Disputes between employees and employers (or former employees and employers) as to data protection rights are increasingly common, and to date there has been little reported legal authority on how the courts will resolve the tension between data protection rights and employment law.

This week, a sheriff's court in Scotland has considered article 5(1)(a) of the UK GDPR (lawfulness, fairness and transparency) and article 5(1)(b) (purpose limitation) in conjunction with the legal proceedings exemption in paragraph 5(3) of Schedule 2 to the Data Protection Act 2018 (DPA 2018). 

 

An employee (the complainant) claimed that his former employer had breached these principles while processing his personal data in defending employment tribunal proceedings brought by a colleague. The tribunal's decision referred to the complainant 162 times and was reported in an online newspaper article. He contended there had been a breach of fairness and transparency and that his employer should have informed him of the proceedings, provided him with copies of the tribunal bundles, asked him to comment on the allegations made against him and invited him to provide a witness statement. He sued for £75,000 for distress and anxiety, and the impact on his employment prospects. 

 

The employer relied on the legal proceedings exemption. The core issue was the meaning of the words in paragraph 5(3)(c) "to the extent that the application of those provisions would prevent the controller from making the disclosure" and whether they qualified the exemption. The complainant argued that the employer must attempt to comply before relying on the exemption with the employer arguing there was no such requirement. 

 

The court considered that a data controller's duties should not fetter its discretion to conduct litigation as it saw fit or impinge on its right to a fair trial. Requiring the employer to have invited the complainant to comment and taken a witness statement would undercut its discretion as a litigant and would impose duties upon it that the rules of that litigation did not require. The tension between data protection requirements and the demands of litigation was precisely what the exemption was intended to address.

 

Therefore, it was held that where the application of a listed GDPR provision would result in a change to the content of the disclosure as required by the litigation, it ought not to be applied and the effect of the legal proceedings exemption was to exempt the employer from having to comply with those provisions. A court or tribunal could anonymise a judgment if considered necessary to protect an individual's privacy.

 

Although this is a Scottish decision, the exemption applies throughout the UK and this decision appears to be the first to consider the exemption under the DPA 2018 and suggests a wide application of the exemption,  not just within the context of the facts of this case (Riley v Student Housing Co (Ops Ltd) but perhaps also where a claimant (typically a former employee) to litigation seeks to use the DPA 2018 in order to expand upon the respondent's (employer) duties of disclosure in those proceedings?