Facts:
The Claimant (YSL) was a patient of the Defendant under the Child and Adolescent Mental Health Services from around April 2011 until his discharge in October 2014. He was subsequently assessed in February 2016 when he was an adult.
He complained to the Defendant about the various issues in 2015 and an internal complaints procedure was carried out. Both parties agreed to settle and discharge all claims in 2016 for £6,000. A few days after the settlement YSL sent a second letter seeking compensation of £2.5 million together with a formal apology. In 2019, the Claimant sent a third letter asking £7,000 in compensation. In February 2020, the Defendant denied liability. He then requested the immediate removal of his personal data, yet the Defendant refused to erase the data.
He brought a claim against the Defendant under the data protection legislation, privacy and the Human Rights Act 1998. The claim concerns the patient records and the unlawful processing and retention of his personal data by the Defendant as well as the disclosure of those data to third parties. He also claimed that some of the data were inaccurate, such as the diagnosis of potential autism. He further claimed that the 20-year retention policy was unlawful and contrary to his fundamental rights. He also complained about the processing of material by the Defendant received from Surrey Police concerning himself via something called the Surrey Multi-Agency Sharing Hub (MASH).
Decision:
The Court agreed with Defendant that the Claimant should have brought all his claims in 2016 as he had access to his medical record. Allowing such a claim would be an abuse of process on the basis of Henderson v Henderson (1843) and Johnson v Gore Wood & Co (No 1) [2002]. Indeed, when agreeing on the settlement, YSL compromised on all claims, even future ones which would arise from the disclosure of his personal information by CAMHS staff. However, it did not cover the data processing by the Trust, the retention of his records, or the procession of the Surrey Police risk assessments.
To reach this conclusion, the Judge also applied the test to strike out a summary judgment as established by EasyAir Limited v. Opal Telecom Limited [2009]. The Court refused to strike out the claim solely on the basis that YSL had exhibited vexatious conduct over the years in sending multiple letters.
The Court turned to the question whether YSL’s sensitive personal data were processed in accordance with the DPA 1998, which the Court found they were. The Court analysed the required conditions in Schedule 3 and ruled that the test of necessity means ‘reasonably necessary’ rather than ‘absolutely or strictly necessary.’ The Court turned to the UK GDPR, in particular Article 6 and concluded that Article 6(1)(e), in conjunction with Section 8 of the DPA 2018, allows the processing of data by health care providers. Regarding the MASH, the Court noted that they were disclosed by the police to the Defendant and not the opposite. The Judge was satisfied that they were lawfully processed under the DPA 1998.
Finally, the Court agreed with the Defendant that the Claimant has no right to have his data erased under Article 17(1) UK GDPR as the data are necessary in the area of public health. In this case, the Court also found that the data were primarily processed for the benefit of the Claimant and, therefore, could not be erased. Similarly, the Court also analysed the cases from the European Court of Human Rights in deciding whether the processing of YSL’s patient records by way of storage and retention represents an interference with his Article 8(1) rights for the purposes of Article 8(2). While the case law supports the view that the retention of an individual’s medical data is an interference with their right to a private life as guaranteed by Article 8(1) of the Convention, their retention was necessary in a democratic society and, therefore, authorised by Article 8(2).
Implications:
This case demonstrates that while data protection laws have evolved, they do not guarantee unrestricted rights. Not every date can be erased. The Court was very cautious, analysing every aspect carefully. However, as reiterated, necessary means ‘reasonably rather than absolutely or strictly necessary’. The case also highlights that early settlements must be well thought out as they might prevent future claims.