A Scottish sheriff’s court has considered the extent to which the Data Protection Act and GDPR provides an exemption in respect of legal proceedings.
The Dunfermline sheriff’s court looked at article 5(1)(a) of the UK GDPR (lawfulness, fairness and transparency) and article 5(1)(b) (purpose limitation) in conjunction with the legal proceedings exemption in paragraph 5(3) of Schedule 2 to the Data Protection Act 2018 (DPA 2018).
An employee claimed that his former employer had breached these principles while processing his personal data in defending employment tribunal proceedings brought by his colleague. The tribunal’s decision referred to the pursuer 162 times and was reported in an online newspaper article. He contended there had been a breach of fairness and transparency and that the defender should have informed him of the proceedings, provided him with copies of the tribunal bundles, asked him to comment on the allegations made against him and invited him to provide a witness statement. He sued for £75,000 for distress and anxiety, and the impact on his employment prospects.
The defender relied on the legal proceedings exemption. The core issue was the meaning of the words in paragraph 5(3)(c) “to the extent that the application of those provisions would prevent the controller from making the disclosure” and whether they qualified the exemption. The pursuer argued that the controller must attempt to comply before relying on the exemption with the defender arguing there was no such requirement.
The court considered that a controller’s duties should not fetter its discretion to conduct litigation as it saw fit or impinge on its right to a fair trial. Requiring the defender to have invited the pursuer to comment and taken a witness statement would undercut its discretion as a litigant. The tension between data protection requirements and the demands of litigation was precisely what the exemption was intended to address.
Therefore, where the application of a listed GDPR provision would result in a change to the content of the disclosure, it ought not to be applied and the effect of the legal proceedings exemption was to exempt the defender from having to comply with those provisions. A court or tribunal could anonymise a judgment if considered necessary to protect an individual’s privacy.
Although this is a Scottish decision, the exemption applies throughout the UK and this decision appears to be the first to consider the exemption under the DPA 2018 and suggests a wide application of the exemption.
Source: Practical Law
Case: Riley v Student Housing Co (Ops) Ltd [2023] SC DNF 7 (8 February 2023) (Sheriff C Lugton).
