Oral disclosure doesn’t constitute the processing of personal data

The High Court has ruled that where a charity providing counselling services made an oral disclosure to a doctor regarding the wellbeing and mental health of one of its patients, that disclosure was not unlawful under the Data Protection Act 1998.

The claimant alleged that the LBGT Foundation had disclosed to his doctor the fact that they had assessed him as being at significant risk of suicide or other substantial self-harm, and that at the time they were unable to provide the claimant with the services he sought from the Foundation because of the claimant’s ongoing drug use.

The Foundation’s legal team argued that the claim under the DPA should be struck out because the DPA does not apply to purely verbal communications such as the disclosure. The High Court accepted the submission as “well-founded” with the DPA imposing rights and duties as regards the “processing” by a “data controller” of “personal data”. It therefore follows that a claim under the DPA can only arise where there has been processing of “personal data”.

It was clear from the evidence that there had been no processing of “data” under section 1 of the DPA and the information had not been recorded, in either electronic or manual form, for it to constitute data for the purposes of the Act.

The High Court struck the claim out confirming that verbal disclosure did not constitute the processing of personal data, and therefore could not give rise to a claim under the DPA. But even if the DPA applied to the disclosure, the disclosure was itself lawful under the DPA – it satisfied condition four within Schedule 2 to the DPA which provides that the “…processing is necessary in order to protect the vital interests of the data subject”. It was accepted that the data was sensitive personal data as it was information as to the claimant’s physical or mental health and/or sexual life.

As to the claimant’s case that there had been a breach of confidence, this aspect of the claim also failed. According to the High Court the duty of confidence, which was undoubtedly owed to the claimant had a qualifier to confidentiality, or “carve out”, which permitted the very limited disclosure to his GP. The referral forms provided to the claimant made it clear that the LGBT Foundation would disclose confidential information to an individual’s GP if it had serious concerns about that individual’s well-being. The claimant completed the form and provided his GP’s details.

And finally, as to claimant’s contention that the Foundation had breached his human rights, the High Court said he had no claim under the Human Rights Act. The LBGT Foundation is not a public authority for HRA purposes – the fact that the body provides services for public benefit does not establish that it has functions of a public nature. Of importance is that LGBT Foundation has “…no statutory powers, duties or functions (not even matters being delegated to it by true public authorities), and is not in any way "governmental". It is simply a charity which, like many such bodies, attracts public funding in addition to funds from other sources. The fact that it helps members of the public on health issues takes matters no further.”

Whilst this final point will not assist NHS organisations (which will be regarded as public bodies), it is something that other publically funded bodies may take solace from, depending on their circumstances.

Do get in touch with Stuart Knowles, Jill Weston or Claire Williams if you have a tricky DPA matter – we have supported on a number of clients on data protection cases.