High Court clarifies law around oral disclosures of personal data

In an article on his personal blog, data protection specialist Jon Baines considers the recent High Court judgment in Raine v JD Wetherspoon PLC, which clarified the scope of misuse of private information and data protection law, particularly concerning pretexting and the oral disclosure of personal data. The case involved a former pub employee whose estranged, abusive partner deceptively obtained her mother's mobile number from the pub, leading to further harassment. Despite the company's guidance on such matters, the information, stored in a "Strictly Private and Confidential" paper file, was disclosed.

The High Court dismissed Wetherspoon's appeal against findings of misuse of private information and breach of confidence. Mr Justice Bright ruled that the mother's mobile number constituted the Claimant's private information, in which she had a reasonable expectation of privacy. In doing so, the judge rejected the argument that a data security duty could not arise under misuse of private information, highlighting that this was a positive act of misuse resulting in the direct disclosure of information.

Importantly, the Claimant's cross-challenge regarding the dismissal of her data protection claim also succeeded. The High Court overturned the initial ruling that purely oral disclosure did not constitute "processing" of "personal data" under UK General Data Protection Regulation (GDPR). The judge found that because the information was recorded in a personnel file, accessed, extracted, and then communicated, it fell "squarely within the definition of 'processing' in the GDPR at article 4(2)." The judgment reinforces that oral disclosure, when derived from a filing system, can indeed constitute processing under GDPR, aligning with a European Court. Damages of £4,500 for exacerbation of psychological damage were upheld.