Introduction
My articles for this blog are hopefully of interest to the readers but sometimes may also serve, to be honest, as a reminder to myself of a recent case and prompt to carefully read the judgment. Such is the case with the 5 July 2023 judgment in Yao Bekoe v London Borough of Islington [2023] EWHC 1668 (KB).
This was a claim for misuse of private information and later breach of rights under the (pre-Brexit) General Data Protection Regulation (“GDPR”). The latter issue concerned a data subject access request (“DSAR”) sent by Mr Bekoe, and especially delays in providing a response .
The misuse of private information claim arose out of possession proceedings in respect of a property owned by Mr Bekoe’s neighbour (Mrs Sobesto, now deceased). The London Borough of Islington (“the Council”) had previously been appointed deputy for her after Mrs Sobesto had moved into a care home, and had concerns about Mr Bekoe letting out Mrs Sobesto’s property.
Mr Bekoe said that “he had an informal arrangement with Mrs Sobesto and her family whereby he managed and let out flats in the Property on her behalf with the income being intended to help pay for her care”.
Before looking at how the court dealt with the claims, its treatment of the witness evidence, actual or missing, has an importance and relevance beyond the 4 corners of the case.
Witness evidence
Neither of the Council’s witnesses had any personal knowledge of the facts underlying the two claims, and the legal file related to the earlier possession claim had likely been destroyed.
The Judgment of DHCJ Susie Alegre includes a helpful section on evidence and inferences (see my earlier blog on this issue from September 2021):
“19.The general rule concerning the evidence of witnesses is set out at CPR r.32.2.
“32.2—(1) The general rule is that any fact which needs to be proved by the evidence of witnesses is to be proved—(a)at trial, by their oral evidence given in public; and (b)at any other hearing, by their evidence in writing.”
20.The commentary on the rule in White Book 2023, 32.2.1 at pg. 1017 says:
“Traditionally, the law applicable in England and Wales has placed greatest weight on evidence given by witnesses in open court on oath or affirmation under examination by the parties. Rule 32.2(1)(a) restates the general principle in relation to the most important part of the civil process, the trial. The rule applies only to evidence as to matters of fact.”
21. In Active Media Services Inc v Burmester Duncker & Joly GmbH & Co KG [2021] EWHC 232 (Comm) (Calver J), at [299]-[311], the Court summarised the applicable principles regarding a court’s ability to draw adverse inferences from the absence of evidence before the court. In relation to the claimant company’s failure to call relevant witnesses Calver J referred to the observations of Brooke LJ in Wisniewski v Central Manchester Health Authority [1998] P.I.Q.R P324, including that “(1) In certain circumstances a court may be entitled to draw adverse inferences from the absence or silence of a witness who might be expected to have material evidence to give on an issue in an action.”
22. In relation to the destruction of evidence, Calver J referred to the observations of HHJ Simon Brown QC in Earles v Barclays Bank [2009] EWHC 2500, at [31]: “In cases where there is a deliberate void of evidence, such negativity can be used as a weapon in adversarial litigation to fill the evidential gap and so establish a positive case.”
23. In summarising the application of the principles in Active Media Services Inc at [311], Calver J held:
“that the court is entitled in such a case, depending upon the particular facts, to draw adverse inferences as to (i) what the destroyed documents are likely to have shown on the issue on question, and (ii) the evidence that the witnesses are likely to have given on the issue in question but which was withheld, without the need for some other supporting evidence being adduced by the innocent party on that issue.”
24. In Vardy v Rooney [2022] EWHC 2017 (QB); [2023] E.M.L.R. 1, the Court held that it could draw adverse inferences on the basis that the wrongdoer has “parted with relevant evidence”, under the principle in Armorie v Delamirie.”
In Bekoe v Islington the DHCJ found (emphasis added):
“52.There is no dispute that the Defendant accessed the private information sometime in July 2015 and shared it, both within the organisation and with the County Court in the Possession Claim. Mr. Cunliffe repeatedly put forward the argument that the access was based on LBI’s duty to Mrs Sobesto and was an enquiry under Section 42 of the Care Act 2014, but no evidence was adduced by the Defendant to back up these submissions. Nor was any evidence adduced to back up submissions related to contact with the police beyond the reporting in November 2014 which resulted in no action by Islington Police.
53.The Defendant said that the officers involved in the Possession Claim and in earlier engagements with Mr Bekoe in relation to the Property and the Court of Protection proceedings have all left the Council. But in their absence, no evidence was brought to show how an enquiry under Section 42 of the Care Act would normally be carried out; and there was no evidence as to what actually happened on this occasion. Indeed, the only evidence of contact with the police was reference to the report in November 2014 which resulted in Islington Police taking no action. In light of the observations of Brooke LJ in Wisniewski v Central Manchester Health Authority [1998] P.I.Q.R P324, I conclude from the absence of witnesses from the relevant departments who might have material evidence on the process for making an enquiry under Section 42 of the Care Act, that there was no evidence to support this defence.”
Misuse of private information
Returning to the claims, misuse of private information is a tort under common law. Information is private for the purposes of this tort if the person in question has a reasonable expectation of privacy in respect of it. If so, the question is whether that expectation is outweighed by a countervailing interest: ZXC v Bloomberg LP [2022] UKSC 5, [2022] AC 1158, [43]-[62]26.
The private information in issue here included (a) the account number and sort code of several of Mr Bekoe’s bank accounts, and (b) mortgage accounts and mortgage balances providing a snapshot of his general financial affairs at the time of the possession proceedings.
That private information had been provided by the Council to the County Court in the possession proceedings without, Mr Bekoe said, any legal basis.
Although there was a disclosure order in the possession proceedings for some of the same documents, the court found that “the financial information accessed by LBI went far beyond that which would have been necessary to demonstrate payments made or received in relation to the Property”, and that his private information had been accessed by the Council before the August 2015 disclosure order.
Ultimately therefore, the DHCJ determined at para. 56 of the judgment “that the Defendant did misuse private information belonging to Mr Bekoe by accessing details relating to a collection of bank accounts and mortgage accounts associated with Mr Bekoe (and others) in July 2015 without lawful authority”.
GDPR
As for the GDPR claim, there was little real argument that this was made out by reason of the delays, the likelihood of missing information and breaches of security of personal data – articles 5, 12 and 15:
Article 5(1) provides:
“Personal data shall be:(a)
processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
….(f)
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).”
Article 12(3) provides
“The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request.”31.
Article 15(1) provides:
“The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:(a)
the purposes of the processing;(b)
the categories of personal data concerned;
…”
Article 15(3) provides:
“The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.”
Quantum
Mr Beko was awarded £6000 for the misuse of private information and breaches of the GDPR by the Council. This included aggravated damages because of the (para. 69 of the Judgment):
“Repeated failure to disclose key information, disclosure at the final hour, two working days before the trial, and the absence of any clear evidence to support or substantiate Defence submissions relating to alleged fraud have clearly aggravated the distress caused to the Claimant.”
Conclusion
It will be noted that in the misuse of private information case, the DHCJ held at para. 54:
“The argument that Mr Bekoe’s privacy rights under Article 8 ECHR must be balanced against the late Mrs Sobesto’s property rights under Article 1 Protocol 1 ECHR must also fail in the absence of evidence for a clear legal basis for accessing the information.”
