M, R (on the application of) v The Chief Constable of Sussex Police & Anor

The law in this field is complex, and the statute labyrinthine, so I will have to set out large parts below. Part 3 of the Data Protection Act 2018 (‘the 2018 Act’) sets out the relevant provisions for the handling of data.

The Defendant is a ‘competent authority’ for the purposes of Part 3 of the Act: see section 30(1)(a) and paragraph 5 of Schedule 7 to the 2018 Act. (Footnote: ¹) It is a data controller within the meaning of section 32 (1) and (2) of the Act. Section 32(3) provides that a data processor under Part 3 is “any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller)”.

Sections 34-40 set out the six data protection principles which correspond to those under Article 4(1) Law Enforcement Directive (LED). In relation to the first data protection principle, section 35 provides materially as follows:

Schedule 8 provides materially as follows:

Section 40 sets out the sixth data protection principle as follows:

The requirement to have appropriate technical and organisational measures was previously known as the Seventh Data Protection Principle (para 7 of Schedule 2 of the Data Protection Act 1998). In CLG & Ors v Chief Constable of Merseyside Police[2015] EWCA Civ 836, the Court of Appeal (Moore-Bick LJ, Fulford and Vos LJ concurring) held that the principle:

“46 ….relates to the implementation of appropriate systems for ensuring the protection of personal data. …. The language in which the seventh data protection principle is cast ("appropriate . . . measures shall be taken against . . . unauthorised or unlawful processing") is not apt to impose an absolute duty to prevent the misuse of data. It imposes no more than a duty to put in place a system of measures to safeguard data that are appropriate having regard to the operations of the data controller and the nature of the data for which he is responsible. What is appropriate will vary from case to case.

In Various Claimants v WM Morrisons Supermarket Plc [2017] EWHC 3113 (QB The claimants brought a private law action against their employer alleging, among other things, breach of the Seventh Data Protection Principle (namely the requirement to take “appropriate technical and organisational measures … against unauthorised or unlawful processing of personal data”. Langstaff J analysed that requirement as follows:

“67.

The seventh principle does not impose a duty to take "reasonable care" as such. Those words do not appear in the Statute. This might suggest that the draftsman was aiming at a rather different target when he required that "appropriate" measures be taken. This word comes from the Directive: it is likely therefore to bear an autonomous meaning, which will apply in each Member State of the EU to whom it is addressed. However, it is clear that the principle is a qualified one. The mere fact of disclosure or loss of data is not sufficient for there to be a breach. Rather, "appropriate" sets a minimum standard as to the security which is to be achieved. This is expressly subject to both the state of technological development and the cost of measures. Thus, the fact that a degree of security may technologically be achievable, which has not been implemented, does not of itself amount to failure to reach an appropriate standard: an example might be if particular security measures might be introduced which are very costly at the present stage of development, whereas after a few more years the cost might reduce significantly, as is the case with many new technologies. However, the following words in DPP7 indicate that a balance has to be struck between the significance of the cost of preventative measures and the significance of the harm that might arise if they are not taken. This is itself intended to be a combination of the nature of the harm in itself and the importance of the data to be safeguarded from that harm.

68.

Though, as I have pointed out, the words "reasonable care" are not employed, there is a resonance here of the common law approach to the tort of negligence, where the standard of reasonable care is to be judged by balancing the magnitude of the risk of the activity in question (itself a combination of the likelihood of injury and the severity of it should it occur) against the availability and cost of measures to prevent the risk materialising, and the importance of the object to be achieved by performing those actions. That approach is accordingly indicative of the standard which should apply here, whilst remaining mindful that it is being applied in the field of data protection and it is, in general terms, of considerable importance that data be kept secure.

On appeal, the Court of Appeal (Etherton MR, Bean and Flaux LJ) added a further observation concerning the requirement to take “appropriate” measures:

Section 42 sets out the further safeguards required in respect of the processing of sensitive data

Chapter 4 of Part 3 of the Act sets out the general obligations of controllers and processors, including:

Section 59 provides materially as follows:

Section 66 of the Act reads as follows:

In relation to the interpretation of the 2018 Act, Part 3 seeks to implement the UK’s obligations under the Law Enforcement Directive (the LED). There is a somewhat complex issue, raised very fairly by Mr Metcalfe, as to the interaction between the LED and the 2018 Act, and whether the UK relied upon an “opt-out”, see El-Gizouliv Secretary of State for the Home Department [2019] EWHC 60 (Admin) [178]. However, quite apart from the fact that the relevant Secretary of State is not a party to this action, I do not think it is either necessary or appropriate for me to try to decide the relationship between the LED and the 2018 Act. As I explain in the next paragraph, the terms of the LED appear to me to have a limited relevance in this case.

The only relevance of the LED is as an aid to interpretation of the provisions of Part 3 of the 2018 Act, it is not suggested to me that there is any mistransposition of the provisions of the LED and it is therefore not necessary to set out the detail of its provisions. In interpreting the provisions of the DPA 2018 Mr Metcalfe places considerable on recital 50, which states;

“The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller’s behalf should be established. In particular, the controller should be obliged to implement appropriate and effective measures and should be able to demonstrate that processing activities are in compliance with this Directive. Such measures should take into account the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons. The measures taken by the controller should include drawing up and implementing specific safeguards in respect of the treatment of personal data of vulnerable natural persons, such as children.”

It is in my view appropriate to take into account this recital in interpreting the provisions in the DPA 2018, but to the degree Mr Metcalfe is arguing that there is a legal requirement to have “specific safeguards” in respect of the data of children because of the terms of recital 50, I bear closely in mind that this is a recital, and there is no such requirement in those terms in the articles of the Directive.

Mr Metcalfe also relied on the UN Convention on the Rights of the Child (UNCRC), as an aid to construction of the Data Protection Acts, and the scope of the UK’s obligations in terms of respecting children.

Mr Gold relies on the terms of the Crime and Disorder Act 1998 to establish the legitimate purpose of the ISAs and the data sharing. The Defendant is an authority responsible for crime and disorder strategies in Sussex under section 5(1)(b) of the Crime and Disorder Act 1998. Accordingly, it is obliged by section 6(1)(a) of that Act to “formulate and implement a strategy for the reduction of crime and disorder in the area (including anti-social and other behaviour adversely affecting the local environment)”.

Mr Metcalfe referred me to s.49 of the Children and Young Persons Act 1933, which he says was breached by the sharing of bail conditions. That states;

A similar provision exists in s.45(1) of the Youth Justice and Criminal Evidence Act 1999. Mr Metcalfe argued that the sharing of M’s bail conditions with the BCRP was a breach of section 49 of the 1933 Act and of s.45 of the 1999 Act. Mr Gold argued that the employees with whom the bail conditions were shared were not “members of the public” and the bail conditions were not part of proceedings covered by the Act.

I was somewhat concerned about the scope of these submissions, and the potentially wide consequences for other cases as to who was or was not a member of the public for the purposes of s.45. I therefore asked counsel at the end of the hearing to do further research on the meaning of “members of the public”. I am very grateful to both of them for the further written submissions and authorities with which they provided me.

There are a number of cases which deal with the meaning of the “the public” or “members of the public”. They are all considering the meaning in their specific statutory context, and have to be read with that in mind. However, probably the most relevant case is Dockers Labour Club v Race relations Board [1976] AC 285, where despite the very large number of club associates (approximately one million) the House of Lords held that the club did not provide services to a section of the public because each associate had been subject to a separate procedure which therefore differentiated them from a member of the public.

Mr Metcalfe quite rightly pointed me to the strong public policy lying behind s.49, and the importance of assisting children and young persons’ rehabilitation if they have offended, see McKerry v Teesdale and Wear Justices [2000] EWCA Crim 3553.

In my view the sharing of the bail conditions with BCRP and relevant employees, was not sharing with the public and was not “likely to lead members of the public to identify [her]” within the meaning in the CYPA. Those who received the information did so in their capacity either as BCRP members, or their employees or contractors, and did so on terms that were directly linked to those contracts. They were therefore not receiving the information on the bail conditions as members of the public, and they were not entitled to further disseminate the information to members of the public. Therefore there was no breach of the CYPA or the 1999 Act.

The Claimant advances two separate issues. Firstly, that the Defendant’s Information Sharing Agreements (both November 2017 and December 2018) fail to provide sufficient safeguards to prevent the unlawful processing of the Claimant’s sensitive personal data, and as such breach the 2018 Act. Secondly that there has been an unlawful and disproportionate disclosure of the Claimant’s sensitive personal data.

As I have explained above, in relation to the first issue the focus is now on the ISA 2018, and whether it complies with the DPA 2018. The Claimant’s argument is that the Defendant’s arrangements for sharing data failed to have appropriate technical and organisational measures to prevent unlawful sharing of sensitive personal data of the claimant and/or allows the unlawful processing of the same data.

The Claimant’s argument proceeds in the following states. Firstly, the Defendant is the controller of the Claimant’s personal data under s.32, and to the degree it shares M’s data with BCRP, then BCRP is processing the data on the Defendant’s behalf within the meaning of s.32(3).

Secondly, the Defendant therefore must be able to demonstrate compliance with the Data Protection Principles, see s.34(2).

Thirdly, the Defendant is required to implement the “appropriate technical and organisational measures” required under Part 3, including the requirement to demonstrate compliance (s.56); to implement the principles in an effective manner, and to integrate the safeguards necessary (s.57(1)); and to ensure that personal data is not made accessible to an indefinite number of people without an individual’s intervention (s.57(5)).

It is Mr Metcalfe’s submission that the 2018 ISA fails to afford specific safeguards, in particular to children and young people. He refers to the fact that the only reference in the ISA 2018 itself to children, is the reference to article 6(f) of the GDPR. He then argues that there is nothing to prevent the authorised person within BCRP from sharing the data with their fellow employees, and the discretion is left entirely, or largely, to the authorised person. He also argues that the Legitimate Interest Assessment is entirely about the GDPR and the decision whether or not to exclude, and it does not deal with children or young people who have already been excluded and/or entered the criminal justice system.

Mr Metcalfe also argues that the 2018 ISA breaches article 8 ECHR because there is an interference with the Claimant’s right to privacy under article 8(1) for which the lack of safeguards and disproportionate impact mean that there is no justification under article 8(2). He also argues that there if there is a breach of the 2018 Act, then the interference is necessarily not in accordance with law and therefore again does not meet the requirements of article 8.

He further argues that there is a breach of EU law because there is a breach of article 8 of the EU Charter of Fundamental Rights (article 8 covers data protections). I cannot see that the Charter adds anything material to this case, which are not in any event covered by the statutory requirements and/or the broad scope of article 8 ECHR. Mr Metcalfe did not point me to any specific provisions of either the Charter or caselaw concerning it, which would lead to an analytically different argument. I therefore am not going to consider it further.

In my view the key question under Issue One is whether the ISA 2018 complies with the requirements of the 2018 Act. The balances that need to be made under the 2018 Act are themselves compatible with article 8(2) ECHR (and it is not suggested otherwise), so I cannot see that article 8 ECHR adds much if anything to the exercise,

Mr Metcalfe also relies on the UN Convention on the Rights of the Child. The rights and interests of children, and M in particular, need to be given great weight in the balance that is struck. However, there are no specific provisions of the UNCRC which add to that general consideration on the facts of this case. Therefore, as with article 8, although I have had regard to the UNCRC I do not think that it adds anything to the overall balance.

It is clear that the burden of showing compliance with the 2018 Act falls on the Defendant, under s.34(2). Mr Gold argued that the approach of the Court should be that in Gillick v West Norfolk Health Authority [1986] 2 AC 112 and Munjaz vMerseyside NHS trust [2006] 2 AC 148, namely that the agreement is only unlawful where it would give rise to a serious risk of breach of the DPA 2018. However, it does not seem to me that that is the correct approach.

There is a requirement on the data controller to show compliance with the data principles, under s.43(3). Therefore there is a legal requirement on the controller to have in place a system with appropriate safeguards that meets the terms of the 2018 Act. That is not at all the same as a statutory scheme or test where there will only be a breach if there is a serious risk of the statutory duty being breached in any particular case. Of course it does not follow that to satisfy the statutory test there must be no risk of an individual breach ever occurring. But the statute itself incorporates the concept of safeguards, and an element of proportionality will apply when determining whether the safeguards are sufficient to achieve compliance with the 2018 Act. In my view trying to incorporate a Gillick type approach, by which there is only a breach of the Act if there is a serious risk of individual breaches occurring, does not accord with either the structure or the purpose of the Act.

There was a debate before me as to whether the Defendant remained the data controller of the information once it had been shared with the BCRP. Mr Metcalfe argued that BCRP was the data processor, acting on behalf of the Defendant. It seems to me that the much more natural reading of the situation was that the Defendant was initially the data controller, when it passed the data to BCRP, and then either they were joint data controllers, or BCRP became a data controller on its own. I note that the ISA 2018 describes the Defendant and BCRP as joint data controllers, and that appears to me to be correct.

However, I am not sure that this debate really matters. The Defendant is undoubtedly the data controller at the point that it passes the information about the individual to BCRP and as such the duties in s.32(2) apply to the Defendant.

As I have set out above the Defendant therefore has duties to implement the appropriate technical and organisational measures under Part 3 to ensure that the processing of the personal data complies with the requirements of Part 3 (s.56); to implement the data protection principles in an effective manner and the necessary safeguards (s.57(1); and that the measures under s.57(3) must ensure that “personal data is not made accessible to an indefinite number of people…” and finally that the Defendant must ensure a level of security appropriate to the risks arising from the processing of personal data (s.66(1)). Mr Metcalfe argues that these duties have to be interpreted in the light of recital 50 of the Law Enforcement Directive, and in particular that the data controller must implement “specific safeguards in respect of the treatment of personal data of vulnerable natural persons, such as children”.

He also argues, that all those duties have to be interpreted in line with the individual’s article 8 right to privacy firmly in mind, and in particular the need to protect the article 8 rights of children. Ultimately, I have to reach a judgment as to whether the safeguards in place through the ISA 2018 are sufficient to meet the terms of the 2018 Act, and in particular to do so where sensitive personal data is being shared, and the interests of children are in issue.

The following issues arise in deciding whether the safeguards are sufficient to meet the statutory requirements, and to protect M’s rights- (a) the nature of the data that can be shared under the agreement; (b) the provisions as to who it can be shared with and control over any onward sharing; (c) the requirements for the training and vetting of recipients of the data; and (d) the degree to which the specific interests of children are factored into the proportionality exercise. In deciding whether the sharing of information is proportionate I also have to take into account the reason or justification for the sharing. I will go through each of the factors I have identified in turn, and then reach a holistic view as to whether the safeguards are sufficient to meet the terms of the 2018 Act.

The first stage I have identified (a), is the nature of the information shared. Mr Gold says that under ISA 2018 the only information which can be shared is the name, date of birth; photographic image; address and offences against BCRP members. He takes this from Box J of the Legitimate Interest Assessment. This restriction on the data being shared is somewhat unsatisfactory. It is not set out in the ISA itself, nor in Appendix 4 of the ISA, which deals with the policy for processing the data of children. If the intention is, as Mr Gold says it is, no to longer share bail conditions, then it is surprising that this is not made express in appendix 4. The lack of clarity is exacerbated by the fact that Appendix 3, which covers how and what information will be shared and constraints thereon, says that bail conditions will be shared without any reference to the LIA. Mr Gold’s argument is that in respect of children this has to be read subject to the LIA, but this is not at all clear from the documentation.

Mr Metcalfe argued that the safeguards must be set out in one document and therefore reliance on the appendices, let alone the LIA, was not permissible. I do not think this can be correct. Any references to one document, including a contract, must contemplate that such a document may have appendices or other documents incorporated by reference. However, seeking to apply the law in a realistic and effective manner and not an illusory one, if reliance is placed on a series of documents then they must be clearly referred to and accessible at the same time as the principal document. Otherwise any safeguard being relied upon which is set out in those documents will not work. In this case the fact that the limitation on the data is buried in a document to which there is only an opaque reference, and which is actually drafted to deal with a different legal situation (that of the GDPR), does not suggest that that safeguard alone in respect of the type of data to be shared is likely to be very effective, if at all.

However, taking the restrictions in the LIA at face value (i.e. excluding the bail conditions), the only sensitive personal data which can be shared is the photograph. According to the ISA, when images are taken the Defendant informs an individual that their image may be used, disclosed or retained. It is also relevant, though not in any sense determinative, that certainly in the case of M, her photo was already widely disseminated through BCRP’s members’ CCTV footage.

In my view the safeguards in respect of what data is shared are not alone sufficient to meet the requirements of the 2018 Act. However, that does not lead to the conclusion that the ISA 2018 breaches the 2018 Act, because it is necessary to consider all the various safeguards in a holistic manner.

The next stage (b) is with whom the data can be shared. 239 members of BCRP are currently entitled to have data shared with them. All decisions as to what data is shared are made by a senior officer of the Defendant. Once data is shared with members then safeguards are in place as to whom within those members has access to the data. Members have to sign the Data Integrity Agreement and confirm that they have read the relevant documents. The BCRP manager and relevant staff must be vetted to NPV2 level.

Any onward sharing (i.e. to members’ staff) is the joint responsibility of the Defendant and BCRP as joint data controllers. For the Defendant’s decision to share with BCRP to be lawful they have to be satisfied that BCRP has in place sufficient safeguards about onward transmission. In my view there are sufficient safeguards at this stage. The Code of Conduct only allows staff to access to data on a need to know basis. This, I accept is a somewhat crude safeguard because of the very wide element of judgement involved.

However, this leads directly to stage (c) and the training and vetting requirements for those who receive the data. All security staff have to hold licences from the SIA, and thus be DBS (Disclosure and Barring Service) checked. The reality of the data sharing is that the people who are most likely to be using the data, particularly the photo, are security guards employed by BCRP members, and it is therefore of considerable importance that there is a process of licensing and DBS checking them. If there were a case of inappropriate onward transmission of the data, or the individual using it in an inappropriate or unlawful manner, then that would be directly relevant to whether their SIA licence was revoked, or not renewed.

The data itself is placed on a secure intranet, which is encrypted and password protected. Of course I accept that these safeguards are not “water-tight”, but considering them together with the nature of the personal data (including sensitive personal data) that is to be shared, I think they are proportionate. For the data sharing to achieve its purpose, i.e. for BCRP members to be able to use the information to prevent or limit unlawful or anti-social behaviour around their premises, employees have to have relatively easy access to the information. Therefore there must be a balance between the legitimate interest of public protection, and the dissemination of the data.

The next relevant stage (d) is the consideration of the specific interests of children and young persons. There are at least two reasons why particular consideration has to be given to the interests of children in the decision as to whether to share data. As a

Appendix 4 of the ISA is sensitive to the particular needs of children, and the relevant factors in terms of their interests, under a legitimate interest assessment. The balancing exercise set out within Appendix 4 is however focused on the decision as to whether or not to exclude, rather than the decision as to what sharing of data is appropriate once a decision to exclude has been made. In this regard the document could certainly do with more careful redrafting. However, it does set out the relevant factors, and it does albeit opaquely, send the reader to the Legitimate Interest Assessment document.

Mr Metcalfe placed considerable reliance on recital 50 of the LED and the reference to specific safeguards in respect of, inter alia, children. However, that is a recital rather than an article of the Directive and therefore is only an aid to interpretation, rather than a legal requirement. I certainly consider that there has to be a process by which the interests of children and young persons are specifically considered, but I do not think either the Directive or the 2018 Act requires specific separately listed safeguards for children.

Taking these matters together I have reached the conclusion that the ISA 2018, together with the appendices and the LIA, do provide sufficient safeguards and effective measures, including technological measures, to meet the relevant requirements of the DPA 2018. That is not to say that those safeguards could not be improved, particularly by clearer reference to the LIA, and some reframing of that document. However, I do not think those problems are sufficient to make the ISA itself unlawful. In reaching this conclusion I take into account the purposes of the ISA, which are public protection and the prevention of crime, and therefore the need for sharing with a fairly wide group, i.e. employees of BCRP. I also take into account the interests of children and young people, but take the view that so long as the nature of the data shared remains as in the LIA, and the safeguards exist as to onwards transmission, the sharing is proportionate.

The position in relation to the ISA 2017 is now academic in the sense that that Agreement has been superceded. I can therefore be very brief in respect of it. The legal position on compliance with the statutory tests is less clear cut because the safeguards are less clearly set out. Probably the most troubling element is that the bail conditions could be shared under that Agreement, whereas they cannot under the ISA 2018. Although I have found above that this was not a breach of the 1933 CYPA, that does not answer the data protection issue. There seems to have been limited consideration of the potential impact on children of sharing bail conditions with BCRP, and indeed unclear processes by which the specific interests of children were considered. However, the principal safeguards that I have referred to above were in

This Ground does not turn on an assessment of whether the ISA has sufficient safeguards to meet the legal requirements, but rather whether the specific incidents of data sharing between the Defendant and BCRP, in respect of M, were in breach of the DPA 1998 or the DPA 2018 (depending on the date of the specific sharing) and as such unlawful.

For the reasons that I have explained above it is not possible to be wholly confident as to what data has been shared with BCRP and at what date. There are five incidents of assault/affray, the last one of which took place on 7 June 2018 and therefore fell under the 2018 Act, details of which were shared. The Defendant also accepts it shared the

There are therefore four categories of information that were shared; (a) information about the various incidents; (b) the photo and other personal data; (c) information about vulnerability; and (d) the bail conditions.

The Defendant argues that the purpose of the sharing of the information is for the prevention of crime and the protection of vulnerable persons. They further argue that the Claimant could have had no expectation of privacy when she engaged in criminal or anti-social behaviour. I find the latter argument difficult to understand because the requirements under the DPA (both 1998 and 2018) are not removed by the fact an individual was guilty of a criminal offence, or antisocial behaviour.

In reaching a conclusion on issue two I have to consider what safeguards were in place to ensure that the data protection law was complied with, and then I have to consider whether the sharing that took place was lawful. I am concerned on the generic level that, as I have said above under Issue One, there does not appear to have been any clear process under the ISA 2017 by which the particular interests of children were taken into account. This may well explain why the Defendant changed its position on bail conditions, which I will refer to below, and why information on vulnerability seems to have been shared without any (or any evidence of) consideration of the potential impacts on the child.

In respect of the sharing of information about the various incidents I do not think this was unlawful. Firstly, it was not sensitive personal data. Secondly, the incidents were known to BCRP members in any event. Thirdly, the sharing of this information was plainly for a public protection purpose and was justified for that purpose.

I reach a similar conclusion in respect to the sharing of the photo, and other personal information. Although the photo is sensitive personal data, being biometric information, the reality of the situation is that the M’s photo was on the BCRP database in any event. There was a legitimate interest in the security guards employed by BCRP members having access to a clear photograph, and there were safeguards, similar to those in the ISA 2018, in respect of there being any onward transmission of the photograph.

In my view the position is different in respect of the information that was shared relating to M’s vulnerability to sexual exploitation. The Defendant had strongly disputed that it had shared data stating that the Claimant was a person who is sexually vulnerable and/or at risk of sexual exploitation. However, this denial was difficult to accept in the light of two emails which have been disclosed. The first dated 3 October

It is possible that the 29 January email is merely reflecting the fact that it was obvious to the security guard that M was at risk of exploitation, by reason of her conduct at the time. However, putting the two emails together it is plain that the Defendant did give BCRP information about M being vulnerable and at risk of sexual exploitation. It is easy to see why this was of considerable concern particularly to the Local Authority, given that there is a very obvious risk that by sharing this information the police were exposing M to greater risk.

It appears that the two emails (and any other disclosures as to vulnerability) were in breach of the ISA 2017, i.e. they should not been shared under that agreement. It was only at the hearing that the Defendant accepted that such information had been shared. Further, as I have said this information was likely to put the Claimant at greater risk, and any benefit in such sharing might be limited. The Defendant may argue that they were seeking to protect M, but there is no evidence that the Defendant properly weighed up the impact on the Claimant of sharing this information, or whether there were sufficient safeguards to ensure against onward transmission. In particular there is no evidence that the Defendant addressed its mind to the particular importance of not sharing information of this nature about a child.

I therefore find that there was a breach of M’s rights under the DPA 1998 by the sharing of information about her vulnerability and risk of sexual exploitation.

In respect of the sharing of the bail conditions. Having considered the caselaw referred to above, it is my view that the sharing with BCRP did not amount to sharing with “the public”. The sharing is limited to BCRP members, in their capacity as members. All the employees who receive the information are doing so entirely in their employment (or contractual) capacity and subject to safeguards which limit its use to that within that capacity. In other words, they are not receiving it as members of the public, but as employees of BCRP and for the purposes of BCRP.

For these reasons I dismiss Issue One, and I find for the Claimant on only one part of Issue Two, namely the sharing of information that revealed her vulnerability to child sexual exploitation.