BAILII [Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]

England and Wales High Court (King's Bench Division) Decisions


You are here: BAILII >> Databases >> England and Wales High Court (King's Bench Division) Decisions >> YSL v Surrey and Borders Partnership NHS Foundation Trust (Rev1) [2024] EWHC 391 (KB) (22 February 2024)
URL: http://www.bailii.org/ew/cases/EWHC/KB/2024/391.html
Cite as: [2024] EWHC 391 (KB)

[New search] [Context] [View without highlighting] [Printable PDF version] [Help]


Neutral Citation Number: [2024] EWHC 391 (KB)

Case No: QB-2022-000798

IN THE HIGH COURT OF JUSTICE

KING'S BENCH DIVISION

MEDIA AND COMMUNICATIONS LIST

 

 

Royal Courts of Justice

Strand, London, WC2A 2LL

 

Date: 22/02/2024

 

Before :

 

MR JUSTICE JULIAN KNOWLES

- - - - - - - - - - - - - - - - - - - - -

Between:

 

 

YSL

Claimant

 

- and -

 

 

     SURREY AND BORDERS PARTNERSHIP NHS FOUNDATION TRUST 

Defendant

 

- - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - -

 

YSL appeared in person

Jack McCracken (instructed by Clyde & Co LLP) for the Defendant

 

Hearing dates: 14th & 15th June 2023

- - - - - - - - - - - - - - - - - - - - -

Approved Judgment


 

 

This judgment was handed down remotely at 10.30am on 22 February 2024 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

 

.............................

 

 

 

Mr Justice Julian Knowles:

Introduction

1.           There is an anonymity order in place for this case protecting the Claimant’s identity and he will be referred to as the Claimant or YSL.

2.           His claim against the Defendant is brought under data protection legislation, privacy and the Human Rights Act 1998.  It concerns his patient records and what he regards as the unlawful processing and retention of his personal data by the Defendant.  He also maintains a complaint about the accuracy of some of the data. 

3.           Paragraph 2 of his trial Skeleton Argument asserted:

“Since April 2011, D has been engaging in a pattern of unauthorized data collection about C, gathering excessive amounts of information without C's knowledge or consent. The collected data covers an extensive range of personal details, including intimate aspects of C's private life like his bathroom and eating habits, hobbies, sexual orientation, racial identity, medical data, and even future reproductive intentions. At this time C did not consent to the “treatment” nor was he aware of what was going [on] ...”

4.           The claim has something of a history, as I shall explain. As the Claimant said, it relates to matters going back to around 2011, and continuing thereafter.

5.           The Claim Form was sealed on 10 March 2022 and served with Particulars of Claim (PoC).  YSL filed and served a witness statement dated 19 April 2022.  The Defendant filed a Defence in May 2022. YSL filed a Reply in July 2022.

6.           In March 2023 the Claimant made an application for summary judgment. I mean no disrespect when I say this was largely a reiteration of what he sees as the merits of his claim.   His witness statement in support and exhibits ran to over 150 pages.   Senior Master Fontaine ordered that to be dealt with at a hearing (the Claimant had sought summary judgment without a hearing).

7.           Then, on 6 June 2023, the week before the trial, which was listed for 14/15 June 2023, YSL filed a notice of discontinuance.  That was signed by both parties. However, almost immediately, YSL withdrew it with the Court’s consent. 

8.           On 9 June 2023 I made an ‘unless’ order requiring the Claimant to comply with trial directions which Deputy Master Fine had made in December 2022 requiring the filing of a bundle and Skeleton Arguments and the like, which the Claimant had not complied with.  My order provided that in the event of non-compliance, the claim would stand dismissed.     

9.           Also on 9 June 2023, the Defendant applied to strike out the claim on the grounds, first and foremost, that there was a compromise or settlement reached between the Claimant and the Defendant as long ago as 2016 in relation what it said were the same matters largely or wholly covered by the present claim. Further or alternatively, the Defendant said the claim should be struck out on as an abuse of process on the basis of the principles in Johnson v Gore Wood & Co [2002] 2 AC 1, and for other reasons.

10.        The Claimant complied with my unless order.  In the days leading up to the trial there was a flurry of material from both sides, including Skeleton Arguments and evidence, and also draft Amended Particulars of Claim from the Claimant.   Over 4000 pages of authorities alone were filed.   There are numerous different bundles and supplementary bundles.   I did essential pre-reading before the hearing, but there has needed to be extensive post-hearing reading and research.

11.        I should make clear in relation to the draft Amended Particulars of Claim that no consent to amendment has been forthcoming from the Defendant pursuant to CPR r 17.1(2)(a), and the Claimant has not made an application under CPR r 17.1(2)(b) for the Court’s permission to amend his PoC.   This judgment therefore proceeds on the basis of the claim as presented in the PoC.

12.        In the event, I heard the strike-out application and heard evidence on the trial (and YSL’s summary judgment application) immediately thereafter, and reserved judgment on all matters.   I afforded YSL a number of breaks during the case at his request.  I also rose early on the first day of the hearing, again at his request.  I bear (and bore) in mind that he is a litigant in person and that hearings are stressful.   I am satisfied that YSL had a full and proper opportunity to present his case and he did not suggest otherwise (although I note his written submissions about the alleged lateness of the Defendant’s strike-out application).  The Defendant’s case was presented with fairness and sensitivity by Mr McCracken.

13.        In this judgment I will use the following abbreviations: Data Protection Act 1998 (DPA 1998); Data Protection Act 2018 (DPA 2018); General Data Protection Regulation ((EU) 2016/679) (EU GDPR); the  retained version of  the EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of s 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419) (the UK GDPR).

14.        I will refer several times to the ‘processing’ of data in this judgment.  Article 4(2) of the UK GDPR states that ‘processing’ means:

“… any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;”

Background

15.        YSL is currently a student but has done, or is also doing, other things.  

16.        I have taken some of the chronology that follows from the witness statement dated 9 June 2023 of Michelle Golden, a solicitor with the Defendant’s solicitors Clyde & Co LLP (Clyde & Co), in support of its strike-out application.  The witness statement is obviously verified by a statement of truth.  I do not regard what follows as being controversial.

17.        YSL was a patient of the Defendant under its CAMHS (Child and Adolescent Mental Health Services) from around April 2011 to the time of his discharge from CAMHS on 23 October 2014. During his time at CAHMS he was treated by, amongst others, Dr JW, a Clinical Psychologist, and Dr DG, a Child and Adolescent Psychotherapist

18.        YSL was subsequently assessed by the Defendant’s Psychiatric Liaison Service on 4 February 2016. He was by that time an adult.

19.        The thrust (but not the entirety) of YSL’s present claim relates to medical and other records held by the Defendant as a result of his  interactions with it, mainly while he was under the care of CAMHS. To put it neutrally, his complaint is that certain records and personal data were unlawfully disclosed to third parties; that some are inaccurate (including in particular a potential diagnosis of autism); and that the Defendant’s records retention policy whereby records are kept for 20 years is unlawful because it is disproportionate and breaches his fundamental rights, and he seeks erasure of his entire patient records as a result.   He also complains about the processing of material by the Defendant received from Surrey Police about him via something called the Surrey Multi-Agency Sharing Hub (MASH), a mechanism by which different agencies can share information about adults potentially at risk.

Background to YSL’s various claims against the Defendant from 2015 - 2023

20.        I note from YSL’s medical records in the bundle at E/121 that there is an entry for 5 January 2016:

“Tue 05 Jan 2016 08:20 … MM Acrobat Document: accreq [YSL] 1073953.pdf - Subject Access Request”

21.        I take from this that YSL made a subject access request (SAR) around this time for his medical records. There is a similar entry on 25 July 2016, and there are a number of similar entries in later years in YSL’s records.

22.        YSL sent a letter to the Defendant notifying his intention to take legal action as long ago as 17 June 2016. YSL had complained to the Defendant in or around 2015 and an internal complaints procedure had followed.  It would appear there had also been a meeting between the Claimant and staff from the Defendant. 

 

23.        The letter made a number of complaints, including about Dr JW.  It said that she had sent a letter to YSL’s school allegedly breaking his confidentiality, and undertook an autism assessment’. The letter also complained about Dr DG, including that he had telephoned YSL’s school and had ‘confirmed’ increased obsessional behaviour and ‘Asperger’s traits’.

 

24.        The letter made many complaints about his records from his CAMHS treatment. It ended by stating that the Defendant had breached the Data Protection Act 1998 and Article 8 of the European Convention on Human Rights (ECHR/the Convention) read with the Human Rights Act 1998. YSL stated he would be seeking ‘compensation … and should this go to court I will also be asked for other legal remedies’.  High Court litigation was said to be contemplated by 21 June 2016.

 

25.        In or around 29 July 2016 YSL sent a Part 36 offer to the Defendant. He sought £40,000 in compensation; erasure of all information relating to him, as he did not consent or was made aware of any storage of his data; a full apology; disciplinary action against Dr SM (another CAMHS doctor); and agreement by the Defendant to terminate the employment of Dr SW and Dr DG for a period of not less than three years.

 

26.        For the reasons set out in Ms Golden’s witness statement at [14], I am satisfied that any privilege which existed in this offer has been waived as a result of YSL referring to it and its terms in his PoC and in his evidence.

 

27.        I move forward to September 2016. Paragraph 15 of Ms Golden’s statement said this:

 

“15. It appears YSL sent his first formal letter of claim (assuming the letter of 17 June 2016 is not treated as a letter of claim) to the Trust in respect of legal action over his medical records on 6 September 2016. I exhibit a copy as MG3. The letter of claim appears on its face undated, but I believe the correct date is 6 September 2016 from information in a privileged document created by Weightmans LLP close to the time (if there is any dispute about the date of the letter of claim the Trust will waive privilege over the document but only to the extent of proving the date of the letter of claim to be 6 September 2016). This letter of claim, written pursuant to the defamation pre-action protocol, gave a list of eleven main examples of defamation and sought damages of £200,000 for what YSL described as ‘defamation, inaccuracies in his medical records, and breach of confidence’.

 

28.        It is accepted by the Defendant there is an inadvertent mistake in this paragraph, in that the quote at the end of the paragraph did not appear in YSL’s letter, but is a descriptive summary of the allegations in the letter.

 

29.        On 17 November 2016, Weightmans LLP, the Defendant’s then solicitors,  responded to YSL in without prejudice correspondence. For the same reasons as earlier, I consider that without prejudice privilege no longer exists. This letter finished by stating that:

 

 “… we note that in your recent Part 36 offer you made a request that all the documentation held by the Trust relating to be erased. Our client is not as a matter of law able to action this request. We would refer you to the Guidance: Requesting amendments to health and social care records issued by the National Information Governance Board  for Health and Social Care.”

30.        The Guidance referred to said (inter alia):

“Providing care and treatment is often complicated and based on trust between you and the professionals providing it. Professionals will usually make decisions about care or treatment based on what happened or what was done previously. For this reason, it is important to you and the professionals that the whole record (including any amendments, who made them, and why) is available.

Completely removing one or more pieces of information from a record so that no one knows it was ever there can be like taking a chapter out of a book - the following chapters often do not make sense.”

31.        Enclosed with this letter was a Part 36 offer to settle the proposed claim in the sum of £6,000.  (Neither side now has a copy of the actual offer itself;  I was told that the Defendant’s initial offer may have been lower, and that it was an open offer and not a Part 36 offer, but little turns on those matters now.)

32.        What is clear is that YSL and the Defendant reached an agreement on or around 23 November 2016 when YSL signed a Form of Receipt and Discharge (which we do have).  That stated:

“I [YSL of address] agree to accept the sum of £6,000 in full and final satisfaction and discharge of all claims that I may have against Surrey & Borders Partnership NHS Foundation Trust arising out of the disclosure of my personal information to third parties by staff at the Trust Children & Adolescent Mental Health Services including [Dr JW and Dr DG] whilst I was under their care in 2011 and 2012.”

33.        A few days after signing this, YSL sent a second formal letter of claim to the Defendant dated 28 November 2016.  Ms Golden did not have a copy of the letter when she wrote her witness statement, but she understood that the issues raised in the letter included claims under the DPA 1998; the Human Rights Act 1998; for defamation; under the Equality Act 2010; and for misfeasance in a public office. Complaints were again made about Dr SWt, Dr DG and others involved in his treatment. This time YSL sought compensation of £2.5 million together with a formal apology, and repeated his previous request that all of his information be removed from the Defendant’s systems.

34.        The Defendant, via Steven Chahla of the NHS Litigation Authority, emailed YSL on 20 March 2017 about a complaint which YSL had made. Mr Chahla apologised for various lapses in communication, but said:

“I accept that our communication with you should have been better. We did not acknowledge your original letter of claim dated 17 June 2016 until 15 July, and the next communication with you appears to be your email sent on 5 September attaching a Part 36 offer to accept £40,000. In that email you mentioned a second letter of claim sent to the trust, which we received on 6 September. However, we did not acknowledge your second letter until 5 October.

I apologise for failing to keep you better informed about the progress of our investigations. I note that we eventually concluded settlement of your claims for £6,000 on 23 November 2016.

I apologise again for our shortcomings in communication, but I do not believe that your position has been prejudiced by any delays.  Your claims were brought under a variety of headings, including the Defamation, Data Protection, Human Rights, Equality and Children’s Acts, and all causes were taken into consideration in arriving at a settlement. Martin Forshaw of Weightmans has explained that your defamation claim was always, in law, bound to fail, and that the law will not allow you to bring further claims arising from essentially the same facts on which you have already been compensated.”

35.        On or about 6 December 2019 YSL sent a third letter of claim to the Defendant ‘for breaches of the Data Protection Act 2018, Human Rights Act 1998, European Convention on Human Rights and Common Law Duty of Confidentiality.’   This related to information said to have been obtained from Surrey Police. It sought removal of all ‘information obtained from the Surrey MASH’ (Multi-Agency Sharing Hub); compensation of £7,000; and costs.

 

36.        A manager with NHS Resolution responded by a holding email on 20 December 2019.

 

37.        At some point Clyde & Co took over from Weightmans LLP as the Defendant’s solicitors.

 

38.        On 28 February 2020 Clyde & Co, wrote to YSL responding to his letter of claim and denied liability, setting out the Defendant’s reasons.

 

39.        YSL made a further SAR to the Defendant on 1 October 2020.  He made a further request on 5 September 2021 stating, ‘I wish to make a request for all information that is held about myself’.

 

40.        YSL then emailed the Defendant on 8 September 2021 requesting the immediate removal of all his personal data.

 

41.        The Defendant responded by email dated 20 September 2021.

 

42.        On 4 January 2022 the Defendant’s Records Team sent an email at 15.51 to YSL confirming amongst other things that his records could not be erased. It would appear from that email that in the interim YSL had made a complaint to the Information Commissioner’s Office (ICO).

 

43.        On 4 February 2022 YSL sent a fourth formal letter of claim by way of an email at 19.04 to the Defendant. This related again to the retention of his records.  He said that he:

 

“… believes that the continued processing and retention of their Personal Data is unlawful and the Defendants failure to comply with contents of the request is also lawful. The Defendant unlawfully obtained and processed the Claimants Data. Including (but not limited to) failing to comply with the lawfulness, fairness and transparency requirements and failing to ensure the accuracy of Data.”

 

44.        He sought ‘unspecified damages and an injunction to prevent the continued processing of the Claimant’s Data’ and sought the matter to be resolved in court.

 

45.        On or around 23 February 2022, the Defendant received notice of a hearing in the County Court in relation to a claim by YSL for an injunction.

 

46.        The Defendant served a witness statement from Ms Golden of Clyde & Co dated 4 March 2022 and a Skeleton Argument from counsel opposing the injunction, on both procedural and substantive grounds. This matter was concluded when on 1 June 2022 the Court noted that new proceedings had been issued (ie, the claim before me) and the County Court  matter was therefore consolidated with those new proceedings.

 

47.        On 9 March 2022 YSL issued this claim (Claim No QB-2022- 000798).

 

48.        On 7 December 2022 this matter came on for a costs and case management hearing before Deputy Master Fine and directions were made.

 

49.        On 21 March 2023 YSL issued an application for summary judgment on this claim. This was listed by Senior Master Fontaine to be heard at the trial by order dated 20 April 2023.

 

50.        On 19 April 2023 the parties exchanged witness statements pursuant to an agreed extension. YSL served a statement from himself. The Defendant served a statement from Louis Lau, its data protection officer.  

 

51.        On 20 April 2023 the High Court, at the request of YSL, issued witness summonses to Dr SW and Dr DG.  These were later set aside by consent. 

 

52.        As I have mentioned, on 29 May 2023 YSL sent by email in open correspondence draft amended Particulars of Claim. He sought the Defendant’s agreement to considerable amendments of the original PoC to include new allegations. The amended Particulars of Claim added allegations which substantially increased the page count from 28 to 46 pages. Some allegations were deleted, but the net effect was to increase the allegations pursued.

 

53.        On 1 June 2023, about two weeks before this trial was listed to start, YSL sent a fifth letter of claim to the Defendant.   This related to a letter said to have been sent by Dr DG 11 years earlier, in 2012.   YSL said:

 

“I am writing to notify you of my intent to bring legal action against your organization for serious breaches of the Data Protection Act 1998 (DPA), misuse of private information, breach of confidentiality, and violation of Article 8 of the European Convention on Human Rights (ECHR). I believe your actions amount to unlawful sharing and covert collection of my personal data without my knowledge or consent.

 

My entitlement to remedies stems from your violation of the aforementioned statutes and rights. Specifically, I recently became aware of a letter ‘dispatched’ by [Dr DG] on 8th June 2012 and ‘typed’ on 4th July 2012, sent to my General Practitioner, my mother, and my school. This letter, outlining personal, sensitive information about my mental and emotional health, academic progress, and family relationships, was shared without my consent or knowledge. These actions were taken within England and Wales, making it the most appropriate forum for this dispute. I am self-funding this litigation.”

 

54.        In this letter YSL also said:

 

“Please note that I reserve the right to expand the claims once disclosure takes place and upon further investigation of the circumstances surrounding this matter.”

 

55.        YSL also complained about Surrey Police to the ICO.  He complained that a risk assessment from August 2018 had been shared with both Surrey County Council and the Defendant. On 10 January 2022 the ICO concluded that Surrey Police had not acted contrary to data protection legislation. YSL requested a case review on 10 January 2022, which was unsuccessful, as communicated to him on 24 January 2022.

 

The present claim

 

The Claimant’s claim in summary

 

56.        The Claim Form states that YSL’s claim is for:

 

“Damages (including aggravated damages) for breaches of the Claimant's article 8 human rights, misuse of private information, breaches of the Data Protection Act 1998 and 2018 and breach of the GDPR and UK GDPR.

 

An Injunction to restrain the Defendant, whether by itself, its officers, servants or agents, or otherwise howsoever, from processing information about or relating to the Claimant.

Such further or other relief as is just and appropriate.”

57.        The main allegations in the PoC and in YSL’s trial witness statement of 19 April 2022 are as follows:

a.        Letters were sent by Dr SW and Dr DG to several parties including his GP, family and/or school without his knowledge or consent, which were used by his school to degrade and discredit abuse perpetrated by the school on him (PoC, [11]- [17]; witness statement, [13]).    The relevant paragraphs of the PoC state:

“11. The Defendant, whilst the DPA 1998 was in force, collected, compiled, stored and disseminated the Claimant’s personal data and information relating to (or purporting to the relate to) the Claimant.

12. This included letters by [Ms JW] and [Mr DG], which were sent to several parties including the Claimants GP, Family and/or school. This was done without the Claimants knowledge or consent. Pending full disclosure, the precise extent of publication and republication of the letters is unknown.

13. At the time the Claimant was not presented with a privacy notice, nor did they agree for their information and data to be processed.

14. There were several consent forms signed by the Claimants mother.

15. Pending full disclosure, the Claimant will argue that the fact the trust sought to have consent forms signed demonstrates that the Defendant was using consent as a basis for their processing.

16. [Ms JW] and [Mr DG] not only processed, collected and shared personal information and data, they failed to ensure the accuracy of said information and data and included several degrading and crass comments of their own.

17. [Ms JW] and [Mr DG]’s letters were also used by the Claimants School to degrade and discredit abuse perpetrated by the School on the Claimant.”

b.        Dr DG had a call with [LL] at YSL’s school (witness statement, [15]):

“15. I was then aware of a man, [DG], doing similar things to [JW]. I think I spoke to him once briefly. I then subsequently found out that he had sent a letter to my GP, mother and school without my consent or knowing. When dealing with my school, as part of a subject access request it showed that [LL] (deputy head at [YSL’s  School] had sent an email say that she had a call with [DG] and he ‘confirmed’ asperges and increased obsessional behaviour.”  

c.        Per [16] of the PoC:

“16. [Ms JW] and [Mr DG] not only processed, collected and shared personal information and data, they failed to ensure the accuracy of said information and data and included several degrading and crass comments of their own.”

d.        The Defendant had four risk assessments on its system completed by officers from Surrey Police (PoC, [21]) and failed to adhere to the Surrey MAISP (Multi Agency Information Sharing Protocol (PoC, [26]).  The risk assessments contained information to the effect, for example, that YSL had assaulted his mother; that he had undiagnosed mental health issues; and that he had become obsessed by what information different agencies held about him.)

e.        The Defendant should have, but has failed, to erase his entire medical records because their ongoing retention for 20 years is unlawful as it is a disproportionate interference with his rights under Article 8 (PoC, [57]-[63].

The Defendant’s Defence in summary

58.        The Defendant defends the claim on the following basis.

59.        It denies that it has acted unlawfully in relation to the processing and retention of YSL’s personal data. Insofar as allegations are made about the actions of Surrey Police or other third parties, these do not concern the Defendant, and the Defendant is not responsible for them.

60.        It is denied that the Defendant acted unlawfully in relation to YSL’s data because, in summary:

a.        the Defendant had a lawful basis under the relevant data protection legislation for processing it;

b.        the processing of the data was necessary for the exercise and provision of the Defendant’s functions in relation to the provision of healthcare and maintenance of public health;

c.        further or alternatively, the Defendant had a legitimate interest in processing the Claimant’s data for the purpose of its public health duties and/or the provision of healthcare;

d.        the information shared was reviewed and assessed by the Defendant to ensure the appropriateness of the information being shared;

e.        the processing and retention of the Claimant’s data has been carried out in accordance with the NHSX’ Records Management Code of Practice 2021 (NHSX Code) and the Defendant’s Data Protection Policy.  (NHSX was a Government unit from 2019 to early 2022, with responsibility for setting national policy and developing best practice for NHS technology, digital and data, including data sharing and transparency.)

61.        In relation to alleged unlawful processing of data under the DPA 2018, the EU GDPR and/or the UK GDPR, YSL is required to prove [38]-[42] of the PoC.   These aver:

 

“38. The Defendant, whilst the DPA 2018 and the GDPR or the UK GDPR were in force, collected, compiled and stored the Claimant’s personal data and information relating to (or purporting to the relate to) the Claimant. The processing includes those relating to:

 

(a) Surrey Police reference […] authored by [PC M];

 

(b) Surrey Police reference unknown authored by [PC F].

 

39. The obtaining of information (unlawfully and without the Claimant’s knowing) was not an isolated incident but rather a continuous and chronic course of conduct that has gone on for over a decade.

 

40. Further or alternatively, the Defendant has breached the Claimant’s right to data protection as set out in Article 8 of the EU Charter of Fundamental Rights (the ‘Charter’), the GDPR, the UK GDPR and DPA 2018:

 

(a) the information and data constituted the Claimant’s personal data pursuant to Article 4 (1) of the GDPR and the UK GDPR and section 5 of the DPA 2018 since they were, or they contained or claimed to contain, information relating to the Claimant;

 

(b) the compilation, adaptation, dissemination, disclosure, making available and storage of the Claimants data and information constitute the processing of the Personal Data by the Defendant within the meaning of Article 4 (2) of the GDPR and the UK GDPR and section 4 and 5 of the DPA 2018;

 

(c) the Defendant was the data controller within the meaning of Article 4 (7) of the GDPR, the UK GDPR and section 5 and 32 (1) (a) of the DPA 2018 in respect of each of these processing operations;

 

(d) in obtaining and storing the Claimants personal data and information, the Defendant has failed and continues to fail to process the Personal Data in compliance with the GDPR, the DPA 2018 and the UK GDPR and has failed to give effect to the Claimant's rights under the GDPR, the DPA 2018 and the UK GDPR;

 

(e) by processing the Claimant’s personal data as aforesaid, the Defendant acted in breach of its statutory duty pursuant to Article 5 of the GDPR and the UK GDPR and section 34 of the DPA 2018 to process the Claimant’s personal data and information in accordance with the data protection principles set out in the GDPR and the UK GDPR. In particular, in breach of Article 5 (1) (a) of the GDPR and the UK GDPR and section 34 (1) (a) of the DPA 2018, the Defendant’s processing was unlawful and unfair:

 

(1) the Claimant did not consent to the sharing of their personal data;

 

(2) there was no other lawful basis for processing and obtaining of the Claimant’s personal data pursuant to Article 6 of the GDPR and the UK GDPR or section 35 of the DPA 2018. In particular, the processing did not serve a legitimate interest of the Defendant, or any third party nor was it shared for law enforcement purposes. Further, even if (which is denied) such a legitimate interest or lawful basis existed, it was overridden by the interests and fundamental rights of the Claimant.

 

(3) the processing was manifestly unfair and was not transparent. At no stage prior to the processing was the Claimant informed as to what would be taking place in respect of their personal data and information. It will be inferred that this was a deliberate decision taken by the Defendant in order to prevent the Claimant from having the opportunity to object.

 

41. The Defendant failing to inform or gain consent from the Claimant as to what would be taking place in respect of their personal data and information, meant the Claimant was unable to exercise their rights as stated in paragraph 36, 36(a), 36(b), 36(c), 36(d), 36(e), 36(f), 36(g), 36(h), 36(i), 37, 37(a), 37(b), 37(c), 37(d) and 37(e). It will be inferred that this was a deliberate course of action taken by the Defendant in order to cause a detriment to the Claimant.

 

42. Paragraph 24, 25 26, 26(a), 26(a)(i), 26(a)(ii), 26(a)(iii), 26(a)(iv), 26(b), 26(c), 28, 30 and 30(a) is repeated.

Particulars

 

(a) In breach of Article 5 (1) (a) of the GDPR and the UK GDPR and section 34 of the DPA 2018, the Defendant has failed to process the Personal Data lawfully or fairly.  The Claimant will rely in particular on the following facts and matters:

 

[Omitted]”

62.        As above, insofar as allegations are made against or concerning the actions of Surrey Police or other third parties, these do not concern the Defendant and so the Defendant is not responsible for them.

63.        Further, it is denied that the Defendant acted unlawfully in relation to YSL’s data because:

a.        the Defendant had, and has, a lawful basis for processing it;

b.        processing of the data was and is necessary for health or social care purposes and/or for public health purposes in the public interest;

c.        processing of the was and is necessary for the performance of a task carried out in the public interest or in the exercise of official authority;

d.        processing of the  was and is also necessary for the purposes of carrying out the Defendant’s obligations in the field of social protection law;

e.        further or alternatively, the Defendant had and has a legitimate interest in processing the data for the purpose of its public health duties and/or the provision of healthcare;

f.         processing and retention of the was and is in accordance with the NHSX Code and the Defendant’s Data Protection Policy;

g.          processing and retention of the data was and is required in relation to the Defendant’s liability insurance for the investigation and defence of complaints and legal claims;

h.          the data held by the Defendant about YSL are not inaccurate insofar as they record the opinions of professionals at the material time.

64.        In relation to the alleged misuse of private information, [44] of the PoC appears to concern ‘information provided by the Claimant to Surrey Police’.  It avers under the heading ‘Misuse of Private Information’:

“44. Further or alternatively, the information and data processed by the Defendant is self-evidently private and confidential and/or fall within the scope of the Claimant’s private and family life, home and correspondence under Article 8 of the ECHR; alternatively, the Claimant had a reasonable expectation that the information obtained and data processed by the Defendant were private and would remain so. In further support of this contention, the Claimant will rely upon the following facts and matters:

(a) any information provided by the Clamant to Surrey Police was obviously provided with Clamant believing that they had a reasonable expectation of privacy and confidentiality;

(b) further, the information and data purports to convey the Claimant’s deepest and most private thoughts, feelings and information about their life; and

(c) the Claimant intended the any information about them to be and remain private, and certainly did not expect it to be published and distributed to multiple third parties and stored on the Defendant’s systems, without any warning.”

65.        As above, the Defendant says that is not responsible for the acts or omissions of Surrey Police.

 

66.        Insofar as it is alleged by [44] to [51] that the Defendant has misused YSL’s, this is denied for the reasons in [12] and [16] of the Defence.

 

67.        In relation to YSL’s alleged exercise of his data protection rights,  he is required to prove [52]-[54] of the PoC.  These provide:

“52. The Claimant wrote to the Defendant on 08 September 2021 to activate and pursue his right to object in line with Article 21 GDPR and UK GDPR.

53. In breach of Article 12(4) the Defendant failed to respond or action the request without delay and at the latest within one month of receipt of the request.

54. in breach of Article 12(4) of the GDPR and UK GDPR, when determining not to take action following the Claimant’s requests set out in his email dated 08 September 2021, the Defendant did not inform the Claimant of how their interests outweighed the Claimant’s for not taking action in response to his requests, or of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.”

68.        The Defendant has lawful grounds for the processing and retention of YSL’s data as set out in [12] and [16] of the Defence. The Defendant is unable to erase the Claimant’s data for the reasons in [16(f) and (g)] of the Defence:

“(f) Processing and retention of the Claimant’s data was and is in accordance with the NHSX Records Management Code of Practice and the Defendant’s Data Protection Policy.

(g) Processing and retention of the Claimant’s data was and is required in relation to the Defendant’s liability insurance for the investigation and defence of complaints and legal claims.”  

69.        The Defendant has confirmed to YSL that it will add a notification to his electronic patient record to reflect his request, and investigate applying the restricted record process, which decision must be made by a clinician. This process is underway (see Defence, [20(c)].

 

70.        In relation to YSL’s complaint about retention of data for 20 years, the Defendant denies the retention is or was unlawful for the same reasons as earlier.  

 

71.        Paragraphs 59 to 63 of the PoC are denied.  These provide:

 

“59. 20 years is unquestionable an enormous amount of time for the Claimant’s information and data to processed.

 

60. The Defendant has not provided a legitimate reason, and which overrides the interests of the Claimant or justifies such a long interference of Claimant’s private life. Reason[s] for the 20-year retention of the Claimant’s data have included:

 

(a) that the service is open to the Claimant;

 

(b) the NHSX Code of Practice retention of these records will be retained for 20 years after last contact.

 

61. Having a retention schedule do[es] not in itself cause it to be necessary to retain data. 

 

62. The Claimant or a reasonable [person] would have never expected retention for such a long period of time without warning.

 

63. Without prejudice, to the fact that the data processed is inaccurate or the accuracy has been challenged. Storing data for two decades will keep the information accurate or give a picture of the persons current life so further breeches the Accuracy Principal of the GDPR and UK GDPR.”

 

72.        They are denied because:

 

a.      the Defendant’s services are open to YSL and retention of his data is necessary for health or social care purposes;

 

b.      the Defendant’s retention period is in accordance with national NHS policy, namely the NHSX Code.

 

73.        In relation to remedies, damages for ‘damage to [the Claimant’s] autonomy and integrity’ and ‘[loss of] control over [his] personal data’ are irrecoverable.

 

74.        The Claimant has, in any event, failed to plead reliance on any expert medical or other evidence in relation his alleged anxiety and distressed. Such issues are not made out.

 

75.        The Defendant will contend that such loss and damage as the Claimant may prove is attributable to the Defendant’s acts or omissions is de minimis.

 

76.        Hence, the Defendant denies the Claimant’s claim is denied in its entirety.

 

77.        YSL filed and served a Reply dated 11 July 2022 but I do not think I need to set out the details.    

 

The Defendant’s strike-out/summary judgment application

 

78.        The Defendant seeks to strike out YSL’s claim as an abuse of the court’s process and/or because of YSL’s conduct, under CPR r. 3.4(2)(b), on the grounds that:

 

a.        The entire claim alternatively substantial parts of it were compromised by the settlement reached between YSL and the Defendant in  November 2016;

 

b.        Further or alternatively, the claim is an abuse of process on the grounds that  YSL could and should have brought all his claims in 2016, on the basis of  Henderson v Henderson (1843) 3 Hare 100 and Johnson v Gore Wood & Co (No 1) [2002] 2 AC 1;

 

c.        In any event, this claim and/or YSL’s conduct has been and is vexatious and is therefore abusive and likely to obstruct the just (and specifically the final) disposal of the claim. 

 

79.        Further, any allegations which might survive the abuse of process application should be:

 

a.        Struck out under CPR 3.4(2)(a) and/or summarily dismissed under CPR r 24.2 because YSL has no real prospect of success and there is no other compelling reason for the case or any issue to be disposed of at trial;

 

b.        Anything remaining should be struck out under CPR 3.4(2)(a) as being too vague.

 

80.        Developing these grounds further, the Defendant submitted as Ground 1 that the claim is an abuse of process due to the November 2016 compromise. It argues that by entering into that compromise:

a.        YSL expressly compromised all potential claims involving disclosure of his personal information by CAMHS.

b.        YSL expressly compromised all potential claims involving Dr JW and Dr DG whilst under their care in 2011 and 2012.

c.         YSL impliedly compromised any claim relating to alleged inaccuracies of his records. YSL raised inaccuracies including with respect to his potential autism diagnosis in his letter of 17 June 2016, before the compromise.

d.        YSL compromised any claim for the deletion of all his information by the Defendant. YSL raised this in the negotiations (his Part 36 offer of 29 July 2016) and Weightmans LLP stated it could not be actioned as a matter of law. By proceeding to settle, YSL thereby compromised this claim.

 

81.        The Defendant’s Ground 2 is that, for any matters found not to have been compromised in 2016, they could and should have been brought in 2016 and so to bring them now is an abuse of process.  

 

82.        It is clear from his 17 June 2016 letter and his first formal letter of claim dated 6 September 2016 that he had access to his medical records in order to formulate those allegations. With reasonable diligence he could have brought all the allegations pursued in this claim in 2016 and so bring them now is an abuse of process on the basis of Henderson v Henderson (1843) 3 Hare 100 and Johnson v Gore Wood & Co (No 1) [2002] 2 AC 1.  His failure to do so has meant that the Defendant has been repeatedly vexed by various proposed claims.

 

83.        The Defendant’s Ground 3 is that the claim should be struck out because of YSL’s vexatious conduct.  The Defendant relies on the detailed history as set out above as showing that YSL has engaged in a course of vexatious conduct against it, and has repeatedly pursued allegations against Drs SW and DG.  He has sought termination of their employment for three years, and summonsed them in this claim despite having no valid basis for doing so. This has amounted to harassment as the Defendant has had to fight or respond to the same or very similar allegations over and over since 2015.

 

84.        In her witness statement, Ms Golden said that this particular concern is demonstrated by YSL’s recent draft amended Particulars of Claim and his most recent (fifth) letter of claim dated 1 June 2023.  She said this demonstrates that YSL has no intention of this claim being the final chapter in his pursuit of the Defendant.  She said YSL clearly remains determined to litigate allegations going back many years.

 

85.        The Defendant’s Ground 4 is that in any event the  allegations have no merit.  YSL has no realistic prospect of success on any of the allegations in this case, if they survive strike out on the other grounds. This is because:

 

a.        His main pleaded complaint about inaccuracy of his CAMHS records relates to the clinical opinion that he might have autistic traits. Section 205 of the DPA 2018 provides that inaccurate means ‘incorrect or misleading as to any matter of fact’ (emphasis added). Thus, a clinical opinion on diagnosis cannot be challenged under the accuracy principle. In any event, he cannot now realistically hope to successfully challenge the accuracy of records from 2011 and 2012 given the passage of time.

 

b.        Any processing by the Defendant of risk assessments received from Surrey Police was plainly lawful. This was in effect the conclusion of the ICO following YSL’s complaint.

 

c.        His main complaint about ongoing retention of his patient records has no prospect of succeeding. The high point of his legal case is Article 8 of the ECHR, yet even if he could show an interference with his right under Article 8(1):

 

a.      retention of his records would plainly be proportionate to two obvious legitimate aims under Article 8(2);

 

b.      the aim of protecting health, an issue on which a margin of appreciation is enjoyed (see Chave v France, Application 14461/88);

 

c.      the Trust’s need to defend itself from the threat of ongoing litigation from YSL. This is again demonstrated by YSL’s fifth formal letter of claim sent as recently as 1 June 2023;

 

d.      in any event, there was a separate legal obligation to retain YSL’s records during the  Independent Inquiry into Child Sexual Abuse, see Louis Lau’s trial statement at [21].

 

86.        Nor does YSL have a realistic prospect of obtaining any remedy in this case because:

 

a.      Even if he establishes liability in any respect, YSL has no real prospect of showing he is genuinely distressed by the matters in this claim, or distressed to an extent exceeding that for which he was already compensated by the 2016 settlement, so as to warrant an award of compensatory damages;

 

b.      YSL has not properly particularized any claim for rectification of his records under Article 16 UK GDPR as he has not properly set out how he wishes he records to be rectified;

 

c.      YSL cannot obtain erasure of his records as a result of the operation of Article 17(3) UK GDPR read with Article 9(3) UK GDPR, where processing is necessary for reasons of public interest in the field of health.

 

87.        Finally, the Defendant’s Ground 5 is that  any other relevant remaining allegations in the PoC are too vague to succeed and, in particular, YSL has failed to plead a proper case on how his records are inaccurate. He should have pleaded, first, the meaning of the records as to a matter of fact, and then set out why he says the records are factually incorrect.  Further, other allegations of unlawful processing are not properly set out.

 

88.        I turn to YSL’s response to the strike out application.

 

89.        In his written submissions YSL complained about the lateness of the Defendant’s application.  By the day of the hearing YSL had not been served with the exhibits to Ms Golden’s statement in support of the strike out application.  I granted an adjournment on the first day of the hearing for that to be done, and for him to read them, which was acceptable to him.  I am satisfied he had enough time.  In fact, as well as being fully described in Ms Golden’s statement, I noted that in any event some of the exhibits were YSL’s own documents, eg, letters from him (including his letters of claim), or else were documents that he had seen before and had had for some years (eg the letter from Weightmans about the settlement agreement in 2016).  None of them were very lengthy.   As I have explained, they essentially narrated the contact between YSL and the Defendant over the years, which he is very familiar with.

 

90.        YSL made some brief oral submissions but largely relied upon his witness statement of 13 June 2023 in response to the strike out application.  I have read that witness statement carefully but do not intend to summarise it. I do note, however, his response to the Defendant’s argument about the 2016 settlement:

“19. The Defendant contends that I compromised any claim for the deletion of my personal information by the Trust when I agreed to a settlement in previous negotiations specifically stelling the “disclosure”. However, this interpretation overlooks significant aspects of the situation and the distinct nature of my current claim.

20. Firstly, the claim I am bringing now under the GDPR (namely the right to object and the principle of storage limitation) is different in nature and legal basis from the previous matters addressed in the negotiation. My current claim relates specifically to the ongoing storage and processing of my data without my knowledge or consent, a matter that I believe is in breach of my rights under the GDPR. 

21. Moreover, it is essential to clarify that my acceptance of the settlement was based on the information and understanding available to me at the time. The Defendant's assertion that my claim could not be actioned as a matter of law was accepted in the context of those specific negotiations. It does not preclude my right to assert new or unaddressed claims under the changing landscape of data protection law, especially considering the significant changes brought by the GDPR.”

22. Therefore, the compromise reached during those negotiations should not be seen as a comprehensive settlement of all potential claims related to my data. My current claim under the GDPR is a separate issue that was not and could not have been fully addressed in the previous settlement.”

The trial and YSL’s summary judgment application

91.        YSL opened the case primarily by reference to his Skeleton Argument and he wrapped up his summary judgment application within it; as I have said this is largely a repeat of the merits of his claim as he sees them.   He then adopted his witness statement of 19 April 2023 as his evidence in chief.  There was no substantive cross-examination.   That was YSL’s case.

92.        Turning to the Defendant’s case, Mr McCracken called Louis Lau, who is the Defendant’s data protection officer.  He adopted his witness statement of 18 April 2023 as his evidence in chief.

93.        He was then cross-examined by YSL.

94.        Mr Lau was asked to elaborate upon the balancing exercise that was undertaken in relation to the obtaining of his data from Surrey Police.   He said they were relying on the data protection legislation, and that the Defendant had not sought the information but that it had been sent by the police via MASH. He said therefore they did not need to do any balancing act.  He said what was received had been in the nature of referrals to the Defendant (although he stressed he was not a clinician).  They were uploaded to the Defendant’s system (called System One) upon receipt.  He said they needed to get information in order to ‘reveal an assessment’ (ie, for assessment purposes).

95.        He said that he considered that uploading had complied with the first data protection principle in the GDPR. The data had been stored for the clinicians to process it. The Defendant was providing care. It was transparent because at the time there was the Defendant’s Privacy Notice which was publicly available.  He said that the GDPR did not apply at the time the information was received, it was the DPA 1998 (which only refers to unlawful and fair).   He agreed there should be transparency.  There would have been leaflets and a notice on the Defendant’s website about data handling.

Discussion

 

96.        I have carefully read the necessary written materials, including in particular YSL’s witness statements and his Skeleton Argument.  Both sides’ cases are clearly articulated.  My failure to mention a particular point in this judgment does not mean that it has been overlooked.

 

Preliminary

 

97.        For reasons which will become clear, I think it is relevant to note at the outset by that on his own case, YSL has continuing mental health difficulties.    I will not set out the details: they are fully described in the evidence and in YSL’s Skeleton Argument. YSL is receiving ongoing treatment for them.  In significant part he blames the Defendant for them. The Defendant denies any responsibility for YSL’s health issues.

 

The Defendant’s strike-out/summary judgment application

98.        As I have said, the Defendant has applied to strike out the Claimant's claim, and/or for summary judgment, pursuant to CPR r 3.4(2)(a) and (b) and/or CPR r 24.2 respectively. These provide:

“3.4

(1) In this rule and rule 3.5, reference to a statement of case includes reference to part of a statement of case.

(2) The court may strike out a statement of case if it appears to the court –

(a) that the statement of case discloses no reasonable grounds for bringing or defending the claim;

(b) that the statement of case is an abuse of the court's process or is otherwise likely to obstruct the just disposal of the proceedings;

24.2 The court may give summary judgment against a claimant or defendant on the whole of a claim or on a particular issue if –

(a) it considers that –

(i) that claimant has no real prospect of succeeding on the claim or issue …"

99.        The test to be applied on a summary judgment application is well-known. In EasyAir Limited v. Opal Telecom Limited [2009] EWHC 339 (Ch), [15], Lewison J (as he then was) said:

“1. The court must consider whether the [respondent to the summary judgment application] has a 'realistic' as opposed to a 'fanciful' prospect of success.

 

2. A 'realistic' [statement of case] is one that carries some degree of conviction. This means a [case] that is more than merely arguable.

 

3. In reaching its conclusion the court must not conduct a 'mini-trial'.

 

4. This does not mean that the court must take at face value and without analysis everything that [the respondent] says. In some cases it may be clear that there is no real substance in factual assertions made, particularly if contradicted by contemporaneous documents.

 

5. However, in reaching its conclusion the court must take into account not only the evidence actually placed before it on the application for summary judgment, but also the evidence that can reasonably be expected to be available at trial.

 

6. Although a case may turn out at trial not to be really complicated, it does not follow that it should be decided without a fuller investigation into the facts at trial than is possible or permissible on an application for summary judgment. Thus the court should hesitate about making a final decision without a trial, even where there is no obvious conflict of fact, where reasonable grounds exist for believing that a fuller investigation into the facts of the case would add to or alter the evidence available to a trial judge and so affect the outcome of the case.

 

7. On the other hand it is not uncommon for an application under Part 24 to give rise to a short point of law or construction and, if the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and that the parties have had an adequate opportunity to address it in argument, it should grasp the nettle and decide it. The reason is quite simple: if the respondent's case is bad in law, he will in truth have no real prospect of succeeding on his claim or successfully defending the claim against him, as the case may be. Similarly, if the applicant's case is bad in law, the sooner that is determined, the better. If it is possible to show by evidence that although material in the form of documents or oral evidence that would put the documents in another light is not currently before the court, such material is likely to exist and can be expected to be available at trial, it would be wrong to give summary judgment because there would be a real, as opposed to a fanciful, prospect of success. However, it is not enough simply to argue that the case should be allowed to go to trial because something may turn up which would have a bearing on the question of construction.”

 

100.     For examples of recent cases where these principles have been applied, see eg, ArcelorMittal North America Holdings LLC v Ravi Ruia et al [2022] EWHC 1378, [26]-[28]; JJH Holdings Ltd v Microsoft [2022] EWHC 929 (Comm), [11]; and WWRT Limited v Zhevago [2024] EWHC 122 (Comm), [59].

 

101.     There is an overlap between the test for real prospect of success under CPR r 24.2 and CPR r 3.4(2)(i)(a) and (b): see White Book 2023 at 3.4.21, where it is noted that the Court of Appeal has taken the view that if the particulars of claim disclose no reasonable grounds for bringing the claim, then they also show no real prospect of success. 

 

102.     I begin with the question of whether and/or to what extent the present claim is an abuse of process by reason of the settlement reached between the parties in 2016.   If the claim or any part of it is so covered then it will be abuse of process.

 

103.     It is trite law which needs little authority that a party cannot sue on a cause of action which he has effectively compromised (or which has been the subject of a prior judgment by a court of competent jurisdiction). I will, however, quote passages from Lord Bingham’s speech in Johnson, a case relied on by the Defendants. 

 

104.     In that case the plaintiff, Mr Johnson, a businessman, conducted his affairs through a number of companies, including WWH Ltd, in which he owned all but two of the shares.  WWH Ltd sued its former solicitors (Gore Wood (GW)) for professional negligence in connection with a transaction, the litigation eventually being settled.   Mr Johnson then sued GW in his own name, on essentially the factual basis for the same alleged negligence as in the first claim, but for different losses.  GW sought to strike out the action as an abuse of process, and the case ended up in the House of Lords.  Lord Bingham said at pp22-23:

 

“GW contends that Mr Johnson has abused the process of the court by bringing an action against it in his own name and for his own benefit when such an action could and should have been brought, if at all, as part of or at the same time as the action brought against the firm by WWH. The allegations of negligence and breach of duty made against the firm by WWH in that action were, it is argued, essentially those upon which Mr Johnson now relies. The oral and documentary evidence relating to each 23action is substantially the same. To litigate these matters in separate actions on different occasions is, GW contends, to duplicate the cost and use of court time involved, to prolong the time before the matter is finally resolved, to subject GW to avoidable harassment and to mount a collateral attack on the outcome of the earlier action, settled by GW on the basis that liability was not admitted.

 

This form of abuse of process has in recent years been taken to be that described by Sir James Wigram V-C in Henderson v Henderson 3 Hare 100 , 114–115:

 

‘In trying this question, I believe I state the rule of the court correctly, when I say, that where a given matter becomes the subject of litigation in, and of adjudication by, a court of competent jurisdiction, the court requires the parties to that litigation to bring forward their whole case, and will not (except under special circumstances) permit the same parties to open the same subject of litigation in respect of matter which might have been brought forward as part of the subject in contest, but which was not brought forward, only because they have, from negligence, inadvertence, or even accident, omitted part of their case. The plea of res judicata applies, except in special cases, not only to points upon which the court was actually required by the parties to form an opinion and pronounce a judgment, but to every point which properly belonged to the subject of litigation, and which the parties, exercising reasonable diligence, might have brought forward at the time.’

 

Thus the abuse in question need not involve the reopening of a matter already decided in proceedings between the same parties, as where a party is estopped in law from seeking to relitigate a cause of action or an issue already decided in earlier proceedings, but, as Somervell LJ put it in Greenhalgh v Mallard [ 1947 ] 2 All ER 255, 257, may cover:

 

‘issues or facts which are so clearly part of the subject-matter of the litigation and so clearly could have been raised that it would be an abuse of the process of the court to allow a new proceeding to be started in respect of them.’”

 

105.     The passage from Henderson quoted by Lord Bingham has become known as ‘the rule in Henderson v Henderson.   Lord Bingham said at p32:

 

“The second subsidiary argument was that the rule in Henderson v Henderson 3 Hare 100 did not apply to Mr Johnson since the first action against GW had culminated in a compromise and not a judgment. This argument also was rightly rejected. An important purpose of the rule is to protect a defendant against the harassment necessarily involved in repeated actions concerning the same subject matter. A second action is not the less harassing because the defendant has been driven or thought it prudent to settle the first; often, indeed, that outcome would make a second action the more harassing.”

 

106.     I quoted the settlement agreement earlier and will come back to it in a moment.  The approach to its interpretation is as follows. In Bank of Credit and Commercial International SA v Ali [2002] 1 AC 251, [8],  Lord Bingham said:

 

“In construing this provision, as any other contractual provision, the object of the court is to give effect to what the contracting parties intended. To ascertain the intention of the parties the court reads the terms of the contract as a whole, giving the words used their natural and ordinary meaning in the context of the agreement, the parties’ relationship and all the relevant facts surrounding the transaction so far as known to the parties. To ascertain the parties’ intentions the court does not of course inquire into the parties’ subjective states of mind but makes an objective judgment based on the materials already identified.”

 

107.     I consider the following matters to be clear, and I so find, from the correspondence leading up to the settlement agreement as referred to in Ms Golden’s witness statement:

a.        by then he had made at least  one SAR for his medical records, and had had access to them, which enabled him to frame his claim;

b.        his primary complaint was that Drs SW, DG and SM had done various things without his knowledge or consent including conducting an autism assessment; disclosing information to his school, GP and mother; and had referred to him having ‘obsessional tendencies’;

c.        he also complained his records were inaccurate and he wanted them erased.

108.     The key point arising from the settlement, it seems to me, is that YSL was compromising all claims that he may have arising out of the disclosure of his personal information by staff working in the Defendant’s CAMHS, including by Drs SE and DG whilst he was under their care. The reference to ‘staff’ meant disclosure by ‘any staff’, and not just disclosure by Drs SW and DG - hence the use of the word ‘including’.

109.     I therefore find the parts of the current claim which relate to the alleged illegality of such disclosures are an abuse of process. YSL gave up his right to sue on them in return for a payment of £6,000.  The relevant paragraphs of the PoC in which the abusive disclosure claim is pleaded are: [7] (‘The Defendant has shared information and data about and from the Claimant to third parties …); [11], in respect of dissemination; and [12]-[18].  The following paragraphs of YSL’s trial witness statement are linked to this abusive disclosure claim, and so the disclosure complaints within them are also struck out as an abuse of process: [6]-[16]; [18];   

110.     For the avoidance of doubt, in my judgment the agreement also covers the subject matter of YSL’s fifth letter of claim of 1 June 2023, in which he wrote:

“My entitlement to remedies stems from your violation of the aforementioned statutes and rights. Specifically, I recently became aware of a letter ‘dispatched’ by [Dr DG] on 8th June 2012 and ‘typed’ on 4th July 2012, sent to my General Practitioner, my mother, and my school. This letter, outlining personal, sensitive information about my mental and emotional health, academic progress, and family relationships, was shared without my consent or knowledge. These actions were taken within England and Wales, making it the most appropriate forum for this dispute. I am self-funding this litigation.”

111.     Because of the lack of specificity in the PoC, I am not entirely clear whether this letter is one of the ones referenced in [12], [16] and [17] of the PoC, in which YSL complained about:

“12. … letters by [Dr SW] and [Dr DG], which were sent to several parties including the Claimants GP, Family and/or school. This was done without the Claimants knowledge or consent. Pending full disclosure, the precise extent of publication and republication of the letters is unknown.

16. [Dr SW] and [Dr DG] not only processed, collected and shared personal information and data, they failed to ensure the accuracy of said information and data and included several degrading and crass comments of their own.

17. [Dr SW] and [Dr DG]’s letters were also used by the Claimants School to degrade and discredit abuse perpetrated by the School on the Claimant.

18. [Dr SW] also made repeated reference the claimant being autistic, a claim which she [shared] and distributed to multiple parties, but never directly to the Claimant. [Dr SW]’s unlawful and unethical conduct has led to not only continues distress, but also negatively affected the Claimants family relationships, quality of education and development.”

112.     Leaving aside how it is that YSL says he only became aware of the 8 June 2012 letter around 2023, when (as I have noted) he has made SARs many years previously and has long since obtained his records, any claim which YSL might try to make arising out of this letter from Dr DG in 2012 falls squarely within the terms of the 2016 compromise and would be an abuse of process. 

 

113.     However, it is plain from the wording that the agreement only applied to claims or potential claims arising out of the disclosure of YSL’s data by CAMHS staff - as opposed to other forms of data processing by the Trust, for example, the retention of YSL’s records or its processing of Surrey Police’s risk assessments.

 

114.     I therefore reject the Defendant’s submission that the compromise can be read as including claims of illegality relating to these other forms of data processing.  Whilst these had been raised by YSL in correspondence, they did not fall within the terms of what eventually was agreed between him and the Defendant.

 

115.     The Defendant submitted in its Closing Submissions on this aspect of the case at [6]:

“6. The Trust therefore submits that:

(i)          The parties intended to compromise ‘all claims’ in relation to disclosure to third parties by CAMHS staff, which included all claims YSL had already raised in correspondence and all other such claims he may have had at that time which included claims he may reasonably have had in his contemplation by that point in time. That includes claims he could have discovered or made with reasonable inquiries such as SARs and/or requesting his GP, school, local authority records etc.

(ii)        There was an implicit compromise of the inaccuracy allegations.

 

(iii)      There was an implicit compromise of the claim for erasure of his records. YSL accepted a financial settlement with no agreement on erasure.”

 

116.     For the reasons I have given, I agree with (i), but I reject (ii) and (iii).

 

117.     I turn to the Defendant’s alternative strike-out argument based upon Johnson (Closing Submissions, [7] et seq).

 

118.     The court applies a broad merits-based approach when considering this species of abuse of process. Lord Bingham set out the test at p31 of Johnson:

 

“The bringing of a claim or the raising of a defence in later proceedings may, without more, amount to abuse if the court is satisfied (the onus being on the party alleging abuse) that the claim or defence should have been raised in the earlier proceedings if it was to be raised at all. I would not accept that it is necessary, before abuse may be found, to identify any additional element such as a collateral attack on a previous decision or some dishonesty, but where those elements are present the later proceedings will be much more obviously abusive, and there will rarely be a finding of abuse unless the later proceeding involves what the court regards as unjust harassment of a party. It is, however, wrong to hold that because a matter could have been raised in early proceedings it should have been, so as to render the raising of it in later proceedings necessarily abusive. That is to adopt too dogmatic an approach to what should in my opinion be a broad, merits-based judgment which takes account of the public and private interests involved and also takes account of all the facts of the case, focusing attention on the crucial question whether, in all the circumstances, a party is misusing or abusing the process of the court by seeking to raise before it the issue which could have been raised before. As one cannot comprehensively list all possible forms of abuse, so one cannot formulate any hard and fast rule to determine whether, on given facts, abuse is to be found or not. Thus while I would accept that lack of funds would not ordinarily excuse a failure to raise in earlier proceedings an issue which could and should have been raised then, I would not regard it as necessarily irrelevant, particularly if it appears that the lack of funds has been caused by the party against whom it is sought to claim. While the result may often be the same, it is in my view preferable to ask whether in all the circumstances a party’s conduct is an abuse than to ask whether the conduct is an abuse and then, if it is, to ask whether the abuse is excused or justified by special circumstances. Properly applied, and whatever the legitimacy of its descent, the rule has in my view a valuable part to play in protecting the interests of justice.”

 

119.     This type of abuse applies to settlement agreements as well as judgments, as I explained earlier.

 

120.     In his Closing Submissions at [9], Mr McCracken helpfully set out in tabular form why and on what basis the Defendant says that the allegations made by YSL in this claim fall to be struck out as barred by the 23 November 2016 compromise (expressly or by implication); on the basis of Johnson style abuse, or for the other reasons given in the third column of the table below (I have added numbers to each row for ease of reference):

 

Allegation

Bundle Reference(s)

Short reasoning of Defendant Trust

1. Letters by JW and DG were sent to several parties including the Claimant’s GP, Family and/or School. This was done without consent or knowledge.

 

 

PoC, [12] [CMB-B27]

 

PoC, [16] [Ibid]

 

 

Covered by express wording of compromise. No date is given but must be 2011 or 2012.

 

In any event, any allegations against JW and DG could and should have been brought by November 2016 so an abuse on the broad merits test.

 

2. JW and DG’s letters used by the Claimant’s School to degrade him.

 

PoC [17] [CMB-B28]

Same as above.

3. JW and DG failed to ensure accuracy and included degrading and crass comments.

 

PoC [16] [CMB-B28]

Covered by implied settlement of accuracy complaint.

 

In any event, any allegations against JW and DG about accuracy could and should have been brought so an abuse on the broad merits test.

 

Lack of particularity and clarity.

 

4. JW made repeated references to the Claimant being autistic.

 

PoC [18] [CMB-B28]

Same as above.

 

All references to a potential autism diagnosis are on a fair reading of the records expressions of comment, opinion, or evaluation.

 

5. The Defendant uploaded Surrey Police 38/29 [risk assessment] forms to its system

PoC [21](a) (b) and (c) [CMB-B28]

 

It is accepted [21(d)] post-dates the compromise.

If there is any allegation of third party disclosure here, it is caught by the express wording of the compromise.

 

In any event, any allegations could and should have been brought so an abuse on the broad merits test.

 

 

6. JW sent an autism questionnaire to YSL’s School on 4 April 2011.

 

YSL trial witness statement (W/S) [6] [CMB-D83]

Covered by express wording of compromise as an allegation against JW from 2011.

 

In any event, any allegation against JW could and should have been brought by November 2016 so an abuse on the broad merits test.

 

7. On 5 April 2011 JW called Educational Psychologist Chloe Gibson

 

YSL trial witness statement (W/S) §7 [CMB-D83]

Covered by express wording of compromise as an allegation against JW from 2011.

 

In any event, any allegation against JW could and should have been brought by November 2016 so an abuse on the broad merits test.

 

 

8. On 5 April 2011 JW had an appointment with YSL’s mother\

 

YSL trial witness statement (W/S) [8] [CMB-D83]

Covered by express wording of compromise as an allegation against JW from 2011.

 

In any event, any allegation against JW could and should have been brought by November 2016 so an abuse on the broad merits test.

 

 

9. On 25 May 2011 JW infringed YSL’s right to privacy

 

YSL trial witness statement (W/S) [10] [CMB-D83]

Covered by express wording of compromise as an allegation against JW from 2011.

 

In any event, any allegation against JW could and should have been brought by November 2016 so an abuse on the broad merits test.

 

 

10. JW discussed YSL’s sexuality etc.

 

YSL trial witness statement (W/S) [12] [CMB-D84]

Covered by express wording of compromise as an allegation against JW from it appears 2011.

 

In any event, any allegation against JW could and should have been brought by November 2016 so an abuse on the broad merits test.

 

 

11. JW sent another letter to his GP, mother and summary of letter to school

 

YSL trial witness statement (W/S) [13] [CMB-D84]

Covered by express wording of compromise as an allegation against JW from it appears 2011.

 

In any event, any allegation against JW could and should have been brought by November 2016 so an abuse on the broad merits test.

 

 

12. DG sent a letter to his GP, mother and school

 

YSL trial witness statement (W/S) [15] [CMB-D84]

Covered by express wording of compromise as an allegation against DG from it appears 2011 or 2012.

 

In any event, any allegation against DG could and should have been brought by November 2016 so an abuse on the broad merits test.

 

 

13. DG said on a call YSL had ‘confirmed’ Asperger’s and increased obsessional behaviour

 

YSL trial witness statement (W/S) [15] [CMB-D84]

Covered by express wording of compromise as an allegation against DG from it appears 2011 or 2012. Appears similar if not identical to allegation at [SOAB-21].

 

In any event, any allegation against DG could and should have been brought by November 2016 so an abuse on the broad merits test.

 

 

14. SM organised an ‘unplanned opportunistic conversation’ on 28 May 2014 with YSL’s knowledge. Then organised to see YSL’s mother.

 

YSL trial witness statement (W/S) [18] [CMB-D85]

Covered by express wording of compromise as an allegation of third party disclosure by staff.

 

In any event, any allegation against SM could and should have been brought by November 2016 so an abuse on the broad merits test.

 

 

15. The Defendant has in many cases forwarded ‘20something/30something’ risk forms to his GP

 

Presumed to be a reference to the 38/29 forms pleaded at §21 PoC [CMB-B28]

YSL trial witness statement (W/S) §23 [CMB-D85]

In respect of the first three pleaded 38/29 forms they are covered by express wording of compromise as an allegation of third party disclosure by staff.

 

In any event, any allegations could and should have been brought so an abuse on the broad merits test.

 

The fourth form (§21(d) PoC [CMB-B28] was lawfully processed for the purposes of health

 

In any event, this is a sweeping allegation unsupported by specific allegations or evidence that does not correspond to a pleaded allegation in the PoC.

 

 

121.     Apart from (6) and (15), which relate to the risk assessments prepared by Surrey Police which were shared via the Surrey MASH and received by the Defendant from that source, I agree that all of the other matters fall within the terms of the compromise agreement.   I will deal later with YSL’s complaint about the Defendant having uploaded these risk assessments to its system, but in relation to the alleged disclosure of them (ie, (15)), this does not fall within the terms of the settlement agreement because the disclosure did not come about as a result of the Defendant’s interaction with CAMHS. 

122.     I reject the Defendant’s argument that the claim should be struck out purely on the basis of what it says is YSL’s vexatious conduct over the years in sending multiple letters before action including one just days after having signed a compromise agreement in November 2016; threatening to commence proceedings (but not doing so); and, latterly, sending the letter of claim in June 2023 and amended draft Particulars of Claim substantially expanding the present claim (albeit, as I have said, without having sought the court’s permission).  I readily understand the Defendant’s concern but it seems to me that there are other remedies potentially available to it to restrain litigation by YSL in the form, for example, of civil restraint orders, if it were so advised.

123.     For these reasons, the part of YSL’s claim relating to disclosure by CAMHS is struck out as an abuse of process.

The merits of the Claimant’s claim

124.     However, in case I am wrong in these conclusions, I will go on to consider the merits of all of the aspects of YSL’s claims against the Defendant, namely the alleged unlawful disclosure; unlawful retention; processing of risk assessment received from Surrey Police; and failure to erase records.  It seems to me that the Defendant’s summary judgment application that YSL has no prospects of success, can in the circumstances of this case, be wrapped with a discussion of its overall merits.

125.     I begin with YSL’s claim under the DPA 1998, which was the predecessor legislation to the EU GDPR, the DPA 2018, and the UK GDPR. 

126.     YSL pleaded at [11] of his PoC:

“11. The Defendant, whilst the DPA 1998 was in force, collected, compiled, stored and disseminated the Claimant’s personal data and information relating to (or purporting to the relate to) the Claimant.”

127.     There is no dispute that the data held by the Defendant about YSL was personal data as defined in s 1(1) of the DPA 1998.  There is also no dispute that the Defendant was a data controller subject to the provisions of the Act, as defined by s 1(1). Furthermore, the data held by the Defendant about YSL included ‘sensitive personal data’ as defined in s 2, to the extent that it related to his physical or mental health or condition, and/or his sexual life. 

128.     By s 4(4), it was the duty of the Defendant as a data controller to comply with the data protection principles in relation to YSL’s data.  By s 4(1) and (2), the data protection principles were the principles set out in Part I of Sch 1 to the Act.  They had to be interpreted in accordance with Part II of Sch 1.

129.     The data protection principles in Part I of Sch 1 were as follows:

“1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

 

(a) at least one of the conditions in Schedule 2 is met, and

 

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

 

2 Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

 

3 Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

 

4 Personal data shall be accurate and, where necessary, kept up to date.

 

5 Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

 

6 Personal data shall be processed in accordance with the rights of data subjects under this Act.

 

7 Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

 

8 Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.”

 

130.     The conditions in Sch 2 were:

 

“1 The data subject has given his consent to the processing.

 

2 The processing is necessary -

 

(a) for the performance of a contract to which the data subject is a party, or

 

(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

3 The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

4 The processing is necessary in order to protect the vital interests of the data subject.

5 The processing is necessary -

(a) for the administration of justice,

(b) for the exercise of any functions conferred on any person by or under any enactment,

(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

 

(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.”

 

131.     The conditions in Sch 3 were:

 

“1 The data subject has given his explicit consent to the processing of the personal data.

 

2(1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.

 

(2) The Secretary of State may by order -

 

(a) exclude the application of sub-paragraph (1) in such cases as may be specified, or

 

(b) provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

 

3 The processing is necessary -

 

(a) in order to protect the vital interests of the data subject or another person, in a case where -

 

(i) consent cannot be given by or on behalf of the data subject, or

 

(ii) the data controller cannot reasonably be expected to obtain the consent of the data subject, or

 

(b) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.

 

4 The processing –

 

(a) is carried out in the course of its legitimate activities by any body or association which -

 

(i) is not established or conducted for profit, and

 

(ii) exists for political, philosophical, religious or trade-union purposes,

 

(b) is carried out with appropriate safeguards for the rights and freedoms of data subjects,

 

(c) relates only to individuals who either are members of the body or association or have regular contact with it in connection with its purposes, and

 

(d) does not involve disclosure of the personal data to a third party without the consent of the data subject.

 

5 The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

 

6 The processing -

 

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

 

(b) is necessary for the purpose of obtaining legal advice, or

 

(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

 

7(1) The processing is necessary -

 

(a) for the administration of justice,

 

(b) for the exercise of any functions conferred on any person by or under an enactment, or

 

(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department.

 

(2) The Secretary of State may by order -

 

(a) exclude the application of sub-paragraph (1) in such cases as may be specified, or

 

(b) provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

 

8(1) The processing is necessary for medical purposes and is undertaken by -

 

(a) a health professional, or

 

(b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.

 

(2) In this paragraph ‘medical purposes’ includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

 

9(1) The processing -

 

(a) is of sensitive personal data consisting of information as to racial or ethnic origin,

 

(b) is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and

 

(c) is carried out with appropriate safeguards for the rights and freedoms of data subjects.

 

(2) The Secretary of State may by order specify circumstances in which processing falling within sub-paragraph (1)(a) and (b) is, or is not, to be taken for the purposes of sub-paragraph (1)(c) to be carried out with appropriate safeguards for the rights and freedoms of data subjects.

 

10 The personal data are processed in circumstances specified in an order made by the Secretary of State for the purposes of this paragraph.”

 

132.     I consider there can be no argument but that the Defendant’s processing of YSL’s sensitive personal data complied with the data protection principles, including in particular [1(a) and (b)] of Sch 1.  These required at least one condition in Sch 2 and one condition in Sch 3 to be satisfied. The relevant ones for present purposes were as follows.

 

133.     In Sch 2:

 

a.        Paragraph 5(d): functions of a public nature exercised in the public interest by any person.  The provision of health care and mental health services by a hospital Trust such as the Defendant is plainly such a function;

 

b.        Paragraph 6(a): legitimate interests pursued by the Defendant as a data controller.  The Defendant had a legitimate interest in processing YSL sensitive personal data including by disclosing it to those it reasonably believed ought to have it.

 

134.     In Sch 3, the relevant condition was [8] (the processing is necessary for medical purposes and is undertaken by a health professional, or a person under an equivalent duty of confidentiality.)

 

135.     As I will discuss later, the test of ‘necessity’ in this context means ‘reasonably necessary’, rather than ‘absolutely or strictly necessary.’

 

136.     The processing of YSL’s sensitive personal data was therefore lawful under the DPA 1998.

137.     I have not overlooked the fact that in the course of correspondence in 2016 which led to the compromise agreement, the letter from the Defendant’s then solicitors dated 17 November 2016 said:

“You will be aware that the clinicians’ accounts of their communications with third parties are set out in the letters from Fiona Edwards [the Defendant’s then CEO] referred to above and we do not propose to recite them at length in this letter. 

We adopt the conclusion reached by Fiona Edwards in her correspondence and recognise that there was some disclosure to third parties that was made without your consent.

To that end our client is prepared to make an offer of damages to reflect the nature and extent of that disclosure and we have attached to this letter a Part 36 offer of settlement.  We believe that this offer is a reasonable offer that reflects the admitted breaches.

We would refer you to the recent report in the case of P v A local Authority [2016] EWHC 2779 (Fam) where local authority has paid a vulnerable transgender teenager £4,750 in damages after a member of staff breached his privacy by disclosing personal information about him to friends of his estranged adoptive parents.”

138.     I have read the case of P. There was a relatively complex background, however P’s claim was under the Human Rights Act 1998 for a breach of Article 8 arising from the unauthorised disclosure by the local authority of personal information about P, including his forename and transgender status, to third parties who were friends of P's adoptive parents.  The local authority admitted liability.

139.     I was not shown and do not have the letters from Ms Edwards.  However, I note that there is in the bundle at E132-133 a letter of apology from Dr DG to YSL dated 25 May 2016 which referred to YSL having been upset that a discharge summary had been sent by Dr DG to his school and his mother without his consent.   

140.     I do not know exactly what ‘breaches’ were being referred to in the solicitors’ letter, or whether they included the matter referred to by Dr DG.   However, I can only go on the materials before me.  The Defendant has put forward a defence to YSL’s claim of a breach of the DPA 2018 arising from CAMHS disclosures.  Having considered this defence, and for the reasons I have given, if I am wrong on my strike out decision in relation to them, I consider that there was a lawful basis for them under the DPA 2018. 

The Claimant’s case under the EU GDPR, the UK GDPR and the DPA 2018

141.     I turn now to the Claimant’s claims under the EU GDPR and the DPA 2018 (which came into force in 2018) and the UK GDPR, which came into force in 2021. As I explained earlier, the UK GDPR is part of retained EU law and was given force in domestic law from 1 January 2021 by s 3 of the European Union (Withdrawal) Act 2018.

142.     Article 5 of the UK GDPR contains the principles relating to processing of personal data.  The first principle is that:

“1. Personal data shall be:

 

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’.)”

143.     Article 6 provides lawful grounds for processing, and provides that processing shall be lawful only if and to the extent that at least one of the conditions in Article 6(1) applies.  Sub-paragraphs (d) and (e) provide:

“(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

 

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

 

144.     The Defendant primarily relies on (e) as being the basis for the lawful processing of YSL’s medical records for the provision of care to him; ie, it says processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Defendant as part of the NHS.  It also relies on YSL’s health as the ‘vital interest’ in sub-paragraph (d). 

 

145.     For reasons I will come to, I reject (d) as a lawful basis for processing data concerning YSL’s health.  I do accept, however, that processing of YSL’s data is lawful by virtue of (e). This is the lawful basis identified in [14.1] of the Defendant’s Data Protection and Records Management Policy and in Appendix 4 and has been correctly identified.   The Appendix states:

 

“Legal basis for processing personal information: 

 

This summarises the legal authority that we, under current data protection legislation, process personal data, and the areas they cover.

 

There are 2 levels of personal information:

 

• Level 1 data, such as your name, your address, your birth date. (Article 6(1))

 

• Level 2 data (also called ‘special categories’), such as your health records. (Article 9(2))”

 

146.         The relevant part of the Table which follows states:

 

 

 

Surrey and Borders Partnership NHS Foundation Trust:

Health and Social Care purposes:

 

 

Legal basis: Provision of Care

 

Data rights:

 

Surrey and Borders Partnership NHS Foundation Trust is an official authority with a public duty to care for its patients, as guided by the Department of Health and data protection law.

 

Under the legislation it is appropriate to do so for the health and social care treatment of patients, and the management of health or social care systems and services.

 

Level 1:

 

Processing is necessary for the performance of a task carried out … in the exercise of official authority vested in the controller.

 

Level 2: Processing is necessary for the purposes of preventative

or occupational medicine… medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services … or a contact with a health professional.

 

Right to be informed

Yes

Right of access

Yes

Right of rectification

Yes

Right of erasure

No

Right to restrict processing

Yes

Right to data portability

No

Right to object

Yes

Rights in relation to automated processing

Yes

 

 

147.     Section 8 of the DPA 2018 is relevant here.   It provides that in Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for:

 

“…

 

(e) the exercise of a function conferred on a person by an enactment or rule of law

 

…”

148.     The provision of health care is obviously such a function.  The role, duties and responsibilities of the NHS are governed by many pieces of legislation including, for example, the National Health Service Act 2006.

149.     Article 9 is headed, ‘Processing of special categories of personal data.’  Processing of this sort of data - which includes data concerning health - is prohibited  unless a condition in Article 9(2) applies. Sub-paragraphs (h) and (i) provide:

“(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of [domestic law] or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;”

 

150.         In my judgment the processing of YSL’s health data falls within both of these conditions. 

 

151.         Article 9(3) provides:

 

“Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under domestic law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under domestic law or rules established by national competent bodies.”

152.         This condition is satisfied in relation to those who process YSL’s medical data. Firstly, the common law imposes a duty of confidentiality on medical professionals in respect of patient records: see eg, Hunter v Mann [1974] QB 767; W v Egdell [1990] Ch 359.  Second, obligations of confidentiality are also imposed on the Defendant’s employees who may have access to YSL’s data.  These arise from their contractual obligations (whether express or implied) and from other sources.  The NHS’s Confidentiality Policy (2022) states:

“All employees working in the NHS are bound by a legal duty of confidence to protect personal information they may come into contact with during the course of their work. This is not just a requirement of their contractual responsibilities but also a requirement within the common law duty of confidence and data protection legislation - the European General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018) which implements the GDPR in the UK.

153.         The reason I rejected ‘vital interests’ in Article 6(1)(d) as a lawful basis for processing YSL’s special category data is because of Article 9(2)(c), which is much narrower:

“(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent”

154.         YSL is plainly capable of giving consent, so this cannot apply. But in any event, as the ICO’s Guidance makes clear (at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/#conditions3 ):

“Vital interests are intended to cover only interests that are essential for someone’s life. So this condition is very limited in its scope, and generally only applies to matters of life and death.

This condition only applies if the individual is physically or legally incapable of giving consent. This means you should ask for explicit consent if possible. If a data subject refuses consent, you cannot rely on vital interests as a fallback condition, unless they are not legally competent to make that decision.

“This condition is likely to be most relevant where there is an urgent need to use a person’ personal data for medical care, but they are unconscious or otherwise incapable of giving consent.” 

155.         The DPA 2018 is also relevant in relation to the processing of medical data.    Section 10(1) and (2) provide:

“(1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the [UK GDPR] (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2) -

(c) point (h) (health and social care);

(d) point (i) (public health);

(2) The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the [UK GDPR] for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.”

 

156.         The conditions in Part 1 of Sch 1 to the DPA 2018 include in [2]:

 

“2(1) This condition is met if the processing is necessary for health or social care purposes.

 

(2) In this paragraph ‘health or social care purposes’ means the purposes of -

 

(a) preventive or occupational medicine,

 

(b) the assessment of the working capacity of an employee,

 

(c) medical diagnosis,

 

(d) the provision of health care or treatment,

 

(e) the provision of social care, or

 

(f) the management of health care systems or services or social care systems or services.

 

(3) See also the conditions and safeguards in Article 9(3) of the [UK GDPR] (obligations of secrecy) and section 11(1).”

 

157.         Section 11(1) provides:

 

“(1) For the purposes of Article 9(2)(h) of the [F1UK GDPR] (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the [F1UK GDPR] (obligation of secrecy) include circumstances in which it is carried out—

 

(a) by or under the responsibility of a health professional or a social work professional, or

 

(b) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.”

 

158.         For the reasons I gave earlier in relation to Article 9(3) of the UK GDPR, this condition is satisfied in relation to YSL’s health data.

 

159.         Overall, therefore, I consider that the Defendant has and had a lawful basis for processing YSL’s health data under the EU GDPR, the UK GDPR and the DPA 2018.

 

The risk assessments received from Surrey Police in 2016 and 2017

160.     A distinct part of YSL’s pleaded case relates to risk assessments received from Surrey Police via the MASH (PoC, [21] et seq).  There were four of them: three from 2016 and one from 2017.   The concerned ‘Adults at Risk’.

161.     I am bound to say that YSL’s pleaded case in relation to these seems to me to be somewhat confused, in that he  has pleaded matters relating to their disclosure by the Defendant.  But the evidence was that these were disclosed to the Defendant by Surrey Police, and the Defendant then uploaded them to its system for clinical assessment.  That was the evidence of Mr Lau.  As the Defendant pleaded in its Defence at [11], it is not responsible for the actions of Surrey Police or any other third party. There was no evidence that the risk assessments were somehow procured by the Defendant.    An email dated 15 November 2016 sent from Surrey County Council via the MASH which accompanied one of the police risk assessments stated (H/276):

“Please see attached Police Notification regarding the above named client for you to make a decision about your involvement.”

162.      Hence although the risk assessments ended up in the possession of the Defendants, it did not ‘obtain’ them in any meaningful sense, such as by taking some active step.  Any liability it has is by way of its storage and retention of these documents, and not from any disclosure by it. In fact, there was no evidence that they have been disclosed by the Defendant to any third party.  

163.     I will not set out the detail of the risk assessments, which are contained in the evidence.  They included concerns about YSL’s mental health and potential for suicide; an allegation that he may have assaulted his mother (although proceedings were never brought); and other matters.

164.     YSL accepts (trial Skeleton Argument, [14]):

 

“14. The completion and submission of an 'Adult at Risk' form indeed serves as an important component of safeguarding procedures, designed to protect individuals who may be vulnerable due to age, illness, or a mental or physical condition, and who are unable to protect themselves against significant harm or exploitation. Such forms are typically used to document and report concerns, not necessarily to instigate health or social care services.”

 

165.     I have no doubt that the processing of these by the Defendant when they were received from Surrey Police via the MASH in 2016 and 2017 was lawful under the DPA 1998 for the reasons given earlier.  They plainly concerned YSL’s health and needed to be uploaded and stored for clinical assessment.  That was Mr Lau’s evidence, which I accept.   It was not necessary for the Defendant to conduct some sort of balancing exercise before uploading them to its system, nor to notify the Claimant specifically and personally in advance.  The right to be informed under data protection legislation (now, pursuant to Article 13 of the UK GDPR) plainly does not mean that every individual has to be specifically informed every time a data controller organisation receives personal data about them, before or at the time it is received.   

 

166.     Finally, in case it is thought I have overlooked it, YSL referred to data relating to criminal convictions in his PoC at [42(b)].  That, I take it, is the reference to one of the risk assessments alleging that YSL had assaulted his mother (see above).

 

167.     The processing of this data (which was sensitive personal data by virtue of s 2(g) of the DPA 2008) was lawful for the same reasons I gave earlier in relation to YSL’s medical data.  The data in question formed part of the narrative about concerns over YSL’s mental health, and was intimately bound up within it, the whole forming part of a risk assessment about YSL who was thought to be vulnerable.

 

168.     So far as the subsequent data protection regime is concerned, Article 10 of the UK GDPR provides:

 

Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by  domestic law  providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

2. In the 2018 Act -

(a) section 10 makes provision about when the requirement in paragraph 1 of this Article for authorisation by domestic law is met;

(b) section 11(2) makes provision about the meaning of ‘personal data relating to criminal convictions and offences or related security measures’.”

169.         Section 10(4) and (5) provide:

(4) Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

(5) The processing meets the requirement in Article  10(1) of the UK GDPR  for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.”

 

170.         Section 11(2) provides:

 

In Article 10 of the  UK GDPR  and section 10, references to personal data relating to criminal convictions and  offences or related security measures include personal data relating to -

 

(a) the alleged commission of offences by the data subject,

 

or

 

(b) proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.”

 

171.     There are several conditions in Sch 1 which might apply to the data in question, but the most obvious one is [2] of Part 1 (processing is necessary for health or social care purposes).   The processing of the allegation of assault by continued storage post-2018 was therefore lawful, for the same reasons it was lawful under the DPA 1998.

 

Retention of the records and request for erasure under data protection legislation

 

172.         I turn to the YSL’s claim about the retention of his data (PoC, [52] et seq). 

 

173.     YSL exercised his right to object under Article 21(1) of the UK GDPR, which provides:

“(1) The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions.

The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

(2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.”

174.         He also requested that his data be erased, pursuant to Article 17(1), which provides:

“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

c the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

d the personal data have been unlawfully processed;

e the personal data have to be erased for compliance with a legal obligation [under domestic law];

f the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).”

175.     Article 17(3) provides important exceptions to the general rights conferred by Articles 17(1) :

“(3) Paragraphs 1 and 2… shall not apply to the extent that processing is necessary:

a for exercising the right of freedom of expression and information;

b for compliance with a legal obligation which requires processing [under domestic law] or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

c for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

d for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

e for the establishment, exercise or defence of legal claims.”

176.     In my judgment YSL is not entitled, in other words, he has no right, to have his data erased under Article 17(1). 

177.     Firstly, that is because his request relates to data the processing of which is necessary in the area of public health in accordance with Articles 9(2)(h) and (i) and so his right to erasure is disapplied by Article 17(3)(c). 

178.     In this context, ‘necessary’ means ‘reasonably rather than absolutely or strictly necessary’: South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421, [27].  But whether this interpretation of ‘necessary’ is adopted, or some stricter test as in ‘strictly necessary’ (as per Elgizouli v Secretary of State for the Home Department [2020] 2 WLR 857, [6]-12], [155], [158], [168], [219]-[220], [225], [230], which concerned the derogations from the general prohibition on data transfers to a third country in s 73, DPA 2018), the test is satisfied.  YSL has long standing and ongoing mental health issues that have led to reports of assaults on others and suicide attempts and it is therefore necessary for the Defendant to retain his medical data.   The data is primarily being processed (ie, retained) for his potential benefit.

179.     Second, the Defendant is entitled to rely on Article 17(3)(e).   It is necessary for the Defendant to retain the data in question to defend itself from legal claims (and, from its Defence, I infer this is a condition of its liability insurance).  Since at least 2016 YSL has been threatening litigation, which culminated in the present case and, per his fifth letter of claim from June 2023, he is threatening further litigation.  He has also made regulatory complaints to the ICO about the Defendant’s handling of his data.  All of this means that the Defendant is entitled not to erase his data so that it can defend itself in relation to these or any other legal matters (whether or not instituted by YSL).

180.     For the same reasons, the Defendant has established a basis for not ceasing to process YSL’s data pursuant to his objection under Article 21.  I find its reasons for continuing to process YSL’s data are compelling and satisfy the requirements of Article 21(1).  I reject his contention at PoC, [56(b)], that the processing by way of retention is ‘highly prejudicial’ to him.  The contrary is the case, as I said earlier, and as I shall return to.  

181.     In refusing to erase or cease to process YSL’s data, the Defendant was again acting entirely in keeping with its published Policy.  Paragraph 28 provides:

28.0 Right to Erasure (right to be forgotten) (Article 17):

 

28.1 Our Trust is an official authority carrying out public tasks such as the provision of care. A person cannot normally make a request to delete their health record for this reason.

 

28.2 A person can make a request that our Trust erases their personal data where one of the following conditions applies:

 

• The personal data is no longer necessary in relation to the purposes from which they were collected.

 

• The person objects to the processing, and there are no overriding legitimate grounds for the processing.

 

• The personal data has been unlawfully processed.

 

• Consent, i.e., Article 6(1)(a), is being used as the lawful basis under the Data Protection Legislation.

 

28.3 Where our Trust receives a request of this nature it will be passed to the Records Management Team for consideration, who will provide a response to person on whether our Trust has decided to erase the data. if

 

28.4 Where our Trust receives a request from an individual to delete their information, only where the record retention period set by NHS Digital has been exceeded or where there are legal implications, will our trust enact an individual’s rights under Article 17 of UK-GDPR.”

182.     As I will discuss in the next section, the relevant period in relation to YSL’s records is 20 years from when the records ceased to be operational.

YSL’s claims as framed under Article 8 of the ECHR and common law privacy/confidentiality

183.     YSL also brings claims under Article 8 and common law privacy/confidentiality (see PoC, [43] et seq).  There is no meaningful difference between these different causes of action in this context.

184.     Article 8 provides:

“Right to respect for private and family life

1 Everyone has the right to respect for his private and family life, his home and his correspondence.

2 There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

 

185.     YSL’s case is that the Defendant has engaged in the ‘covert’ collection of data about him and has continued to store it unlawfully, and will continue to do so for the 20 year retention period under the NHSX Code.  He said at [53] of his trial Skeleton Argument:

 

“53. Even if the court were to find the retention schedule is a necessity for the retention of data and proportionate the court should give wight to very specific circumstances in this case as per [89] of Johnson J’s judgement in AB v Chief Constable of British Transport Police [2022] EWHC 2749 (KB). Having information about one’s life collected covertly with a running commentary and then to having the most sensitive parts of one’s life distributed to multiple parties without their knowing would be distressing to anyone and its continued retention continues to be extremely distressing to C and left them feeling fearful and violated..”

 

186.     The Defendant denies that its retention of YSL’s medical data is an ‘interference’ with his Article 8(1) rights.  It says that his records are retained on a confidential basis, and were created as an inevitable consequence of the medical treatment he received. It seeks to distinguish what Lord Sumption said in R (Catt) v Commissioner of Police of the Metropolis and another [2015] AC 1065, [6]:

 

“… the state’s systematic collection and storage in retrievable form even of public information about an individual is an interference with private life”.

 

187.     The context of that case was as follows (at [1]):

 

“1. This appeal is concerned with the systematic collection and retention by police authorities of electronic data about individuals. The issue in both cases is whether the practice of the police governing retention is lawful, as the appellant police commissioner contends, or contrary to article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, as the respondent claimants say. A particular feature of the data in question is that they consist entirely of records made of acts of the individuals in question which took place in public or in the common spaces of a block of flats to which other tenants had access. The information has not been obtained by any intrusive technique such as bugging or DNA sampling. In the first appeal, Mr John Catt objects to the retention on a police database of records of his participation in political demonstrations going back to 2005. In the second appeal, Ms T objects to the retention on a police database of a record of a minor altercation with a neighbour which the latter reported to the police. Each of them accepts that it was lawful for the police to make a record of the events in question as they occurred, but contends that the police interfered with their rights under article 8 of the Convention by thereafter retaining the information on a searchable database. I shall have to say more about the facts of these cases in due course. Both claims failed at first instance. In the Court of Appeal, they were heard together, and both appeals were allowed: [ 2013 ] 1 WLR 3305.”

188.     The Defendant submits that YSL’s patient medical records, and the adult risk assessments received from the police, are qualitatively different from the sort of records gathered by the police that were considered in Catt.  YSL’s records have not been produced because of state ‘surveillance’ or systematic collection (although I note YSL’s claim that the collection of information as part of his CAMHS treatment ‘felt like a form of surveillance’; see his trial witness statement, [16]). YSL’s records are the product of his interaction with the Defendant as a patient and of it receiving information from the police with the aim of protecting YSL’s health and welfare by providing medical services to him.

189.     I am prepared to assume in YSL’s  favour - without deciding definitively in the absence of full argument - that the processing of YSL’s patient records by way of storage and retention represents an interference with his Article 8(1) rights for the purposes of Article 8(2). However, it is clear that there is a substantial body authority which supports that view. 

190.     In Chave (née Jullien) v France (Application no 14461/88, decision of 9 July 1991) the European Commission on Human Rights (a Council of Europe body whose role was to determine whether a petition was admissible to the European Court of Human Rights which was abolished by Protocol 11 to the Convention in 1998)  confirmed in respect of a case involving the retention of the applicant’s mental health records that:

“The Commission recalls that the notion of necessity implies that the interference corresponds to a pressing social need and, in particular, that it is proportionate to the legitimate aim pursued. However, the national authorities enjoy a margin of appreciation, the scope of which depends not only on the nature of the legitimate aim pursued but also on the particular nature of the interference involved … in the present case it is necessary to weigh the respondent State’s interest in protection of health or the rights and freedoms of others against the seriousness of the infringement of the applicant’s right to respect for her private life.”

191.     The Commission went on to find that the continued presence in a central record of information about her confinement in a psychiatric institution was an interference with her private life, but that the interference was not disproportionate to a legitimate aim, ie, health.  The Commission placed reliance, in particular, on the facts that the records were kept on a confidential basis.

192.     In BB v France (Application no. 5335/06, 17 December 2009) (referred to in Catt, [5]) a case concerning the inclusion of persons in a register of convicted sex offenders, it was held at [57] that the ‘mere storing by a public authority of data relating to the private life of an individual’ engaged Article 8 of the Convention so as to require justification.

193.     In LH v Latvia (Application no. 52019/07, 29 April 2014) the applicant underwent a surgical procedure without her consent and she subsequently sued the hospital.  Prior to that, the director of the hospital had written to the Inspectorate of Quality Control for Medical Care and Fitness for Work (the MADEKKI), requesting it to evaluate the treatment which the applicant had received. The MADEKKI was a government institution whose main functions were to inspect and monitor the professional quality of health care in medical institutions in Latvia.   The Court said at [33]:

“33.  The parties agreed that the applicant’s medical data formed part of her private life and that the collection of such data by the MADEKKI constituted an interference with her right to respect for her private life. The Court sees no reason to hold otherwise. Therefore there has been an interference with the applicant’s right to respect for her private life. It remains to be determined whether the interference complied with the requirements of the second paragraph of Article 8 of the Convention.”

194.     The European Court of Human Rights has dealt with the issue of the storage of sensitive health-related data of those with mental health issues. In Malanicheva v. Russia (dec.) (Application no. 50405/06, 31 May 2016), [13], [15]-[18], t he applicant complained under Article 8 about the fact that between 1985 and 1992 her name had been present on the hospital register of persons suffering from psychiatric disorders and about allegedly false references to various aspects of her mental health in internal communications between the healthcare institutions and in their submissions to the domestic courts.

195.     The Court said at [13]:

It is well-established in the case-law of the Court that storing and sharing data relating to the private life of an individual and, more specifically, personal medical data, amounts to an interference with Article 8 of the Convention and therefore attracts its protection (see S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, § 67, ECHR 2008, and L.L. v. France , no. 7508/02, § 32, ECHR 2006‑XI).”

196.         At [15]-[18] it said:

15.  It is evident in the present case that the healthcare institutions had the applicant’s medical records in their possession, had in the past kept her name on the hospital register of persons suffering from psychiatric disorders, and shared that information in their internal communications and submissions to the domestic courts. The applicant did not call into question the fact that that the storing and sharing of that data as such was prescribed by law or that it pursued a legitimate aim. Indeed, it has previously been accepted that within the meaning of Article 8 of the Convention the recording of information concerning mental patients serves not just the legitimate interest of ensuring the efficient running of the public hospital service, but also that of protecting the rights of the patients themselves (see Yvonne Chave née Jullien v. France (dec.) , no. 14461/88, 9 July 1992).

16.  The crux of the applicant’s complaints concerning the presence of her name on the hospital register and the sharing of information concerning her mental health rests on her disagreement with the diagnosis given by the psychiatrists. At the same time, the applicant did not argue that her medical records were at any point divulged to the general public or made generally accessible in any other way. Nor did she argue that the procedures employed by the healthcare institutions and the courts to share the information regarding her mental health lacked sufficient safeguards.

17.  Having regard to the legitimate aim mentioned above, the Court accepts that it was necessary for the effective operation of the domestic healthcare institutions and the decision-making of the courts to store and share the relevant information (see, a contrario , L.L. v. France , cited above, §§ 45-46). Nothing in the material in the Court’s possession indicates that the information was made accessible to the public or was used for any other purpose [than deciding on the most suitable medical care for the applicant.

18.  Accordingly, the Court concludes that the complaints concerning the presence of the applicant’s name on the hospital register of persons suffering from psychiatric disorders between 1985 and 1992 and the allegedly false references to various aspects of her mental health in the subsequent internal communications between the healthcare institutions and in their submissions to the courts are manifestly ill-founded and must be rejected …”

197.     Another case is Mockutė v Lithuania, (Application no. 66490/09, 27 February 2018), [93], where the applicant complained that a psychiatric hospital had revealed information about her private life to journalists and to her mother, thus breaching Article 8 .  The Court upheld her complaint and found a violation.  It said at [93]-[95]

“93.  The Court reiterates that personal information relating to a patient belongs to his or her private life (see, for example, I. v. Finland , no. 20511/03, § 35, 17 July 2008, and L.L. v. France , no. 7508/02, § 32, ECHR 2006‑XI). The protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general (see Z v. Finland , 25 February 1997, § 95, Reports of Judgments and Decisions 1997‑I; P. and S. v. Poland , no. 57375/08, § 128, 30 October 2012; and L.H. v. Latvia , no. 52019/07, § 56, 29 April 2014). Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking such assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community. The domestic law must therefore afford appropriate safeguards to prevent any such communication or disclosure of personal health data as may be inconsistent with the guarantees in Article 8 of the Convention (see Z v. Finland , cited above, § 95).

94 .  The Court has also held that information about a person’s sexual life (see Dudgeon v. the United Kingdom , 22 October 1981, § 41, Series A no. 45; Biriuk v. Lithuania , no. 23373/03, § 34, 25 November 2008; Ion Cârstea v. Romania , no. 20531/06, § 33, 28 October 2014; Magyar Helsinki Bizottság v. Hungary [GC], no. 18030/11, § 191, ECHR 2016) as well as moral integrity (see Couderc and Hachette Filipacchi Associés v. France [GC], no. 40454/07, § 83, ECHR 2015 (extracts)) falls under Article 8 of the Convention. Likewise, information regarding a mental health related condition by its very nature constitutes highly sensitive personal data regardless of whether it is indicative of a particular medical diagnosis. Disclosure of such information falls therefore within the ambit of Article 8 (see, more recently, Surikov v. Ukraine , no. 42788/06, § 75, 26 January 2017).

95.  The Court thus previously found that the disclosure – without a patient’s consent – of medical records containing highly personal and sensitive data about a patient, including information relating to an abortion, by a clinic to the Social Insurance Office, and therefore to a wider circle of public servants, constituted an interference with the patient’s right to respect for private life (see M.S. v. Sweden , 27 August 1997, § 35, Reports  1997‑IV). The disclosure of medical data by medical institutions to a newspaper, to a prosecutor’s office and to a patient’s employer, and the collection of a patient’s medical data by an institution responsible for monitoring the quality of medical care were also held to have constituted an interference with the right to respect for private life (see Armonienė v.  Lithuania , no. 36919/02, § 44, 25 November 2008, also see Fürst-Pfeifer v. Austria , nos. 33677/10 and 52340/10, § 43, 17 May 2016; Avilkina and Others v. Russia , no. 1585/09, § 32, 6 June 2013; Radu v. the Republic of Moldova , no. 50073/07, § 27, 15 April 2014; and L.H. v. Latvia , cited above, § 33; respectively).”

198.         The authors of Harris, O’Boyle et al, Law of the European Convention on Human Rights (5th Edn, 2023), the authors state at pp542-3 under the heading ‘Data Protection’ summarise the overall position as follows (my emphasis):

“The collection, storage, and disclosure of information by the state about an individual will interfere with his right to respect for his private life.  Thus Article 8 is engaged in respect of data collection by an official census; fingerprinting and photography by the police; the collection and storage of cellular samples and DNA profiles; the collection of medical data and the maintenance of medical records, and the collection and storage of GPS data.”

199.     Hence, as I have said, the weight of authority supports the view that the retention of an individual’s medical data is an interference with their right to a private life guaranteed by Article 8(1) of the Convention which requires justification under Article 8(2).  However, the Court has readily concluded that retention is indeed justified because it serves the legitimate interest of ensuring the efficient running of hospital services, but also that of protecting the rights of the patients themselves.

200.     I am therefore satisfied that in principle the retention and processing of YSL’s data was in accordance with the law and is necessary in a democratic society for the protection of health and for the protection of the rights and freedoms of others and hence authorised by Article 8(2).

201.     It is authorised by law primarily because of the UK GDPR and the DPA 2018.  Moreover, reg 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936), imposes (in general terms) an obligation on those providing health care to maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided.

202.     These statutory provisions are supplemented by the NHSX Code. Whilst this not a statutory provisions, it is capable of providing a basis in law for the purposes of Article 8(2): Catt, [11],  The Code is:

“… a guide for you to use in relation to the practice of managing records. It is relevant to organisations working within, or under contract to, the NHS in England. The Code also applies to adult social care and public health functions commissioned or delivered by local authorities.

The Code provides a framework for consistent and effective records management based on established standards. It includes guidelines on topics such as legal, professional, organisational and individual responsibilities when managing records. It also advises on how to design and implement a records management system including advice on organising, storing, retaining and deleting records. It applies to all records regardless of the media they are held on. Wherever possible organisations should be moving away from paper towards digital records.”

203.     I said ‘in principle’ earlier because YSL complains about the 20 year retention period applicable in his particular case. He maintains that the NHS Code is unlawful in this respect because the retention period it has set it is disproportionate, and will therefore result in a violation of his Article 8(1) rights. 

204.     The NHS Code, Appendix II (Retention Schedule), states at p47:

“Retention periods begin when the record ceases to be operational. This is usually at the point of discharge from care when the record is no longer required for current on-going business, or the patient or service user has died.”

205.     In the table which follows in Appendix II, for ‘Mental health records including psychology records’ the retention period is set at ‘20 years, or 10 years after death.’

206.     The test for proportionality was set out in Bank Mellat v HM Treasury (No. 2) [2014] AC 700. Lord Sumption said at [20] that:

“… the question [of whether a measure is proportionate depends on an exacting analysis of the factual case advanced in defence of the measure, in order to determine (i) whether its objective is sufficiently important to justify the limitation of a fundamental right; (ii) whether it is rationally connected to the objective; (iii) whether a less intrusive measure could have been used; and (iv) whether, having regard to these matters and to the severity of the consequences, a fair balance has been struck between the rights of the individual and the interests of the community. These four requirements are logically separate, but in practice they inevitably overlap because the same facts are likely to be relevant to more than one of them.”

207.     Lord Reed dissented on the facts, but at [74] adopted an approach to proportionality  which was in substance the same as Lord Sumption's (and Lord Sumption expressly agreed with Lord Reed on this at [20]):

“74. The judgment of Dickson CJ in Oakes [1986] 1 SCR 103], provides the clearest and most influential judicial analysis of proportionality within the common law tradition of legal reasoning. Its attraction as a heuristic tool is that, by breaking down an assessment of proportionality into distinct elements, it can clarify different aspects of such an assessment, and make value judgments more explicit. The approach adopted in Oakes can be 791summarised by saying that it is necessary to determine (1) whether the objective of the measure is sufficiently important to justify the limitation of a protected right, (2) whether the measure is rationally connected to the objective, (3) whether a less intrusive measure could have been used without unacceptably compromising the achievement of the objective, and (4) whether, balancing the severity of the measure’s effects on the rights of the persons to whom it applies against the importance of the objective, to the extent that the measure will contribute to its achievement, the former outweighs the latter. The first three of these are the criteria listed by Lord Clyde in de Freitas, and the fourth reflects the additional observation made in Huang. I have formulated the fourth criterion in greater detail than Lord Sumption JSC, but there is no difference of substance. In essence, the question at step four is whether the impact of the rights infringement is disproportionate to the likely benefit of the impugned measure.”

208.     I make the following observations drawn from authority about steps (3) and (4) of this analysis.

209.     Firstly, in relation to the third step, a measure does not become disproportionate just because (for example in this case) a lesser retention period of 19, 18 or 17 years could have been selected by the authors of the NHSX Code.   Lord Reed explained at [75]:

“75. In relation to the third of these criteria, Dickson CJ made clear in R v Edwards Books and Art Ltd [1986] 2 SCR 713, 781–782 that the limitation of the protected right must be one that “it was reasonable for the legislature to impose”, and that the courts were “not called on to substitute judicial opinions for legislative ones as to the place at which to draw a precise line”. This approach is unavoidable, if there is to be any real prospect of a limitation on rights being justified: as Blackmun J once observed, a judge would be unimaginative indeed if he could not come up with something a little less drastic or a little less restrictive in almost any situation, and thereby enable himself to vote to strike legislation down ( Illinois State Board of Elections v Socialist Workers Party (1979) 440 US 173, 188–189); especially, one might add, if he is unaware of the relevant practicalities and indifferent to considerations of cost. To allow the legislature a margin of appreciation is also essential if a federal system such as that of Canada, or a devolved system such as that of the United Kingdom, is to work, since a strict application of a “least restrictive means” test would allow only one legislative response to an objective that involved limiting a protected right.”

210.         Lord Sumption said of the third stage at [20]:

“The question is whether a less intrusive measure could have been used without unacceptably compromising the objective.”

211.     He also approved the formulation of Maurice Kay LJ in the Court of Appeal at [2012] QB 101, [30], who said of the third step:

“It does not amount to insistence that the least intrusive measure is selected. It is that consideration be given to whether the legitimate aim can be achieved by a less intrusive measure without significantly compromising it.”

212.         As to the fourth step, in R (SC) v Secretary of State for Work and Pensions [2019] EWCA Civ 615, Leggatt LJ (as he then was) said at [84]:

84.Put more shortly, the question at step four is whether the impact of the right's infringement is disproportionate to the likely benefit of the impugned measure. Another way of framing the same question is to ask whether a fair balance has been struck between the rights of the individual and the interests of the community: see the Bank Mellat case at para 20 (Lord Sumption).”

213.         In the case law of the European Court of Human Rights it is also well settled that states have a certain ‘margin of appreciation’ in applying the proportionality test, the breadth of which will vary according to "the circumstances, the subject matter and the background": see eg Rasmussen v Denmark (1985) 7 EHRR 371, para 40; Petrovic v Austria (2001) 33 EHRR 14, para 38.  The Commission in Chave referred to the margin of appreciation in the passage I cited earlier.  In its judgment on the merits in Stec v United Kingdom (2006) 43 EHRR 74, para 52, the Grand Chamber said:

“A wide margin is usually allowed to the state under the Convention when it comes to general measures of economic or social strategy. Because of their direct knowledge of their society and its needs, the national authorities are in principle better placed than the international judge to appreciate what is in the public interest on social or economic grounds, and the Court will generally respect the legislature's policy choice unless it is 'manifestly without reasonable foundation'.”

214.     This statement has been reiterated in a number of cases: see eg, Carson v United Kingdom (2010) 51 EHRR 13, para 61; Andrejeva v Latvia (2010) 51 EHRR 28, para 83; Fábián v Hungary [2017] ECHR 744, para 115.

215.     The test stated in the Stec case was referring to the margin of appreciation afforded to national authorities by an international court, and not to the approach which a national court should take towards a policy choice made by its own legislature. However, at the national level, there is a broadly analogous principle that in some circumstances it is appropriate for the courts to recognise that there are areas of judgement within which the judiciary will defer, on democratic grounds, to the considered opinion of the body or person whose act or decision is said to be incompatible with the ECHR: R v Director of Public Prosecutions ex parte Kebilene [2000] 2 AC 326, 381. In the domestic context, the term ‘margin of discretion’ rather than ‘margin of appreciation is used. In In Re Medical Costs for Asbestos Diseases (Wales) Bill [2015] AC 1016, [44], Lord Mance said the latter term does not apply at the national level. Lord Reed made a similar point in R(SC) v Secretary of State for Work and Pensions [2022] AC 223, [143]. Nevertheless, he went on to point out, as I have said, that domestic courts have generally endeavoured to apply an analogous approach to that of the European court.

216.     In R (Lord Carlile of Berriew and others) v Secretary of State for the Home Department [2015] AC 945, Lord Sumption said at [34]:

“34. Various expressions have been used in the case law to describe the quality of the judicial scrutiny called for when considering the proportionality of an interference with a Convention right: ‘heightened’, ‘anxious’, ‘exacting’, and so on ... But the legal principle is clear enough. The court must test the adequacy of the factual basis claimed for the decision: is it sufficiently robust having regard to the interference with Convention rights which is involved? It must consider whether the professed objective can be said to be necessary, in the sense that it reflects a pressing social need. It must review the rationality of the supposed connection between the objective and the means employed: is it capable of contributing systematically to the desired objective, or its impact on the objective arbitrary? The court must consider whether some less onerous alternative would have been available without unreasonably impairing the objective. The court is the ultimate arbiter of the appropriate balance between two incommensurate values: the Convention rights engaged and the interests of the community relied on to justify interfering with it. But the court is not usually concerned with remaking the decision-maker's assessment of the evidence if it was an assessment reasonably open to her. Nor, on a matter dependent on a judgment capable of yielding more than one answer, is the court concerned with remaking the judgment of the decision-maker about the relative advantages and disadvantages of the course selected, or of pure policy choices (eg do we wish to engage with Iran at all?). The court does not make the substantive decision in place of the executive. On all of these matters, in determining what weight to give to the evidence, the court is entitled to attach special weight to the judgments and assessments of a primary decision-maker with special institutional competence.”

217.     As Steyn J succinctly put it in R (II) v Commissioner of Police for the Metropolis [2020] EWHC 2528 Admin, 63(iii), which was a retention case:

“iii) The assessment of proportionality is a matter for the Court, giving appropriate weight to the views of those with particular expertise in the relevant field.”

218.     Hence, my role is not to usurp the role of the primary decision maker (in this case,  in substance, NHSX), and I have to afford an appropriate degree of deference for its judgement on how NHS data is to be managed and in particular how long it is to be retained for.

219.     In the present case, the NHSX Code was plainly the result of detailed consideration by those expert in what was needed by way of retention of NHS data.  It is relevant to point out that the Policy covers every conceivable type of data which the NHS might be in possession of.  It is not limited to patient and medical data, but also covers,  for example, complaints records and corporate records.  In relation to patient records, there are different periods specified for different types of record. For example, adult health records not otherwise covered in Appendix II have a retention period of eight years. For some types of record, the retention period is far longer than 20 years. Hence, GP records where the patient de-registered from the practice for unknown reasons have to be retained for 100 years.  Although there was no evidence directly on point, I can safely infer that 20 years was not some arbitrary choice, but that those who are expert in such matters decided that 20 years was the appropriate period for mental health records to be retained given their particular nature.  It follows that I have to allow a significant margin of discretion on the grounds of institutional competence for NHSX’s decision that that was the appropriate period.

220.     Applying these criteria to the 20 year retention period, I have concluded that that period does not render the otherwise lawful retention of YSL’s medical records disproportionate and so unlawful and in breach of Article 5 of the UK GDPR.

221.     For the reasons I have already give, the first and second parts of the proportionality test are satisfied.  The third and fourth overlap.  In considering these, I adopt the approach of the Divisional Court in R (CL) v Chief Constable of Greater Manchester Police [2018] EWHC 3333 (Admin), [105].   This was a retention case concerning the retention by the police of crime reports arise from teenage ‘sexting’.  Hickinbottom LJ  and Moulder J said that proportionality is a matter of substance not form, and that it was the Court to consider whether, on all the evidence, the collection and retention of the claimant's personal data for the purposes identified in Article 8(2) is proportionate to the adverse consequences of that collection and retention of data to the claimant's right to respect for his private life.  They said it was an exercise which required the Court to identify those matters in favour of allowing the collection and retention of data despite the infringement of the claimant's Article 8 rights that results, and those matters which are in favour of upholding the Article 8 rights and requiring deletion of the data; and then balance the one against the other: Polish Judicial Authorities v Celinski [2016] 1 WLR 551, [16].

222.     I consider that the interference with YSL’d Article 8(1) rights occasioned by the Defendant’s retention of his medical records is modest.  The material is very sensitive, I accept, and such interference as there is still requires justification, for sure (see Catt, [29]), but it is modest.  I do not accept YSL’s claim in [26] of his trial witness statement that, ‘it is just a matter of when and not if the Defendant will further distribute them.’  The Defendant is part of the NHS, which has patient confidentiality at its heart. YSL’s medical data is held by the Defendant pursuant to a highly regulated data protection regime, and so the suggestion that there would be some arbitrary or unlawful further disclosure in the future strikes me as far-fetched.  Absent some proper reason for the data to be accessed by a member of the Defendant’s staff (who are subject to a duty of confidentiality), YSL’s records will stay passively stored in the Defendant’s computer servers or filing system, in whatever form they are in.  There has not been, is not, nor will there be, any stigma attaching to YSL arising from the Defendant’s retention of his medical records.

223.     On the other side of the balance, there are very good reasons why it is necessary for the Defendant to retain YSL’s records for 20 years.  I have already touched on some of these. It is now some 12 or 13 years or so since YSL first became a patient under CAMHS. Nonetheless, on his own evidence, YSL continues to have mental health issues which require treatment.  As I say,  he blames the Defendant in large part for these, however, whatever the reasons for them are, they exist.

224.     It follows that YSL’s mental health may require treatment by the Defendant or another hospital in the future.  Obviously I hope it does not, but if that were to happen, then the treating clinicians would obviously need to be able to see the Defendant’s full medical history in order to determine what would be in his best interests in terms of appropriate treatment going forward, exactly as they would if YSL had some chronic long-term physical condition which required treatment.   If YSL needed mental health treatment the NHS would be bound to provide it if asked, and YSL is still young and his needs could change in the future.  Hence, his records remain an important record of his vulnerability as a young person and a young adult, even if he himself does not agree with aspects of what has been said in the past.

225.     The retention of YSL’s records is also necessary in the interests of the protection of the Defendant’s right to defend itself in litigation. As I said earlier, YSL has regularly threatened for or pursued litigation against the NHS for nearly a decade, and is threatening to do so again. If the Defendant deleted all YSL’s records, it would be left defenceless against YSL in the future (Article 17(3)(e), UK GDPR). The fact that there are limitation periods for litigation of less than 20 years does not mean that period is disproportionate. YSL has not been deterred by limitation from asserting a claim based on disclosure in 2011,  because he says that the Defendant’s alleged breach is a continuing one, which it concealed, thereby defeating limitation: draft Amended Particulars of Claim, [95]-[96].

226.     In his written submissions YSL cited a number of cases such as AB and the II case.  I have not overlooked these, but I did not find them to be helpful.  That is because, as Lord Sumption said in Bank Mellat, [20],  and Steyn J said in II, [76], specifically in relation to retention periods, proportionality is intensely fact specific. Thus, Johnson J confirmed in AB at [89] that the case succeeded on the basis of the exceptional impact of retention on AB (who had Autistic Spectrum Disorder of the Asperger’s type, and who had produced a ‘wealth of evidence’ including medical evidence as to the impact on him [32]), and in any event the judge confirmed that in ‘many cases it will be proportionate to retain crime records of offences for long periods of time’. In R (C) v Northumberland County Council [2015] EWHC (Admin) 2134, Simon J upheld as lawful a retention period of 75 years for child protection records, that period starting after a case had been closed. 

227.     YSL’s challenge to the lawfulness of a 20 year retention period, and the lawfulness of the continued processing of his data, therefore fails.

 

Accuracy

 

228.     Lastly, I turn to YSL’s complaints about the accuracy of the data held by the Defendant.  

 

229.     In the data protection context, accuracy has tended to mean ‘accurate as a matter of fact’, thereby tending to exclude expressions of opinion as capable of being ‘inaccurate’ in that context. Thus,  s 70(2) of the DPA 1998 provided:

 

“For the purposes of this Act data are inaccurate if they are incorrect or misleading as to any matter of fact.”

 

230.     The fourth data protection principle in Part I of Sch 1 to the DPA 1998 provided that, 

 

‘Personal data shall be accurate and, where necessary, kept up to date.’

 

231.     Paragraph 7 in Part II of Sch 1 provided:

 

“7 The fourth principle is not to be regarded as being contravened by reason of any inaccuracy in personal data which accurately record information obtained by the data controller from the data subject or a third party in a case where - \

 

(a) having regard to the purpose or purposes for which the data were obtained and further processed, the data controller has taken reasonable steps to ensure the accuracy of the data, and

 

(b) if the data subject has notified the data controller of the data subject’s view that the data are inaccurate, the data indicate that fact.”

232.     In NT1 and NT2 v Google LLC [2018] EWHC 799 (QB) Warby J (as he then was), said as follows in respect of the accuracy principle that:

“80. NT1’s case is that there have been breaches of the first part of the Fourth Principle: the requirement that personal data “shall be accurate”. The requirement that data be “kept up to date” does not have any application in this context. There has been some dispute about how to decide whether a published article is “inaccurate” for this purpose. Two sources of law have been addressed.

 

81. First, there is data protection law itself. DPA [1998] s 70(2) contains a ‘supplementary definition’ which explains that ‘For the purposes of this Act, data are inaccurate if they are incorrect or misleading as to any matter of fact.’ This does not take the matter much further, though the reference to fact emphasises that this Principle is not concerned with matters of comment, opinion or evaluation. The reference to “misleading” indicates that the Court should not adopt too narrow and literal an approach. The Working Party’s comments on its criterion 4 are helpful:

 

“In general, ‘accurate’ means accurate as to a matter of fact. There is a difference between a search result that clearly relates to one person’s opinion of another person and one that appears to contain factual information.

 

In data protection law the concepts of accuracy, adequacy and incompleteness are closely related. DPAs will be more likely to consider that de-listing of a search result is appropriate where there is inaccuracy as to a matter of fact and where this presents an inaccurate, inadequate or misleading impression of an individual. When a data subject objects to a search result on the grounds that it is inaccurate, the DPAs can deal with such a request if the complainant provides all the information needed to establish the data are evidently inaccurate.”

233.     Article 5(1)(d) of the UK GDPR provides that personal data shall be:

“(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);”

 

234.     Section 205 of the DPA 2018 provides that ‘inaccurate’, in relation to personal data, means ‘incorrect or misleading as to any matter of fact’.  It thus mirrors the DPA 1998 definition.  I therefore agree with the Defendant’s submission that this definition means that matters of comment, opinion, or evaluation are excluded where complaints of inaccuracy are made.

 

235.     A further difficulty with this aspect of YSL’s case is that his complaints about inaccuracy not clearly or specifically pleaded, a point which Ms Golden made in her witness statement on the strike-out application:

 

“49. Finally, any other relevant remaining allegations in the Particulars of Claim are too vague to succeed and in particular:

 

i. YSL has failed to plead a proper case on how his records are inaccurate. He should have pleaded first the meaning of the records as to a matter of fact, and then set out why he says the records are factually incorrect …”

236.         YSL’s main specifically pleaded complaint as to inaccuracy appears to relate to suggestions in his CAMHS records of a potential clinical autism diagnosis.  Paragraphs 16-18 of the PoC state (sic):

"16. [Dr JW] and [Dr DG] not only processed, collected and shared personal information and data, they failed to ensure the accuracy of said information and data and included several degrading and crass comments of their own.

17. [Dr JW] and [Dr DG] letters were also used by the Claimants School to degrade and discredit abuse perpetrated by the School on the Claimant.

18. [Dr JW] also made repeated reference the claimant being autistic, a claim which she shar[ed] and distributed to multiple parties, but never directly to the Claimant. [Dr JW] unlawful and unethical conduct has led to not only continues distress, but also negatively affected the Claimants family relationships, quality of education and development.”

237.     Paragraph 3 of his trial Skeleton Argument alleged that Drs SW and DG;  

“… initiated a campaign alleging C has autism without ever communicating this speculation to C”

238.     It seems to me that the clinical diagnosis or diagnoses which YSL complains about, to the extent they can be understood, were all matters of medical opinion which therefore fall outside the data protection accuracy principle.

239.     To the extent YSL has pleaded a separate cause of action based on inaccuracy I would strike it out as disclosing no reasonable cause of action and/or grant the Defendant summary judgment on it as having no prospects of success.   It has no merit.

 

Conclusion

 

240.     For all of these reasons, this claim fails.  For the avoidance of doubt, I reject YSL’s summary judgment application.    The Defendant made submissions that if I found for YSL on any aspect of his claim, he would not be entitled to any remedy. However, in the circumstances, I need not address these.

 

241.     Accordingly, there will be judgment for the Defendant.

 

Post-script

 

242.         Following the circulation of this judgment in embargoed draft to the parties, I received an application notice and witness statement and exhibits (medical records) from YSL.  In the application notice (dated 14 February 2024) he said he was asking the Court:

 

“…  to hand down the judgement in private, restrict access to the judgment, amend the anonymity order in the case or extended the period of which the judgement is to be handed down. This request is made due to my current physical and mental health.” 

243.         No draft order was attached, and YSL did not specify how he wanted the anonymity order extended.   I received a second witness statement and exhibit from him a few days later putting forward further reasons in support of his application.  In short, he fears being identified from the judgment, and says that its publication would cause a worsening of his ongoing health issues and hamper his recovery.    He prayed in aid inter alia Articles 3 and 8 of the ECHR and the Equalities Act 2010. 

244.         The Defendant objected to the course proposed by YSL.   In summary, it submitted that there was nothing put forward by YSL which justified a departure from the principle of open justice. Among other things, the purpose of open justice is to enable the public scrutiny of the way courts decide cases; to hold judges to account; and to enable the public to understand how the justice system works and why decisions are taken: Cape Intermediate Holdings Ltd v Dring (for and on behalf of Asbestos Victims Support Groups Forum UK) [2020] AC 629, [41]-[42].  Furthermore, the Court is a public authority for the purposes of the Human Rights Act 1998, and Article 6 requires that judgment shall be pronounced in public.

245.         It said that it was entitled to have a public judgment vindicating its position pronounced in public in the normal way. The trial was held in public, in open court, and there had been no application by YSL to sit in private.  Members of the public attended. It would therefore be wrong in principle to have a private judgment following a trial heard in public.

246.         The Defendant said that to the extent that I had the power to hand down the judgment in private or somehow restrict access to it, the required balance came down firmly in favour of the normal course being followed.  To do so would be an unjustified derogation from the principle of open justice.  The judgment deals with issues which engage the wider public interest, and could be of interest to other NHS trusts who might face similar data protection claims. Article 10 is engaged.  That said, the Defendant did not object to any further edits I might make to the draft judgment in order to further safeguard YSL’s anonymity.

247.         On the other hand, YSL’s Article 8 rights are adequately protected by the anonymity order which is in place. The Defendant said that it is not in principle opposed to the removal of specific details from the draft judgment, so long as they are details which would not, if removed, detract from the substance of the judgment, and would not offend against the principle of open justice.

248.         I decline to depart from the principles of open justice.  This judgment will be handed down in public in the normal way and then published.  My reasons are as follows.

249.         Firstly, open justice is a bedrock principle of our legal system.  It has a number of facets including: the general rule that hearings are to be in open court to which the public and press have access (see Scott  v Scott [1913] AC 417 and the commentary to CPR r 39.2(2) in the White Book 2023; that parties should be identified; and that judgments should be made public.  Any derogation from the principle of open justice requires proper justification and must be necessary and proportionate.  

250.         No proper justification exists here.  I am not unsympathetic to YSL’s health issues and the other matters he has raised, but they do not provide a basis for making the orders he seeks.

251.         Second, YSL’s identity is protected by the anonymity order made earlier in these proceedings, which I referred to in [1] of this judgment.   It made on YSL’s application on 4 April 2022 by Senior Master Fontaine.  The recital stated:

“AND UPON consideration of the Claimant’s Article 8 right to respect for private and family life and the Article 10 right to freedom of expression.

 

AND UPON IT APPEARING that non-disclosure of the identity of the Claimant is necessary in order to protect the interests of the Claimant.”

252.         That order is adequate to protect YSL’s privacy interests.  The order is extensive and, besides protecting YSL’s identity from being published, provided among other things for the redaction of YSL’s details from the documents in the bundle.  In fact, that was not done, and I took it that YSL did not object to his name and address appearing there.  He is protected in any event by the usual order preventing a non-party from inspecting the court’s documents without permission.

253.         Third, YSL chose to bring this litigation.  He made his accusations against the Defendant publicly. As the Defendant has pointed out, he did not apply for the case to be heard in private.  The trial was listed openly on the court list in the usual way. The interests at stake are therefore not just those of YSL.  The Defendant is entitled to a public judgment demonstrating that it did not act unlawfully in the way YSL claimed publicly during the trial, and to the public vindication of its reputation.

254.         I am wholly satisfied that the original draft of my judgment faithfully protected YSL’s anonymity and that there was no risk of him being identified from it, on a jigsaw basis, or otherwise.  However, following up on the Defendant’s position, and being sensitive to YSL’s concerns, out of an abundance of caution, I have again reviewed the draft judgment and made some small further edits.  


BAILII: Copyright Policy | Disclaimers | Privacy Policy | Feedback | Donate to BAILII
URL: http://www.bailii.org/ew/cases/EWHC/KB/2024/391.html