Data protection case law anyone ?

[Prouty99]

Firstly, apologies for harping on about this (as i've already posted on the general issue), but this is a related issue

 

Does anyone have any case law for data protection breach by a UK employer ? I am aware that the majority of data protection complaints are probably settled out of court, (so therefore not public knowledge), but i am struggling to find any case law verdicts that actually were decided in court, and what if any compensation was awarded.

 

To be specific, my employer dismissed me without warning, prior arrangement, representation, or records of minutes taken at 'the hearing'.

 

This is being dealt with by my trade union legal team, so it isn't necessary to gain any further advice at this time.

 

The issue at hand is that my employer sent an email to the entire UK network telling them that they had immediately dismissed me, and naming me in the email within 15 mins of the event, then to prevent any possible defence to this issue they deleted my entire company email account, and all of the emails contained within it within 15 minutes of the event also.

 

The company didn't have my authorisation to release this data, and it was released prior to any dismissal letter, or invitation to appeal.

 

Considering the size of the company, and the nature of the business (welfare to work), i feel that i will have major issues attempting to gain employment in this sector for the forseeable futue owing to the sheer amount of people in the industry that now know about my instant dismissal.

 

So how would a court even quantify this and translate this into a compensation award ? What kind of compensation awards are awarded for breaches of this nature ? And, where would i find case law of a similar nature for cases that have actually been won in court ?

[elche]

Prouty,

 

The obvious question, is have you raised this with the union sol? and what did they say?

 

I only had a quick look, but beyond the Durant case I could find little case law.

 

This is from a reliable source:

 

Under the provisions of the DPA 1998, the Information Commissioner can serve an enforcement notice on an employer requiring it to take remedial steps if it is found to have contravened the DPA 1998. This can include a requirement to:

 

— provide the personal data held about the data subject;

 

— rectify, block, erase or destroy personal data;

 

— refrain from processing data of a certain category;

 

— refrain from processing data in a particular manner.

 

In addition, if an employer fails to comply with any of the provisions of the DPA 1998, an employee can seek an order of disclosure from the courts and bring a claim for compensation if any damage is suffered as a consequence of the breach. Compensation for any distress caused may also be recoverable.

 

Why not call the ICO helpline. I haven't used them for ages but they were surprisingly good when i contacted them about 2 years ago.

 

http://www.ico.gov.uk/Global/contact.aspx

 

Has there even been a breach here? I know companies regularly tell staff that employees have moved on - workforce planning etc etc...

 

Che

[lindyhop]

Hi Prouty99, i have recently been looking into this myself and have found the following (sorry, my IT skills mean that i dont know how to transfer a link - sad i know)

 

website legal centre.co.uk covering employer obligations for perserving personal data and confidential information

cases mentioned

thomas v Pearce 2000

Jackson v Royal Bank of Scotland

Durrant (already mentioned)

Coco v A N Clark

Douglas v Hello

 

i found this particular site useful. have a read it may help things a little clearer for you and your own case.

 

my best wishes for you having a successful case.

 

Lindyhop

[Prouty99]

Thanks folks

 

To address elche first, I am in the process of union action, and they are (understandably) going for the jugular on the refusal on section 10 ERA as a priority, and have referred the DPA to a specialist to see where we go with that one..., i am just trying to get a heads up, as i have had cases in the past where i have pointed out obscure angles that may be approached that the legal people hadn't thought of initially (that later bore fruit)

 

 

 

The novel ruling i eluded to was based on a set of 35 year old regulations that had never been repealed, and very rarely utilised for the use that i put them to..., i even got a compliment from the judge who complimented me on my resourcefulness.

 

 

 

As for the DPA, there seems to be a clear path for the legal people to follow, and clear case law for employers to follow, with fines for the companies/bodies well documented

 

 

 

But not very clear for the damage to reputation, defamation, and release of private data for the actual person who's privacy is abused.

 

 

 

You say that companies on occasion inform staff that an employee has moved on (which i have seen many times in industry), but to inform not only staff but many others within the company i have never met about the results of not only a disciplinary, but a disciplinary leading to dismissal, is a different kettle of fish altogether.

 

 

 

Everything that takes place at a disciplinary hearing is private, and confidential. This is why when you are invited to one, or sent a letter with the results of one, the letter always says private and confidential

 

 

 

If the email had said that Mr.Prouty99 had moved on to pastures new and we wish him all the best, then i wouldn't be writing this message, and there would be no case to answer.

 

 

 

The fact that the email says Mr.Prouty99 has today been immediately dismissed from the company for 'x' deserves a reaction from myself utilising the full weight of the law

 

 

I also have a mind to send a SAR for every email written by me, and every one sent to me during my employment, and if they have all been destroyed then they cannot magically appear at my appeal hearing to be used as evidence against me (although i know no dodgy emails were sent either way)

 

 

 

The union also suggested that they may ask the company for a reference, and send it from an email address of a company where the union has recognition, just to see how venomous the reference is, so we can use it as evidence of continuing victimisation even after dismissal.

 

 

 

Thanks for the links Lindyhop, i will check them out

[lbruk]

Agreed, however you can only go to court for financial losses, ie it stopped you getting a new job. If you have suffered financial losses then you can claim hurt feelings.

 

I have been through the entire process with the ICO, with them finding them in breach of the Data Protection Act, but because I was not financially worse off for the breach I could not take them to the small claims court.

[Prouty99]

So what did the ICO do to the company who breached ?

 

Did they get a fine ?

 

If the ICO just slap their wrist, and give them an improvement notice (much like the HSE do for H&S cases), does the fact that they have taken that action become public knowledge ?

 

If i took this to the ICO, and proceeded the case to court, (even though i knew i wasn't going to win anything), then surely the judge would request the company to give some kind of apology, or to send another email throughout the company making an apology. Personally i think it is in the public interest to take this forward as the company's business, and contracts, are based on its data protection principles (as this is the company's core business)

 

If i released your private data concerning the details of your disciplinary hearing to hundreds of people, then later took you into a room and apologised, its too late, the damage has already been done, your reputation has been damaged, and your future prospects are still bleak.

 

Sorry just doesn't cut it, those hundreds of people still regard you as an ass, as they haven't been party to the casual sorry, and thats just the people i know about..., i was given a copy of this by a friend of a friend, and nobody in this chain of friends was on the email rotation, and none even work for the company to start with

 

This has been released internally, then copied, printed and circulated outside of the company...

 

You can't really put a price on defamation

[lbruk]

No, there was no fine.

 

Companies have the right to be given notices of improvements to help there where they have messed up. I agree that you cant put a price on defamation and the company is vicariously liable for the actions of its employees. However there is nothing at the moment that supports this way of thinking that i am aware of.

 

You are very unlikely to get an apology, even if you went to court, and won!