at that time which included claims he may reasonably have had in his contemplation by that point in time. That includes claims he could have discovered or made with reasonable inquiries such as SARs and/or requesting his GP, school, local authority records etc. (ii) There was an implicit compromise of the inaccuracy allegations. (iii) There was an implicit compromise of the claim for erasure of his records. YSL accepted a financial settlement with no agreement on erasure.”

“The bringing of a claim or the raising of a defence in later proceedings may, without more, amount to abuse if the court is satisfied (the onus being on the party alleging abuse) that the claim or defence should have been raised in the earlier proceedings if it was to be raised at all. I would not accept that it is necessary, before abuse may be found, to identify any additional element such as a collateral attack on a previous decision or some dishonesty, but where those elements are present the later proceedings will be much more obviously abusive, and there will rarely be a finding of abuse unless the later proceeding involves what the court regards as unjust harassment of a party. It is, however, wrong to hold that because a matter could have been raised in early proceedings it should have been, so as to render the raising of it in later proceedings necessarily abusive. That is to adopt too dogmatic an approach to what should in my opinion be a broad, merits-based judgment which takes account of the public and private interests involved and also takes account of all the facts of the case, focusing attention on the crucial question whether, in all the circumstances, a party is misusing or abusing the process of the court by seeking to raise before it the issue which could have been raised before. As one cannot comprehensively list all possible forms of abuse, so one cannot formulate any hard and fast rule to determine whether, on given facts, abuse is to be found or not. Thus while I would accept that lack of funds would not ordinarily excuse a failure to raise in earlier proceedings an issue which could and should have been raised then, I would not regard it as necessarily irrelevant, particularly if it appears that the lack of funds has been caused by the party against whom it is sought to claim. While the result may often be the same, it is in my view preferable to ask whether in all the circumstances a party’s conduct is an abuse than to ask whether the conduct is an abuse and then, if it is, to ask whether the abuse is excused or justified by special circumstances. Properly applied, and whatever the legitimacy of its descent, the rule has in my view a valuable part to play in protecting the interests of justice.”

“11. The Defendant, whilst the DPA 1998 was in force, collected, compiled, stored and disseminated the Claimant’s personal data and information relating to (or purporting to the relate to) the Claimant.”

“1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless - (a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met. 2 Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. 3 Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. 4 Personal data shall be accurate and, where necessary, kept up to date. 5 Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. 6 Personal data shall be processed in accordance with the rights of data subjects under this Act. 7 Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. 8 Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.”

“1 The data subject has given his consent to the processing. 2 The processing is necessary - (a) for the performance of a contract to which the data subject is a party, or (b) for the taking of steps at the request of the data subject with a view to entering into a contract. 3 The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract. 4 The processing is necessary in order to protect the vital interests of the data subject. 5 The processing is necessary - (a) for the administration of justice, (b) for the exercise of any functions conferred on any person by or under any enactment, (c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or (d) for the exercise of any other functions of a public nature exercised in the public interest by any person. 6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. (2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.”

“1 The data subject has given his explicit consent to the processing of the personal data. 2(1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment. (2) The Secretary of State may by order - (a) exclude the application of sub-paragraph (1) in such cases as may be specified, or (b) provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied. 3 The processing is necessary - (a) in order to protect the vital interests of the data subject or another person, in a case where - (i) consent cannot be given by or on behalf of the data subject, or (ii) the data controller cannot reasonably be expected to obtain the consent of the data subject, or (b) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld. 4 The processing – (a) is carried out in the course of its legitimate activities by any body or association which - (i) is not established or conducted for profit, and (ii) exists for political, philosophical, religious or trade-union purposes, (b) is carried out with appropriate safeguards for the rights and freedoms of data subjects, (c) relates only to individuals who either are members of the body or association or have regular contact with it in connection with its purposes, and (d) does not involve disclosure of the personal data to a third party without the consent of the data subject. 5 The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject. 6 The processing - (a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), (b) is necessary for the purpose of obtaining legal advice, or (c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights. 7(1) The processing is necessary - (a) for the administration of justice, (b) for the exercise of any functions conferred on any person by or under an enactment, or (c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department. (2) The Secretary of State may by order - (a) exclude the application of sub-paragraph (1) in such cases as may be specified, or (b) provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied. 8(1) The processing is necessary for medical purposes and is undertaken by - (a) a health professional, or (b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional. (2) In this paragraph ‘medical purposes’ includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services. 9(1) The processing - (a) is of sensitive personal data consisting of information as to racial or ethnic origin, (b) is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and (c) is carried out with appropriate safeguards for the rights and freedoms of data subjects. (2) The Secretary of State may by order specify circumstances in which processing falling within sub-paragraph (1)(a) and (b) is, or is not, to be taken for the purposes of sub-paragraph (1)(c) to be carried out with appropriate safeguards for the rights and freedoms of data subjects. 10 The personal data are processed in circumstances specified in an order made by the Secretary of State for the purposes of this paragraph.”

“You will be aware that the clinicians’ accounts of their communications with third parties are set out in the letters from Fiona Edwards [the Defendant’s then CEO] referred to above and we do not propose to recite them at length in this letter. We adopt the conclusion reached by Fiona Edwards in her correspondence and recognise that there was some disclosure to third parties that was made without your consent. To that end our client is prepared to make an offer of damages to reflect the nature and extent of that disclosure and we have attached to this letter a Part 36 offer of settlement. We believe that this offer is a reasonable offer that reflects the admitted breaches. We would refer you to the recent report in the case of P v A local Authority [2016] EWHC 2779 (Fam) where local authority has paid a vulnerable transgender teenager £4,750 in damages after a member of staff breached his privacy by disclosing personal information about him to friends of his estranged adoptive parents.”

“1. Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’.)”

“(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

“Legal basis for processing personal information: This summarises the legal authority that we, under current data protection legislation, process personal data, and the areas they cover. There are 2 levels of personal information: • Level 1 data, such as your name, your address, your birth date. (Article 6(1)) • Level 2 data (also called ‘special categories’), such as your health records. (Article 9(2))”

“… (e) the exercise of a function conferred on a person by an enactment or rule of law …”

“(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of [domestic law] or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; (i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;”

“Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under domestic law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under domestic law or rules established by national competent bodies.”

“(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent”

“Vital interests are intended to cover only interests that are essential for someone’s life. So this condition is very limited in its scope, and generally only applies to matters of life and death. This condition only applies if the individual is physically or legally incapable of giving consent. This means you should ask for explicit consent if possible. If a data subject refuses consent, you cannot rely on vital interests as a fallback condition, unless they are not legally competent to make that decision. “This condition is likely to be most relevant where there is an urgent need to use a person’ personal data for medical care, but they are unconscious or otherwise incapable of giving consent.”

“(1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the [UK GDPR] (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2) - … (c) point (h) (health and social care); (d) point (i) (public health); … (2) The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the [UK GDPR] for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.”

“2(1) This condition is met if the processing is necessary for health or social care purposes. (2) In this paragraph ‘health or social care purposes’ means the purposes of - (a) preventive or occupational medicine, (b) the assessment of the working capacity of an employee, (c) medical diagnosis, (d) the provision of health care or treatment, (e) the provision of social care, or (f) the management of health care systems or services or social care systems or services. (3) See also the conditions and safeguards in Article 9(3) of the [UK GDPR] (obligations of secrecy) and section 11(1).”

“(1) For the purposes of Article 9(2)(h) of the [F1UK GDPR] (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the [F1UK GDPR] (obligation of secrecy) include circumstances in which it is carried out— (a) by or under the responsibility of a health professional or a social work professional, or (b) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.”

“Please see attached Police Notification regarding the above named client for you to make a decision about your involvement.”

“14. The completion and submission of an 'Adult at Risk' form indeed serves as an important component of safeguarding procedures, designed to protect individuals who may be vulnerable due to age, illness, or a mental or physical condition, and who are unable to protect themselves against significant harm or exploitation. Such forms are typically used to document and report concerns, not necessarily to instigate health or social care services.”

“Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. 2. In the 2018 Act - (a) section 10 makes provision about when the requirement in paragraph 1 of this Article for authorisation by domestic law is met; (b) section 11(2) makes provision about the meaning of ‘personal data relating to criminal convictions and offences or related security measures’.”

“(4) Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority. (5) The processing meets the requirement in Article 10(1) of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.”

“In Article 10 of the UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to - (a) the alleged commission of offences by the data subject, or (b) proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.”

“(1) The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. (2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.”

“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: a the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; c the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); d the personal data have been unlawfully processed; e the personal data have to be erased for compliance with a legal obligation [under domestic law]; f the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).”

“(3) Paragraphs 1 and 2… shall not apply to the extent that processing is necessary: a for exercising the right of freedom of expression and information; b for compliance with a legal obligation which requires processing [under domestic law] or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; c for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3); d for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or e for the establishment, exercise or defence of legal claims.” e for the establishment, exercise or defence of legal claims.”

“Right to respect for private and family life 1 Everyone has the right to respect for his private and family life, his home and his correspondence. 2 There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

“53. Even if the court were to find the retention schedule is a necessity for the retention of data and proportionate the court should give wight to very specific circumstances in this case as per [89] of Johnson J’s judgement in AB v Chief Constable of British Transport Police [2022] EWHC 2749 (KB). Having information about one’s life collected covertly with a running commentary and then to having the most sensitive parts of one’s life distributed to multiple parties without their knowing would be distressing to anyone and its continued retention continues to be extremely distressing to C and left them feeling fearful and violated..”

“1. This appeal is concerned with the systematic collection and retention by police authorities of electronic data about individuals. The issue in both cases is whether the practice of the police governing retention is lawful, as the appellant police commissioner contends, or contrary to article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, as the respondent claimants say. A particular feature of the data in question is that they consist entirely of records made of acts of the individuals in question which took place in public or in the common spaces of a block of flats to which other tenants had access. The information has not been obtained by any intrusive technique such as bugging or DNA sampling. In the first appeal, Mr John Catt objects to the retention on a police database of records of his participation in political demonstrations going back to 2005. In the second appeal, Ms T objects to the retention on a police database of a record of a minor altercation with a neighbour which the latter reported to the police. Each of them accepts that it was lawful for the police to make a record of the events in question as they occurred, but contends that the police interfered with their rights under article 8 of the Convention by thereafter retaining the information on a searchable database. I shall have to say more about the facts of these cases in due course. Both claims failed at first instance. In the Court of Appeal, they were heard together, and both appeals were allowed: [2013] 1WLR3305.”

“The Commission recalls that the notion of necessity implies that the interference corresponds to a pressing social need and, in particular, that it is proportionate to the legitimate aim pursued. However, the national authorities enjoy a margin of appreciation, the scope of which depends not only on the nature of the legitimate aim pursued but also on the particular nature of the interference involved … in the present case it is necessary to weigh the respondent State’s interest in protection of health or the rights and freedoms of others against the seriousness of the infringement of the applicant’s right to respect for her private life.”

“33. The parties agreed that the applicant’s medical data formed part of her private life and that the collection of such data by the MADEKKI constituted an interference with her right to respect for her private life. The Court sees no reason to hold otherwise. Therefore there has been an interference with the applicant’s right to respect for her private life. It remains to be determined whether the interference complied with the requirements of the second paragraph of Article 8 of the Convention.”

“It is well-established in the case-law of the Court that storing and sharing data relating to the private life of an individual and, more specifically, personal medical data, amounts to an interference with Article 8 of the Convention and therefore attracts its protection (see S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, § 67, ECHR 2008, and L.L. v. France, no. 7508/02, § 32, ECHR 2006-XI).”

“15. It is evident in the present case that the healthcare institutions had the applicant’s medical records in their possession, had in the past kept her name on the hospital register of persons suffering from psychiatric disorders, and shared that information in their internal communications and submissions to the domestic courts. The applicant did not call into question the fact that that the storing and sharing of that data as such was prescribed by law or that it pursued a legitimate aim. Indeed, it has previously been accepted that within the meaning of Article 8 of the Convention the recording of information concerning mental patients serves not just the legitimate interest of ensuring the efficient running of the public hospital service, but also that of protecting the rights of the patients themselves (see Yvonne Chave née Jullien v. France (dec.), no. 14461/88, 9 July 1992). 16. The crux of the applicant’s complaints concerning the presence of her name on the hospital register and the sharing of information concerning her mental health rests on her disagreement with the diagnosis given by the psychiatrists. At the same time, the applicant did not argue that her medical records were at any point divulged to the general public or made generally accessible in any other way. Nor did she argue that the procedures employed by the healthcare institutions and the courts to share the information regarding her mental health lacked sufficient safeguards. 17. Having regard to the legitimate aim mentioned above, the Court accepts that it was necessary for the effective operation of the domestic healthcare institutions and the decision-making of the courts to store and share the relevant information (see, a contrario, L.L. v. France, cited above, §§ 45-46). Nothing in the material in the Court’s possession indicates that the information was made accessible to the public or was used for any other purpose [than deciding on the most suitable medical care for the applicant. 18. Accordingly, the Court concludes that the complaints concerning the presence of the applicant’s name on the hospital register of persons suffering from psychiatric disorders between 1985 and 1992 and the allegedly false references to various aspects of her mental health in the subsequent internal communications between the healthcare institutions and in their submissions to the courts are manifestly ill-founded and must be rejected …”

“The collection, storage, and disclosure of information by the state about an individual will interfere with his right to respect for his private life. Thus Article 8 is engaged in respect of data collection by an official census; fingerprinting and photography by the police; the collection and storage of cellular samples and DNA profiles; the collection of medical data and the maintenance of medical records, and the collection and storage of GPS data.”

“… a guide for you to use in relation to the practice of managing records. It is relevant to organisations working within, or under contract to, the NHS in England. The Code also applies to adult social care and public health functions commissioned or delivered by local authorities. The Code provides a framework for consistent and effective records management based on established standards. It includes guidelines on topics such as legal, professional, organisational and individual responsibilities when managing records. It also advises on how to design and implement a records management system including advice on organising, storing, retaining and deleting records. It applies to all records regardless of the media they are held on. Wherever possible organisations should be moving away from paper towards digital records.”

“Retention periods begin when the record ceases to be operational. This is usually at the point of discharge from care when the record is no longer required for current on-going business, or the patient or service user has died.”

“… the question [of whether a measure is proportionate depends on an exacting analysis of the factual case advanced in defence of the measure, in order to determine (i) whether its objective is sufficiently important to justify the limitation of a fundamental right; (ii) whether it is rationally connected to the objective; (iii) whether a less intrusive measure could have been used; and (iv) whether, having regard to these matters and to the severity of the consequences, a fair balance has been struck between the rights of the individual and the interests of the community. These four requirements are logically separate, but in practice they inevitably overlap because the same facts are likely to be relevant to more than one of them.”

“74. The judgment of Dickson CJ in Oakes [1986] 1 SCR 103], provides the clearest and most influential judicial analysis of proportionality within the common law tradition of legal reasoning. Its attraction as a heuristic tool is that, by breaking down an assessment of proportionality into distinct elements, it can clarify different aspects of such an assessment, and make value judgments more explicit. The approach adopted in Oakes can be 791summarised by saying that it is necessary to determine (1) whether the objective of the measure is sufficiently important to justify the limitation of a protected right, (2) whether the measure is rationally connected to the objective, (3) whether a less intrusive measure could have been used without unacceptably compromising the achievement of the objective, and (4) whether, balancing the severity of the measure’s effects on the rights of the persons to whom it applies against the importance of the objective, to the extent that the measure will contribute to its achievement, the former outweighs the latter. The first three of these are the criteria listed by Lord Clyde in de Freitas, and the fourth reflects the additional observation made in Huang. I have formulated the fourth criterion in greater detail than Lord Sumption JSC, but there is no difference of substance. In essence, the question at step four is whether the impact of the rights infringement is disproportionate to the likely benefit of the impugned measure.”

“75. In relation to the third of these criteria, Dickson CJ made clear in R v Edwards Books and Art Ltd[1986] 2 SCR 713, 781–782 that the limitation of the protected right must be one that “it was reasonable for the legislature to impose”, and that the courts were “not called on to substitute judicial opinions for legislative ones as to the place at which to draw a precise line”

“The question is whether a less intrusive measure could have been used without unacceptably compromising the objective.”

“It does not amount to insistence that the least intrusive measure is selected. It is that consideration be given to whether the legitimate aim can be achieved by a less intrusive measure without significantly compromising it.”

“84. … Put more shortly, the question at step four is whether the impact of the right's infringement is disproportionate to the likely benefit of the impugned measure. Another way of framing the same question is to ask whether a fair balance has been struck between the rights of the individual and the interests of the community: see the Bank Mellat case at para 20 (Lord Sumption).”

“A wide margin is usually allowed to the state under the Convention when it comes to general measures of economic or social strategy. Because of their direct knowledge of their society and its needs, the national authorities are in principle better placed than the international judge to appreciate what is in the public interest on social or economic grounds, and the Court will generally respect the legislature's policy choice unless it is 'manifestly without reasonable foundation'.”

“34. Various expressions have been used in the case law to describe the quality of the judicial scrutiny called for when considering the proportionality of an interference with a Convention right: ‘heightened’, ‘anxious’, ‘exacting’, and so on ... But the legal principle is clear enough. The court must test the adequacy of the factual basis claimed for the decision: is it sufficiently robust having regard to the interference with Convention rights which is involved? It must consider whether the professed objective can be said to be necessary, in the sense that it reflects a pressing social need. It must review the rationality of the supposed connection between the objective and the means employed: is it capable of contributing systematically to the desired objective, or its impact on the objective arbitrary? The court must consider whether some less onerous alternative would have been available without unreasonably impairing the objective. The court is the ultimate arbiter of the appropriate balance between two incommensurate values: the Convention rights engaged and the interests of the community relied on to justify interfering with it. But the court is not usually concerned with remaking the decision-maker's assessment of the evidence if it was an assessment reasonably open to her. Nor, on a matter dependent on a judgment capable of yielding more than one answer, is the court concerned with remaking the judgment of the decision-maker about the relative advantages and disadvantages of the course selected, or of pure policy choices (eg do we wish to engage with Iran at all?). The court does not make the substantive decision in place of the executive. On all of these matters, in determining what weight to give to the evidence, the court is entitled to attach special weight to the judgments and assessments of a primary decision-maker with special institutional competence.”

“iii) The assessment of proportionality is a matter for the Court, giving appropriate weight to the views of those with particular expertise in the relevant field.”

“For the purposes of this Act data are inaccurate if they are incorrect or misleading as to any matter of fact.”

“7 The fourth principle is not to be regarded as being contravened by reason of any inaccuracy in personal data which accurately record information obtained by the data controller from the data subject or a third party in a case where - \ (a) having regard to the purpose or purposes for which the data were obtained and further processed, the data controller has taken reasonable steps to ensure the accuracy of the data, and (b) if the data subject has notified the data controller of the data subject’s view that the data are inaccurate, the data indicate that fact.”

“80. NT1’s case is that there have been breaches of the first part of the Fourth Principle: the requirement that personal data “shall be accurate”

“In general, ‘accurate’ means accurate as to a matter of fact. There is a difference between a search result that clearly relates to one person’s opinion of another person and one that appears to contain factual information. In data protection law the concepts of accuracy, adequacy and incompleteness are closely related. DPAs will be more likely to consider that de-listing of a search result is appropriate where there is inaccuracy as to a matter of fact and where this presents an inaccurate, inadequate or misleading impression of an individual. When a data subject objects to a search result on the grounds that it is inaccurate, the DPAs can deal with such a request if the complainant provides all the information needed to establish the data are evidently inaccurate.” “In general, ‘accurate’ means accurate as to a matter of fact. There is a difference between a search result that clearly relates to one person’s opinion of another person and one that appears to contain factual information. In data protection law the concepts of accuracy, adequacy and incompleteness are closely related. DPAs will be more likely to consider that de-listing of a search result is appropriate where there is inaccuracy as to a matter of fact and where this presents an inaccurate, inadequate or misleading impression of an individual. When a data subject objects to a search result on the grounds that it is inaccurate, the DPAs can deal with such a request if the complainant provides all the information needed to establish the data are evidently inaccurate.”

“(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);”

“49. Finally, any other relevant remaining allegations in the Particulars of Claim are too vague to succeed and in particular: i. YSL has failed to plead a proper case on how his records are inaccurate. He should have pleaded first the meaning of the records as to a matter of fact, and then set out why he says the records are factually incorrect …”

“… to hand down the judgement in private, restrict access to the judgment, amend the anonymity order in the case or extended the period of which the judgement is to be handed down. This request is made due to my current physical and mental health.”

“AND UPON consideration of the Claimant’s Article 8 right to respect for private and family life and the Article 10 right to freedom of expression. AND UPON IT APPEARING that non-disclosure of the identity of the Claimant is necessary in order to protect the interests of the Claimant.”