In the County Court case of Brown v Commissioner of Police for the Metropolis, a global award of 9,000 in damages was made, split between the two defendants, the Metropolitan Police Service (MPS) and the Greater Manchester Police (GMP). The claimant had travelled to the Caribbean with her daughter while on sick leave without giving her whereabouts to her line manager.

The claimant's actions were in breach of the police service's absence management procedures. In order to provide evidence for disciplinary proceedings against the claimant, an officer at the MPS contacted the National Border Targeting Centre managed by GMP. The correspondence included provision of the subject's name and passport photograph to identify her. This was an unlawful use.

The court made a global award for the breaches of the Data Protection Act and Human Rights Act, and tort of misuse of private information. However, the claimant's proposed minimum of 10,000 for damages was deemed inappropriate in the circumstances.

What Should Employers Do Next?

Employers should make certain that staff know not only what constitutes (sensitive) personal information, but also that it must not be used for any purpose outside that for which it was obtained.