Transcription

• Speaker #0

  Today in the Lefebvre HR and Employment Law podcast we're discussing the judgment in the case of Raine and J.D. Wetherspoon PLC in which the High Court was asked to determine whether personal data stored on a personnel file is processed when it is disclosed orally to a third party as a result of deception. A former employee of a pub chain brought a complaint against her employer in relation to a staff member disclosing her personal information to a third party. As part of her personnel records, the employee had provided her mother's phone number as an emergency contact. The employee was a domestic violence victim, and her former partner was placed on remand for offences against her, including harassment. Managers at the pub were aware of this. While he was on remand, the former partner called the pub, pretended to be a police officer needing to contact the employee urgently, and, with the manager's consent, was provided orally with the employee's mother's mobile number. He then called the employee's mother, again pretended to be a police officer, and persuaded her to share her daughter's mobile phone number before proceeding to call the employee, abuse her and make threats. The employee brought various claims against her former employer and Manchester County Court upheld her claims of misuse of private information and breach of confidence, but her claim under the Data Protection Act 2018 and UK GDPR failed. On appeal, the High Court upheld the County Court's decision on liability for misuse of private information and breach of confidence. The High Court rejected the employer's argument that the employee's mother's mobile phone number did not constitute the employee's information and that she had no reasonable expectation of privacy in it. The facts of this case could be distinguished from a case involving a cyber attack by hackers because the employer here had actively disclosed the information to a third party. The High Court went on to hold that the County Court had erred when it rejected the data protection claims. The oral disclosure of information can constitute processing for data protection purposes. The phone number in question was recorded in the employee's personnel file before it was accessed, extracted and then orally disclosed by the employer staff. This meant it fell squarely within the definition of processing in the UK GDPR. Finally, the High Court upheld the award of £4,500 in damages that had been awarded to the employee. The High Court's decision confirms that, where personal data is stored in a structured filing system and then is orally disclosed by the employer's staff, this will amount to processing for data protection purposes. This means the data protection principles must be complied with in such circumstances, and steps should be taken to preserve the security of the personal data. Look out for further episodes in this series to stay up to date on all things HR and employment law related.