Data Protection and Disclosure of Confidential Information

When disclosing records and documents during legal proceedings issues arise in relation to records containing personal information and data relating to third parties not involved in the litigation. The majority of concerns arise due to the implications of the Data Protection Act 1998 which lays down principles for the way in which personal data must be managed. The Act also provides a framework to ensure that personal data is handled properly.

 

Section 35 of the Data Protection Act specifically states that all the restrictions and requirements imposed by the Act restricting disclosure of personal data do not apply when the disclosure is for the purposes of legal proceedings (including prospective legal proceedings). So arguably, Insurers need not concern themselves with the formalities that would usually be encountered with regards to personal data r when the disclosure is within the context of proceedings.

 

It is necessary to bear in mind, however, that aside from the provisions of The Act, there may still be issues of confidentiality behind much of the information and records held by parties to legal proceedings, so Insurers should always err on the side of caution and try to safeguard as much personal and confidential information as possible.

 

Disclosure in civil proceedings is principally governed by Part 31 of the Civil Procedure Rules. The problem arises when there is confidential data which falls within a Defendant’s disclosure obligation. CPR 31 makes no mention of confidential data, third party data or commercially sensitive data and so in order to deal with this issue we have to look at the case law.

 

The leading case on disclosure of confidential information is the decision of the House of Lords in Science Research Council v Nasse (1980) AC 1028. In this sex discrimination case, Mrs Nasse sought disclosure of annual assessments relating to two of her colleagues promoted above her. The House of Lords held that there was no principle of English Law by which documents were protected from disclosure by reason of confidentiality alone. However, the Court would have regard to the fact that the documents contained confidential information and that disclosure would constitute a breach of confidentiality.

 

Whether the personal information was relevant was an important factor but not an automatically sufficient ingredient to compel  disclosure and the ultimate test for the Court was whether the disclosure sought is necessary for disposing fairly of proceedings. The Court considered whether the necessary information had been or could be obtained by other means which would not involve a breach of confidentiality. Ultimately, the House of Lords accepted that the Science Council did not have to disclose the files relating to the other two employees on the basis that they held confidential information about those employees and those records were not necessary to dispose of Mrs Nasse’s case.

 

Another, more recent case concerning disclosure and data protection is that of Webster & Durnford v Ridgeway Foundation School Governors (2009). This case concerned an action in negligence brought against a Schoool by the parents of a boy attacked by other pupils. The School redacted its disclosure documents so that pupils’ names could not be seen. The Claimants sought specific disclosure of names that had been redacted on disclosure documents. The Court’s view was that the primary question was whether the document in question is relevant and necessary for resolving the matters in dispute. The Court considered that the provisions of the Data Protection Act 1998 were irrelevant because they allowed disclosure in legal proceedings. The Court also considered Article 8 of the European Convention on Human Rights, the right to private life, balanced with Article 6, the right to a fair trial. In conclusion, the Court erred on the side of protection of personal data, and refused to permit the disclosure of names of other pupils who had been victims of assaults and bullying, on the basis this would have been an interference with their private lives. This case shows that there is a high threshold when justifying disclosing personal data relating to children not involved in the case.

 

The case of Croft House Care Ltd, Orchard Home Care Ltd and Kelly Park Caring Agency v Durham City Council (2010) involved a dispute over the disclosure of commercial or business sensitive information. The Claimants brought proceedings against the Council for breaches of a procurement process. The Council did not want to disclose commercially sensitive data provided by tenderers and did not want to disclose information which would prejudice the Council’s ability to re-run the procurement process in the future. The High Court held that when balancing the confidentiality rights of third parties against the necessity of documents to be provided for the purpose of a fair Trial, the tender documents should be disclosed. It was found that the data went directly to the pleaded case.

 

If the data is necessary, consent should be sought and if it cannot be obtained, the documents being disclosed should be redacted. If the opponent demands sight of the un-redacted version then the decision rests with the Court to balance the considerations and needs of each party, following which it can order disclosure if it deems it justified and necessary in the circumstances. This is likely to be the safest course of action and should the matter lead to any complaint as to breach of confidentiality, Insurers will be better protected because the documentation will have been disclosed pursuant to a Court Order.   Further, any disclosure provided within proceedings can only be used by the parties for the purpose of the proceedings in which it is disclosed, arguably limiting the exposure of the sensitive data concerned. When dealing with sensitive personal information, if a person cannot be traced to give suitable consent then it is best to insist upon having a Court Order disclosure in order to protect the Insured’s position.

 

Ultimately, when faced with the question of disclosure of confidential information it is always advisable to err on the side of caution and wherever possible, seek to comply with the requirements of the Data Protection Act 1998 by not disclosing any personal data relating to or identifying a Third Party without their consent.  If this is not possible, a Court Order should provide protection and is the safest way for this often difficult question to be dealt with.

Emma Foxon
Solicitor