The case of Brown v. Commissioner of Police for the Metropolis is a reminder to employers that it is unlawful to use employees' personal information for anything other than its intended purpose.
Under the Data Protection Act 1998 (DPA), personal information is any data which relates to any individual that will identify that individual. It can also be data or information which a data controller holds in relation to an individual, or is likely to hold. Personal information can include any opinion given about the individual and any indication of the intentions of the data controller or any other person in respect of that individual.
The Claimant, a police officer, was on sick leave from her employment at the Defendant, the Metropolitan Police Service (MPS). Whilst on sick leave, the Claimant breached police procedures and travelled to Barbados with her daughter. She did not notify her manager of her travels, and the MPS brought disciplinary proceedings against her.
To obtain evidence for use in the proceedings, the MPS requested the Claimant's personal information from the National Border Targeting Centre and from the airline with which she had travelled. The MPS received the Claimant's flight details, passport photograph, date of birth, name and information about her daughter.
The County Court held that the MPS had unlawfully obtained the Claimant's personal information. The Claimant was awarded £9,000 in compensation.
The damages were awarded in respect of:
- Article 8, Human Rights Act 1998: the MPS breached the right to respect for private and family life from interference by a public authority. The police should be acutely aware of its responsibilities in respect of this right.
- Section 13 (1)/(2) DPA 1998: the Claimant was entitled to compensation for damage suffered in respect of any breach by a data protection officer. "Damage" in this case took the form of the distress suffered by the Claimant.
The damages in this case were notable. The court noted the difficulty in determining the amount that should be awarded in respect of distress. The guidance from the High Court, whilst used, started at a minimum of £10,000, which was disproportionately high in this class of case. The award was set at £9,000 in light of the absence of any repeated misuse of the personal data and the fact that it was not obtained with any intent to injure or embarrass the Claimant.
This case is a reminder to employers to be careful when requesting their employees' personal information. Employers and staff must be aware of both what constitutes personal information and the purpose for which it was obtained. It is advisable to ensure that staff are aware of data protection laws and compliance training should be organised. It is notable that, in this case, the Defendant was the police force, an organisation which should be even more alert to the pitfalls of obtaining personal information unlawfully.
Whilst this case did not concern sensitive personal information, employers should also be aware that there are additional requirements for handling sensitive personal information. Most importantly, explicit consent of the data subject must be obtained unless the employer can rely on any of the limited specific exceptions as set out in Schedule 3 DPA 1998. These include where the data must be obtained under employment law, where it is required by a health professional, or if it is in the context of equal opportunity monitoring.