This case relates to disclosures made under the crime and taxation exemption under s29 Data Protection Act 1998 ("DPA"). In this case, the police were investigating various sexual assault complaints on campus at Loughborough University. An informant told the police that the claimant, Mr Bangura, had been acting suspiciously. The informant gave the police at least part of the claimant's name and his address.
The university also disclosed Bangura's registration form to the police (which included his full name, address and date of birth) prior to a formal written request from the police. Bangura was arrested but later released and never charged.
Bangura alleged that disclosure of personal data by the university was a breach of the DPA and also a breach of contract. The purported contract was, in part, the university's data protection policy which stated that any requests for disclosure of personal data needed to be made in writing.
The High Court held that s29 DPA did not require a request for disclosure to be made in writing. Furthermore s29 DPA exempts a data controller from the obligation to process data fairly and lawfully but still required a Schedule 2 DPA processing condition to apply. The High Court held that disclosure was clearly in the legitimate interests of the university and the police thereby satisfying the processing condition in paragraph 6(1) of Schedule 2 DPA. There was therefore no breach of s29 DPA.
In terms of the allegation of breach of contract, the High Court ruled that the argument that the data protection policy had contractual force "was not sustainable". Neither the registration form nor the policy itself purported to incorporate the policy as part of the contract between the student and the university. The policy sets the practices that the university is expected to adopted and is not invariable.
In any event the loss in question (Bangura's arrest) had been caused by disclosure of personal details by the informant, not the university!
To read the full case please click here(Westlaw).