YSL v Surrey and Borders Partnership NHS Foundation Trust

The Claim Form states that YSL’s claim is for:

“Damages (including aggravated damages) for breaches of the Claimant's article 8 human rights, misuse of private information, breaches of the Data Protection Act 1998 and 2018 and breach of the GDPR and UK GDPR.

An Injunction to restrain the Defendant, whether by itself, its officers, servants or agents, or otherwise howsoever, from processing information about or relating to the Claimant.

Such further or other relief as is just and appropriate.”

The main allegations in the PoC and in YSL’s trial witness statement of 19 April 2022 are as follows:

The Defendant defends the claim on the following basis.

It denies that it has acted unlawfully in relation to the processing and retention of YSL’s personal data. Insofar as allegations are made about the actions of Surrey Police or other third parties, these do not concern the Defendant, and the Defendant is not responsible for them.

It is denied that the Defendant acted unlawfully in relation to YSL’s data because, in summary:

In relation to alleged unlawful processing of data under the DPA 2018, the EU GDPR and/or the UK GDPR, YSL is required to prove [38]-[42] of the PoC. These aver:

“38.

The Defendant, whilst the DPA 2018 and the GDPR or the UK GDPR were in force, collected, compiled and stored the Claimant’s personal data and information relating to (or purporting to the relate to) the Claimant. The processing includes those relating to:

(a)

Surrey Police reference […] authored by [PC M];

(b)

Surrey Police reference unknown authored by [PC F].

39.

The obtaining of information (unlawfully and without the Claimant’s knowing) was not an isolated incident but rather a continuous and chronic course of conduct that has gone on for over a decade.

40.

Further or alternatively, the Defendant has breached the Claimant’s right to data protection as set out in Article 8 of the EU Charter of Fundamental Rights (the ‘Charter’), the GDPR, the UK GDPR and DPA 2018:

(a)

the information and data constituted the Claimant’s personal data pursuant to Article 4 (1) of the GDPR and the UK GDPR and section 5 of the DPA 2018 since they were, or they contained or claimed to contain, information relating to the Claimant;

(b)

the compilation, adaptation, dissemination, disclosure, making available and storage of the Claimants data and information constitute the processing of the Personal Data by the Defendant within the meaning of Article 4 (2) of the GDPR and the UK GDPR and section 4 and 5 of the DPA 2018;

(c)

the Defendant was the data controller within the meaning of Article 4 (7) of the GDPR, the UK GDPR and section 5 and 32 (1) (a) of the DPA 2018 in respect of each of these processing operations;

(d)

in obtaining and storing the Claimants personal data and information, the Defendant has failed and continues to fail to process the Personal Data in compliance with the GDPR, the DPA 2018 and the UK GDPR and has failed to give effect to the Claimant's rights under the GDPR, the DPA 2018 and the UK GDPR;

(e)

by processing the Claimant’s personal data as aforesaid, the Defendant acted in breach of its statutory duty pursuant to Article 5 of the GDPR and the UK GDPR and section 34 of the DPA 2018 to process the Claimant’s personal data and information in accordance with the data protection principles set out in the GDPR and the UK GDPR. In particular, in breach of Article 5 (1) (a) of the GDPR and the UK GDPR and section 34 (1) (a) of the DPA 2018, the Defendant’s processing was unlawful and unfair:

(1)

the Claimant did not consent to the sharing of their personal data;

(2)

there was no other lawful basis for processing and obtaining of the Claimant’s personal data pursuant to Article 6 of the GDPR and the UK GDPR or section 35 of the DPA 2018. In particular, the processing did not serve a legitimate interest of the Defendant, or any third party nor was it shared for law enforcement purposes. Further, even if (which is denied) such a legitimate interest or lawful basis existed, it was overridden by the interests and fundamental rights of the Claimant.

(3)

the processing was manifestly unfair and was not transparent. At no stage prior to the processing was the Claimant informed as to what would be taking place in respect of their personal data and information. It will be inferred that this was a deliberate decision taken by the Defendant in order to prevent the Claimant from having the opportunity to object.

41.

The Defendant failing to inform or gain consent from the Claimant as to what would be taking place in respect of their personal data and information, meant the Claimant was unable to exercise their rights as stated in paragraph 36, 36(a), 36(b), 36(c), 36(d), 36(e), 36(f), 36(g), 36(h), 36(i), 37, 37(a), 37(b), 37(c), 37(d) and 37(e). It will be inferred that this was a deliberate course of action taken by the Defendant in order to cause a detriment to the Claimant.

42.

Paragraph 24, 25 26, 26(a), 26(a)(i), 26(a)(ii), 26(a)(iii), 26(a)(iv), 26(b), 26(c), 28, 30 and 30(a) is repeated.

Particulars

(a)

In breach of Article 5 (1) (a) of the GDPR and the UK GDPR and section 34 of the DPA 2018, the Defendant has failed to process the Personal Data lawfully or fairly. The Claimant will rely in particular on the following facts and matters:

[Omitted]”

As above, insofar as allegations are made against or concerning the actions of Surrey Police or other third parties, these do not concern the Defendant and so the Defendant is not responsible for them.

Further, it is denied that the Defendant acted unlawfully in relation to YSL’s data because:

In relation to the alleged misuse of private information, [44] of the PoC appears to concern ‘information provided by the Claimant to Surrey Police’. It avers under the heading ‘Misuse of Private Information’:

“44.

Further or alternatively, the information and data processed by the Defendant is self-evidently private and confidential and/or fall within the scope of the Claimant’s private and family life, home and correspondence under Article 8 of the ECHR; alternatively, the Claimant had a reasonable expectation that the information obtained and data processed by the Defendant were private and would remain so. In further support of this contention, the Claimant will rely upon the following facts and matters:

(a)

any information provided by the Clamant to Surrey Police was obviously provided with Clamant believing that they had a reasonable expectation of privacy and confidentiality;

(b)

further, the information and data purports to convey the Claimant’s deepest and most private thoughts, feelings and information about their life; and

(c)

the Claimant intended the any information about them to be and remain private, and certainly did not expect it to be published and distributed to multiple third parties and stored on the Defendant’s systems, without any warning.”

As above, the Defendant says that is not responsible for the acts or omissions of Surrey Police.

Insofar as it is alleged by [44] to [51] that the Defendant has misused YSL’s, this is denied for the reasons in [12] and [16] of the Defence.

In relation to YSL’s alleged exercise of his data protection rights, he is required to prove [52]-[54] of the PoC. These provide:

“52.

The Claimant wrote to the Defendant on 08 September 2021 to activate and pursue his right to object in line with Article 21 GDPR and UK GDPR.

53.

In breach of Article 12(4) the Defendant failed to respond or action the request without delay and at the latest within one month of receipt of the request.

54.

in breach of Article 12(4) of the GDPR and UK GDPR, when determining not to take action following the Claimant’s requests set out in his email dated 08 September 2021, the Defendant did not inform the Claimant of how their interests outweighed the Claimant’s for not taking action in response to his requests, or of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.”

The Defendant has lawful grounds for the processing and retention of YSL’s data as set out in [12] and [16] of the Defence. The Defendant is unable to erase the Claimant’s data for the reasons in [16(f) and (g)] of the Defence:

“(f)

Processing and retention of the Claimant’s data was and is in accordance with the NHSX Records Management Code of Practice and the Defendant’s Data Protection Policy.

(g)

Processing and retention of the Claimant’s data was and is required in relation to the Defendant’s liability insurance for the investigation and defence of complaints and legal claims.”

The Defendant has confirmed to YSL that it will add a notification to his electronic patient record to reflect his request, and investigate applying the restricted record process, which decision must be made by a clinician. This process is underway (see Defence, [20(c)].

In relation to YSL’s complaint about retention of data for 20 years, the Defendant denies the retention is or was unlawful for the same reasons as earlier.

Paragraphs 59 to 63 of the PoC are denied. These provide:

“59.

20 years is unquestionable an enormous amount of time for the Claimant’s information and data to processed.

60.

The Defendant has not provided a legitimate reason, and which overrides the interests of the Claimant or justifies such a long interference of Claimant’s private life. Reason[s] for the 20-year retention of the Claimant’s data have included:

(a)

that the service is open to the Claimant;

(b)

the NHSX Code of Practice retention of these records will be retained for 20 years after last contact.

61.

Having a retention schedule do[es] not in itself cause it to be necessary to retain data.

62.

The Claimant or a reasonable [person] would have never expected retention for such a long period of time without warning.

63.

Without prejudice, to the fact that the data processed is inaccurate or the accuracy has been challenged. Storing data for two decades will keep the information accurate or give a picture of the persons current life so further breeches the Accuracy Principal of the GDPR and UK GDPR.”

They are denied because:

In relation to remedies, damages for ‘damage to [the Claimant’s] autonomy and integrity’ and ‘[loss of] control over [his] personal data’ are irrecoverable.

The Claimant has, in any event, failed to plead reliance on any expert medical or other evidence in relation his alleged anxiety and distressed. Such issues are not made out.

The Defendant will contend that such loss and damage as the Claimant may prove is attributable to the Defendant’s acts or omissions is de minimis.

Hence, the Defendant denies the Claimant’s claim is denied in its entirety.

YSL filed and served a Reply dated 11 July 2022 but I do not think I need to set out the details.

The Defendant seeks to strike out YSL’s claim as an abuse of the court’s process and/or because of YSL’s conduct, under CPR r. 3.4(2)(b), on the grounds that:

Further, any allegations which might survive the abuse of process application should be:

Developing these grounds further, the Defendant submitted as Ground 1 that the claim is an abuse of process due to the November 2016 compromise. It argues that by entering into that compromise:

The Defendant’s Ground 2 is that, for any matters found not to have been compromised in 2016, they could and should have been brought in 2016 and so to bring them now is an abuse of process.

It is clear from his 17 June 2016 letter and his first formal letter of claim dated 6 September 2016 that he had access to his medical records in order to formulate those allegations. With reasonable diligence he could have brought all the allegations pursued in this claim in 2016 and so bring them now is an abuse of process on the basis of Henderson v Henderson (1843) 3 Hare 100 and Johnson v Gore Wood & Co (No 1) [2002] 2 AC 1. His failure to do so has meant that the Defendant has been repeatedly vexed by various proposed claims.

The Defendant’s Ground 3 is that the claim should be struck out because of YSL’s vexatious conduct. The Defendant relies on the detailed history as set out above as showing that YSL has engaged in a course of vexatious conduct against it, and has repeatedly pursued allegations against Drs SW and DG. He has sought termination of their employment for three years, and summonsed them in this claim despite having no valid basis for doing so. This has amounted to harassment as the Defendant has had to fight or respond to the same or very similar allegations over and over since 2015.

In her witness statement, Ms Golden said that this particular concern is demonstrated by YSL’s recent draft amended Particulars of Claim and his most recent (fifth) letter of claim dated 1 June 2023. She said this demonstrates that YSL has no intention of this claim being the final chapter in his pursuit of the Defendant. She said YSL clearly remains determined to litigate allegations going back many years.

The Defendant’s Ground 4 is that in any event the allegations have no merit. YSL has no realistic prospect of success on any of the allegations in this case, if they survive strike out on the other grounds. This is because:

Nor does YSL have a realistic prospect of obtaining any remedy in this case because:

Finally, the Defendant’s Ground 5 is that any other relevant remaining allegations in the PoC are too vague to succeed and, in particular, YSL has failed to plead a proper case on how his records are inaccurate. He should have pleaded, first, the meaning of the records as to a matter of fact, and then set out why he says the records are factually incorrect. Further, other allegations of unlawful processing are not properly set out.

I turn to YSL’s response to the strike out application.

In his written submissions YSL complained about the lateness of the Defendant’s application. By the day of the hearing YSL had not been served with the exhibits to Ms Golden’s statement in support of the strike out application. I granted an adjournment on the first day of the hearing for that to be done, and for him to read them, which was acceptable to him. I am satisfied he had enough time. In fact, as well as being fully described in Ms Golden’s statement, I noted that in any event some of the exhibits were YSL’s own documents, eg, letters from him (including his letters of claim), or else were documents that he had seen before and had had for some years (eg the letter from Weightmans about the settlement agreement in 2016). None of them were very lengthy. As I have explained, they essentially narrated the contact between YSL and the Defendant over the years, which he is very familiar with.

YSL made some brief oral submissions but largely relied upon his witness statement of 13 June 2023 in response to the strike out application. I have read that witness statement carefully but do not intend to summarise it. I do note, however, his response to the Defendant’s argument about the 2016 settlement:

“19.

The Defendant contends that I compromised any claim for the deletion of my personal information by the Trust when I agreed to a settlement in previous negotiations specifically stelling the “disclosure”. However, this interpretation overlooks significant aspects of the situation and the distinct nature of my current claim.

20.

Firstly, the claim I am bringing now under the GDPR (namely the right to object and the principle of storage limitation) is different in nature and legal basis from the previous matters addressed in the negotiation. My current claim relates specifically to the ongoing storage and processing of my data without my knowledge or consent, a matter that I believe is in breach of my rights under the GDPR.

21.

Moreover, it is essential to clarify that my acceptance of the settlement was based on the information and understanding available to me at the time. The Defendant's assertion that my claim could not be actioned as a matter of law was accepted in the context of those specific negotiations. It does not preclude my right to assert new or unaddressed claims under the changing landscape of data protection law, especially considering the significant changes brought by the GDPR.”

22.

Therefore, the compromise reached during those negotiations should not be seen as a comprehensive settlement of all potential claims related to my data. My current claim under the GDPR is a separate issue that was not and could not have been fully addressed in the previous settlement.”

YSL opened the case primarily by reference to his Skeleton Argument and he wrapped up his summary judgment application within it; as I have said this is largely a repeat of the merits of his claim as he sees them. He then adopted his witness statement of 19 April 2023 as his evidence in chief. There was no substantive cross-examination. That was YSL’s case.

Turning to the Defendant’s case, Mr McCracken called Louis Lau, who is the Defendant’s data protection officer. He adopted his witness statement of 18 April 2023 as his evidence in chief.

He was then cross-examined by YSL.

Mr Lau was asked to elaborate upon the balancing exercise that was undertaken in relation to the obtaining of his data from Surrey Police. He said they were relying on the data protection legislation, and that the Defendant had not sought the information but that it had been sent by the police via MASH. He said therefore they did not need to do any balancing act. He said what was received had been in the nature of referrals to the Defendant (although he stressed he was not a clinician). They were uploaded to the Defendant’s system (called System One) upon receipt. He said they needed to get information in order to ‘reveal an assessment’ (ie, for assessment purposes).

He said that he considered that uploading had complied with the first data protection principle in the GDPR. The data had been stored for the clinicians to process it. The Defendant was providing care. It was transparent because at the time there was the Defendant’s Privacy Notice which was publicly available. He said that the GDPR did not apply at the time the information was received, it was the DPA 1998 (which only refers to unlawful and fair). He agreed there should be transparency. There would have been leaflets and a notice on the Defendant’s website about data handling.

I have carefully read the necessary written materials, including in particular YSL’s witness statements and his Skeleton Argument. Both sides’ cases are clearly articulated. My failure to mention a particular point in this judgment does not mean that it has been overlooked.

For reasons which will become clear, I think it is relevant to note at the outset by that on his own case, YSL has continuing mental health difficulties. I will not set out the details: they are fully described in the evidence and in YSL’s Skeleton Argument. YSL is receiving ongoing treatment for them. In significant part he blames the Defendant for them. The Defendant denies any responsibility for YSL’s health issues.

As I have said, the Defendant has applied to strike out the Claimant's claim, and/or for summary judgment, pursuant to CPR r 3.4(2)(a) and (b) and/or CPR r 24.2 respectively. These provide:

“3.4

(1)

In this rule and rule 3.5, reference to a statement of case includes reference to part of a statement of case.

(2)

The court may strike out a statement of case if it appears to the court –

(a)

that the statement of case discloses no reasonable grounds for bringing or defending the claim;

(b)

that the statement of case is an abuse of the court's process or is otherwise likely to obstruct the just disposal of the proceedings;

…

24.2

The court may give summary judgment against a claimant or defendant on the whole of a claim or on a particular issue if –

(a)

it considers that –

(i)

that claimant has no real prospect of succeeding on the claim or issue …"

The test to be applied on a summary judgment application is well-known. In EasyAir Limited v. Opal Telecom Limited [2009] EWHC 339 (Ch), [15], Lewison J (as he then was) said:

“1.

The court must consider whether the [respondent to the summary judgment application] has a 'realistic' as opposed to a 'fanciful' prospect of success.

2.

A 'realistic' [statement of case] is one that carries some degree of conviction. This means a [case] that is more than merely arguable.

3.

In reaching its conclusion the court must not conduct a 'mini-trial'.

4.

This does not mean that the court must take at face value and without analysis everything that [the respondent] says. In some cases it may be clear that there is no real substance in factual assertions made, particularly if contradicted by contemporaneous documents.

5.

However, in reaching its conclusion the court must take into account not only the evidence actually placed before it on the application for summary judgment, but also the evidence that can reasonably be expected to be available at trial.

6.

Although a case may turn out at trial not to be really complicated, it does not follow that it should be decided without a fuller investigation into the facts at trial than is possible or permissible on an application for summary judgment. Thus the court should hesitate about making a final decision without a trial, even where there is no obvious conflict of fact, where reasonable grounds exist for believing that a fuller investigation into the facts of the case would add to or alter the evidence available to a trial judge and so affect the outcome of the case.

7.

On the other hand it is not uncommon for an application under Part 24 to give rise to a short point of law or construction and, if the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and that the parties have had an adequate opportunity to address it in argument, it should grasp the nettle and decide it. The reason is quite simple: if the respondent's case is bad in law, he will in truth have no real prospect of succeeding on his claim or successfully defending the claim against him, as the case may be. Similarly, if the applicant's case is bad in law, the sooner that is determined, the better. If it is possible to show by evidence that although material in the form of documents or oral evidence that would put the documents in another light is not currently before the court, such material is likely to exist and can be expected to be available at trial, it would be wrong to give summary judgment because there would be a real, as opposed to a fanciful, prospect of success. However, it is not enough simply to argue that the case should be allowed to go to trial because something may turn up which would have a bearing on the question of construction.”

For examples of recent cases where these principles have been applied, see eg, ArcelorMittal North America Holdings LLC v Ravi Ruia et al [2022] EWHC 1378, [26]-[28]; JJH Holdings Ltd v Microsoft [2022] EWHC 929 (Comm), [11]; and WWRT Limited v Zhevago [2024] EWHC 122 (Comm), [59].

There is an overlap between the test for real prospect of success under CPR r 24.2 and CPR r 3.4(2)(i)(a) and (b): see White Book 2023 at 3.4.21, where it is noted that the Court of Appeal has taken the view that if the particulars of claim disclose no reasonable grounds for bringing the claim, then they also show no real prospect of success.

I begin with the question of whether and/or to what extent the present claim is an abuse of process by reason of the settlement reached between the parties in 2016. If the claim or any part of it is so covered then it will be abuse of process.

It is trite law which needs little authority that a party cannot sue on a cause of action which he has effectively compromised (or which has been the subject of a prior judgment by a court of competent jurisdiction). I will, however, quote passages from Lord Bingham’s speech in Johnson, a case relied on by the Defendants.

In that case the plaintiff, Mr Johnson, a businessman, conducted his affairs through a number of companies, including WWH Ltd, in which he owned all but two of the shares. WWH Ltd sued its former solicitors (Gore Wood (GW)) for professional negligence in connection with a transaction, the litigation eventually being settled. Mr Johnson then sued GW in his own name, on essentially the factual basis for the same alleged negligence as in the first claim, but for different losses. GW sought to strike out the action as an abuse of process, and the case ended up in the House of Lords. Lord Bingham said at pp22-23:

“GW contends that Mr Johnson has abused the process of the court by bringing an action against it in his own name and for his own benefit when such an action could and should have been brought, if at all, as part of or at the same time as the action brought against the firm by WWH. The allegations of negligence and breach of duty made against the firm by WWH in that action were, it is argued, essentially those upon which Mr Johnson now relies. The oral and documentary evidence relating to each 23action is substantially the same. To litigate these matters in separate actions on different occasions is, GW contends, to duplicate the cost and use of court time involved, to prolong the time before the matter is finally resolved, to subject GW to avoidable harassment and to mount a collateral attack on the outcome of the earlier action, settled by GW on the basis that liability was not admitted.

This form of abuse of process has in recent years been taken to be that described by Sir James Wigram V-C in Henderson v Henderson3Hare100, 114–115:

‘In trying this question, I believe I state the rule of the court correctly, when I say, that where a given matter becomes the subject of litigation in, and of adjudication by, a court of competent jurisdiction, the court requires the parties to that litigation to bring forward their whole case, and will not (except under special circumstances) permit the same parties to open the same subject of litigation in respect of matter which might have been brought forward as part of the subject in contest, but which was not brought forward, only because they have, from negligence, inadvertence, or even accident, omitted part of their case. The plea of res judicata applies, except in special cases, not only to points upon which the court was actually required by the parties to form an opinion and pronounce a judgment, but to every point which properly belonged to the subject of litigation, and which the parties, exercising reasonable diligence, might have brought forward at the time.’

Thus the abuse in question need not involve the reopening of a matter already decided in proceedings between the same parties, as where a party is estopped in law from seeking to relitigate a cause of action or an issue already decided in earlier proceedings, but, as Somervell LJ put it in Greenhalgh v Mallard[1947] 2All ER255, 257, may cover:

‘issues or facts which are so clearly part of the subject-matter of the litigation and so clearly could have been raised that it would be an abuse of the process of the court to allow a new proceeding to be started in respect of them.’”

The passage from Henderson quoted by Lord Bingham has become known as ‘the rule in Henderson v Henderson.’ Lord Bingham said at p32:

“The second subsidiary argument was that the rule in Henderson v Henderson3Hare100did not apply to Mr Johnson since the first action against GW had culminated in a compromise and not a judgment. This argument also was rightly rejected. An important purpose of the rule is to protect a defendant against the harassment necessarily involved in repeated actions concerning the same subject matter. A second action is not the less harassing because the defendant has been driven or thought it prudent to settle the first; often, indeed, that outcome would make a second action the more harassing.”

I quoted the settlement agreement earlier and will come back to it in a moment. The approach to its interpretation is as follows. In Bank of Credit and Commercial International SA v Ali [2002] 1 AC 251, [8], Lord Bingham said:

“In construing this provision, as any other contractual provision, the object of the court is to give effect to what the contracting parties intended. To ascertain the intention of the parties the court reads the terms of the contract as a whole, giving the words used their natural and ordinary meaning in the context of the agreement, the parties’ relationship and all the relevant facts surrounding the transaction so far as known to the parties. To ascertain the parties’ intentions the court does not of course inquire into the parties’ subjective states of mind but makes an objective judgment based on the materials already identified.”

I consider the following matters to be clear, and I so find, from the correspondence leading up to the settlement agreement as referred to in Ms Golden’s witness statement:

The key point arising from the settlement, it seems to me, is that YSL was compromising all claims that he may have arising out of the disclosure of his personal information by staff working in the Defendant’s CAMHS, including by Drs SE and DG whilst he was under their care. The reference to ‘staff’ meant disclosure by ‘any staff’, and not just disclosure by Drs SW and DG – hence the use of the word ‘including’.

I therefore find the parts of the current claim which relate to the alleged illegality of such disclosures are an abuse of process. YSL gave up his right to sue on them in return for a payment of £6,000. The relevant paragraphs of the PoC in which the abusive disclosure claim is pleaded are: [7] (‘The Defendant has shared information and data about and from the Claimant to third parties …); [11], in respect of dissemination; and [12]-[18]. The following paragraphs of YSL’s trial witness statement are linked to this abusive disclosure claim, and so the disclosure complaints within them are also struck out as an abuse of process: [6]-[16]; [18];

For the avoidance of doubt, in my judgment the agreement also covers the subject matter of YSL’s fifth letter of claim of 1 June 2023, in which he wrote:

“My entitlement to remedies stems from your violation of the aforementioned statutes and rights. Specifically, I recently became aware of a letter ‘dispatched’ by [Dr DG] on 8th June 2012 and ‘typed’ on 4th July 2012, sent to my General Practitioner, my mother, and my school. This letter, outlining personal, sensitive information about my mental and emotional health, academic progress, and family relationships, was shared without my consent or knowledge. These actions were taken within England and Wales, making it the most appropriate forum for this dispute. I am self-funding this litigation.”

Because of the lack of specificity in the PoC, I am not entirely clear whether this letter is one of the ones referenced in [12], [16] and [17] of the PoC, in which YSL complained about:

“12.

… letters by [Dr SW] and [Dr DG], which were sent to several parties including the Claimants GP, Family and/or school. This was done without the Claimants knowledge or consent. Pending full disclosure, the precise extent of publication and republication of the letters is unknown.

…

16.

[Dr SW] and [Dr DG] not only processed, collected and shared personal information and data, they failed to ensure the accuracy of said information and data and included several degrading and crass comments of their own.

17.

[Dr SW] and [Dr DG]’s letters were also used by the Claimants School to degrade and discredit abuse perpetrated by the School on the Claimant.

18.

[Dr SW] also made repeated reference the claimant being autistic, a claim which she [shared] and distributed to multiple parties, but never directly to the Claimant. [Dr SW]’s unlawful and unethical conduct has led to not only continues distress, but also negatively affected the Claimants family relationships, quality of education and development.”

Leaving aside how it is that YSL says he only became aware of the 8 June 2012 letter around 2023, when (as I have noted) he has made SARs many years previously and has long since obtained his records, any claim which YSL might try to make arising out of this letter from Dr DG in 2012 falls squarely within the terms of the 2016 compromise and would be an abuse of process.

However, it is plain from the wording that the agreement only applied to claims or potential claims arising out of the disclosure of YSL’s data by CAMHS staff – as opposed to other forms of data processing by the Trust, for example, the retention of YSL’s records or its processing of Surrey Police’s risk assessments.

I therefore reject the Defendant’s submission that the compromise can be read as including claims of illegality relating to these other forms of data processing. Whilst these had been raised by YSL in correspondence, they did not fall within the terms of what eventually was agreed between him and the Defendant.

The Defendant submitted in its Closing Submissions on this aspect of the case at [6]:

“6.

The Trust therefore submits that:

(i)

The parties intended to compromise ‘all claims’ in relation to disclosure to third parties by CAMHS staff, which included all claims YSL had already raised in correspondence and all other such claims he may have had at that time which included claims he may reasonably have had in his contemplation by that point in time. That includes claims he could have discovered or made with reasonable inquiries such as SARs and/or requesting his GP, school, local authority records etc.

(ii)

There was an implicit compromise of the inaccuracy allegations.

(iii)

There was an implicit compromise of the claim for erasure of his records. YSL accepted a financial settlement with no agreement on erasure.”

For the reasons I have given, I agree with (i), but I reject (ii) and (iii).

I turn to the Defendant’s alternative strike-out argument based upon Johnson (Closing Submissions, [7] et seq).

The court applies a broad merits-based approach when considering this species of abuse of process. Lord Bingham set out the test at p31 of Johnson:

“The bringing of a claim or the raising of a defence in later proceedings may, without more, amount to abuse if the court is satisfied (the onus being on the party alleging abuse) that the claim or defence should have been raised in the earlier proceedings if it was to be raised at all. I would not accept that it is necessary, before abuse may be found, to identify any additional element such as a collateral attack on a previous decision or some dishonesty, but where those elements are present the later proceedings will be much more obviously abusive, and there will rarely be a finding of abuse unless the later proceeding involves what the court regards as unjust harassment of a party. It is, however, wrong to hold that because a matter could have been raised in early proceedings it should have been, so as to render the raising of it in later proceedings necessarily abusive. That is to adopt too dogmatic an approach to what should in my opinion be a broad, merits-based judgment which takes account of the public and private interests involved and also takes account of all the facts of the case, focusing attention on the crucial question whether, in all the circumstances, a party is misusing or abusing the process of the court by seeking to raise before it the issue which could have been raised before. As one cannot comprehensively list all possible forms of abuse, so one cannot formulate any hard and fast rule to determine whether, on given facts, abuse is to be found or not. Thus while I would accept that lack of funds would not ordinarily excuse a failure to raise in earlier proceedings an issue which could and should have been raised then, I would not regard it as necessarily irrelevant, particularly if it appears that the lack of funds has been caused by the party against whom it is sought to claim. While the result may often be the same, it is in my view preferable to ask whether in all the circumstances a party’s conduct is an abuse than to ask whether the conduct is an abuse and then, if it is, to ask whether the abuse is excused or justified by special circumstances. Properly applied, and whatever the legitimacy of its descent, the rule has in my view a valuable part to play in protecting the interests of justice.”

This type of abuse applies to settlement agreements as well as judgments, as I explained earlier.

In his Closing Submissions at [9], Mr McCracken helpfully set out in tabular form why and on what basis the Defendant says that the allegations made by YSL in this claim fall to be struck out as barred by the 23 November 2016 compromise (expressly or by implication); on the basis of Johnson style abuse, or for the other reasons given in the third column of the table below (I have added numbers to each row for ease of reference):

Apart from (6) and (15), which relate to the risk assessments prepared by Surrey Police which were shared via the Surrey MASH and received by the Defendant from that source, I agree that all of the other matters fall within the terms of the compromise agreement. I will deal later with YSL’s complaint about the Defendant having uploaded these risk assessments to its system, but in relation to the alleged disclosure of them (ie, (15)), this does not fall within the terms of the settlement agreement because the disclosure did not come about as a result of the Defendant’s interaction with CAMHS.

I reject the Defendant’s argument that the claim should be struck out purely on the basis of what it says is YSL’s vexatious conduct over the years in sending multiple letters before action including one just days after having signed a compromise agreement in November 2016; threatening to commence proceedings (but not doing so); and, latterly, sending the letter of claim in June 2023 and amended draft Particulars of Claim substantially expanding the present claim (albeit, as I have said, without having sought the court’s permission). I readily understand the Defendant’s concern but it seems to me that there are other remedies potentially available to it to restrain litigation by YSL in the form, for example, of civil restraint orders, if it were so advised.

For these reasons, the part of YSL’s claim relating to disclosure by CAMHS is struck out as an abuse of process.

However, in case I am wrong in these conclusions, I will go on to consider the merits of all of the aspects of YSL’s claims against the Defendant, namely the alleged unlawful disclosure; unlawful retention; processing of risk assessment received from Surrey Police; and failure to erase records. It seems to me that the Defendant’s summary judgment application that YSL has no prospects of success, can in the circumstances of this case, be wrapped with a discussion of its overall merits.

I begin with YSL’s claim under the DPA 1998, which was the predecessor legislation to the EU GDPR, the DPA 2018, and the UK GDPR.

YSL pleaded at [11] of his PoC:

“11.

The Defendant, whilst the DPA 1998 was in force, collected, compiled, stored and disseminated the Claimant’s personal data and information relating to (or purporting to the relate to) the Claimant.”

There is no dispute that the data held by the Defendant about YSL was personal data as defined in s 1(1) of the DPA 1998. There is also no dispute that the Defendant was a data controller subject to the provisions of the Act, as defined by s 1(1). Furthermore, the data held by the Defendant about YSL included ‘sensitive personal data’ as defined in s 2, to the extent that it related to his physical or mental health or condition, and/or his sexual life.

By s 4(4), it was the duty of the Defendant as a data controller to comply with the data protection principles in relation to YSL’s data. By s 4(1) and (2), the data protection principles were the principles set out in Part I of Sch 1 to the Act. They had to be interpreted in accordance with Part II of Sch 1.

The data protection principles in Part I of Sch 1 were as follows:

“1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -

(a)

at least one of the conditions in Schedule 2 is met, and

(b)

in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2 Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

3 Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

4 Personal data shall be accurate and, where necessary, kept up to date.

5 Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

6 Personal data shall be processed in accordance with the rights of data subjects under this Act.

7 Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

8 Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.”

The conditions in Sch 2 were:

“1 The data subject has given his consent to the processing.

2 The processing is necessary -

(a)

for the performance of a contract to which the data subject is a party, or

(b)

for the taking of steps at the request of the data subject with a view to entering into a contract.

3 The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

4 The processing is necessary in order to protect the vital interests of the data subject.

5 The processing is necessary -

(a)

for the administration of justice,

(b)

for the exercise of any functions conferred on any person by or under any enactment,

(c)

for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(d)

for the exercise of any other functions of a public nature exercised in the public interest by any person.

6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

(2)

The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.”

The conditions in Sch 3 were:

“1 The data subject has given his explicit consent to the processing of the personal data.

2(1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.

(2)

The Secretary of State may by order -

(a)

exclude the application of sub-paragraph (1) in such cases as may be specified, or

(b)

provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

3 The processing is necessary -

(a)

in order to protect the vital interests of the data subject or another person, in a case where -

(i)

consent cannot be given by or on behalf of the data subject, or

(ii)

the data controller cannot reasonably be expected to obtain the consent of the data subject, or

(b)

in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.

4 The processing –

(a)

is carried out in the course of its legitimate activities by any body or association which -

(i)

is not established or conducted for profit, and

(ii)

exists for political, philosophical, religious or trade-union purposes,

(b)

is carried out with appropriate safeguards for the rights and freedoms of data subjects,

(c)

relates only to individuals who either are members of the body or association or have regular contact with it in connection with its purposes, and

(d)

does not involve disclosure of the personal data to a third party without the consent of the data subject.

5 The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

6 The processing -

(a)

is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b)

is necessary for the purpose of obtaining legal advice, or

(c)

is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

7(1) The processing is necessary -

(a)

for the administration of justice,

(b)

for the exercise of any functions conferred on any person by or under an enactment, or

(c)

for the exercise of any functions of the Crown, a Minister of the Crown or a government department.

(2)

The Secretary of State may by order -

(a)

exclude the application of sub-paragraph (1) in such cases as may be specified, or

(b)

provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

8(1) The processing is necessary for medical purposes and is undertaken by -

(a)

a health professional, or

(b)

a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.

(2)

In this paragraph ‘medical purposes’ includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

9(1) The processing -

(a)

is of sensitive personal data consisting of information as to racial or ethnic origin,

(b)

is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and

(c)

is carried out with appropriate safeguards for the rights and freedoms of data subjects.

(2)

The Secretary of State may by order specify circumstances in which processing falling within sub-paragraph (1)(a) and (b) is, or is not, to be taken for the purposes of sub-paragraph (1)(c) to be carried out with appropriate safeguards for the rights and freedoms of data subjects.

10 The personal data are processed in circumstances specified in an order made by the Secretary of State for the purposes of this paragraph.”

I consider there can be no argument but that the Defendant’s processing of YSL’s sensitive personal data complied with the data protection principles, including in particular [1(a) and (b)] of Sch 1. These required at least one condition in Sch 2 and one condition in Sch 3 to be satisfied. The relevant ones for present purposes were as follows.

In Sch 2:

In Sch 3, the relevant condition was [8] (the processing is necessary for medical purposes and is undertaken by a health professional, or a person under an equivalent duty of confidentiality.)

As I will discuss later, the test of ‘necessity’ in this context means ‘reasonably necessary’, rather than ‘absolutely or strictly necessary.’

The processing of YSL’s sensitive personal data was therefore lawful under the DPA 1998.

I have not overlooked the fact that in the course of correspondence in 2016 which led to the compromise agreement, the letter from the Defendant’s then solicitors dated 17 November 2016 said:

“You will be aware that the clinicians’ accounts of their communications with third parties are set out in the letters from Fiona Edwards [the Defendant’s then CEO] referred to above and we do not propose to recite them at length in this letter.

We adopt the conclusion reached by Fiona Edwards in her correspondence and recognise that there was some disclosure to third parties that was made without your consent.

To that end our client is prepared to make an offer of damages to reflect the nature and extent of that disclosure and we have attached to this letter a Part 36 offer of settlement. We believe that this offer is a reasonable offer that reflects the admitted breaches.

We would refer you to the recent report in the case of P v A local Authority [2016] EWHC 2779 (Fam) where local authority has paid a vulnerable transgender teenager £4,750 in damages after a member of staff breached his privacy by disclosing personal information about him to friends of his estranged adoptive parents.”

I have read the case of P. There was a relatively complex background, however P’s claim was under the Human Rights Act 1998 for a breach of Article 8 arising from the unauthorised disclosure by the local authority of personal information about P, including his forename and transgender status, to third parties who were friends of P's adoptive parents. The local authority admitted liability.

I was not shown and do not have the letters from Ms Edwards. However, I note that there is in the bundle at E132-133 a letter of apology from Dr DG to YSL dated 25 May 2016 which referred to YSL having been upset that a discharge summary had been sent by Dr DG to his school and his mother without his consent.

I do not know exactly what ‘breaches’ were being referred to in the solicitors’ letter, or whether they included the matter referred to by Dr DG. However, I can only go on the materials before me. The Defendant has put forward a defence to YSL’s claim of a breach of the DPA 2018 arising from CAMHS disclosures. Having considered this defence, and for the reasons I have given, if I am wrong on my strike out decision in relation to them, I consider that there was a lawful basis for them under the DPA 2018.

I turn now to the Claimant’s claims under the EU GDPR and the DPA 2018 (which came into force in 2018) and the UK GDPR, which came into force in 2021. As I explained earlier, the UK GDPR is part of retained EU law and was given force in domestic law from 1 January 2021 by s 3 of the European Union (Withdrawal) Act 2018.

Article 5 of the UK GDPR contains the principles relating to processing of personal data. The first principle is that:

“1.

Personal data shall be:

(a)

processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’.)”

Article 6 provides lawful grounds for processing, and provides that processing shall be lawful only if and to the extent that at least one of the conditions in Article 6(1) applies. Sub-paragraphs (d) and (e) provide:

“(d)

processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e)

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

The Defendant primarily relies on (e) as being the basis for the lawful processing of YSL’s medical records for the provision of care to him; ie, it says processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Defendant as part of the NHS. It also relies on YSL’s health as the ‘vital interest’ in sub-paragraph (d).

For reasons I will come to, I reject (d) as a lawful basis for processing data concerning YSL’s health. I do accept, however, that processing of YSL’s data is lawful by virtue of (e). This is the lawful basis identified in [14.1] of the Defendant’s Data Protection and Records Management Policy and in Appendix 4 and has been correctly identified. The Appendix states:

“Legal basis for processing personal information:

This summarises the legal authority that we, under current data protection legislation, process personal data, and the areas they cover.

There are 2 levels of personal information:

• Level 1 data, such as your name, your address, your birth date. (Article 6(1))

• Level 2 data (also called ‘special categories’), such as your health records. (Article 9(2))”

The relevant part of the Table which follows states:

Section 8 of the DPA 2018 is relevant here. It provides that in Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for:

“…

(e)

the exercise of a function conferred on a person by an enactment or rule of law

…”

The provision of health care is obviously such a function. The role, duties and responsibilities of the NHS are governed by many pieces of legislation including, for example, the National Health Service Act 2006.

Article 9 is headed, ‘Processing of special categories of personal data.’ Processing of this sort of data - which includes data concerning health – is prohibited unless a condition in Article 9(2) applies. Sub-paragraphs (h) and (i) provide:

“(h)

processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of [domestic law] or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

(i)

processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;”

In my judgment the processing of YSL’s health data falls within both of these conditions.

Article 9(3) provides:

“Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under domestic law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under domestic law or rules established by national competent bodies.”

This condition is satisfied in relation to those who process YSL’s medical data. Firstly, the common law imposes a duty of confidentiality on medical professionals in respect of patient records: see eg, Hunter v Mann [1974] QB 767; W v Egdell [1990] Ch 359. Second, obligations of confidentiality are also imposed on the Defendant’s employees who may have access to YSL’s data. These arise from their contractual obligations (whether express or implied) and from other sources. The NHS’s Confidentiality Policy (2022) states:

“All employees working in the NHS are bound by a legal duty of confidence to protect personal information they may come into contact with during the course of their work. This is not just a requirement of their contractual responsibilities but also a requirement within the common law duty of confidence and data protection legislation – the European General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018) which implements the GDPR in the UK.

The reason I rejected ‘vital interests’ in Article 6(1)(d) as a lawful basis for processing YSL’s special category data is because of Article 9(2)(c), which is much narrower:

“(c)

processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent”

YSL is plainly capable of giving consent, so this cannot apply. But in any event, as the ICO’s Guidance makes clear (at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/#conditions3):

“Vital interests are intended to cover only interests that are essential for someone’s life. So this condition is very limited in its scope, and generally only applies to matters of life and death.

This condition only applies if the individual is physically or legally incapable of giving consent. This means you should ask for explicit consent if possible. If a data subject refuses consent, you cannot rely on vital interests as a fallback condition, unless they are not legally competent to make that decision.

“This condition is likely to be most relevant where there is an urgent need to use a person’ personal data for medical care, but they are unconscious or otherwise incapable of giving consent.”

The DPA 2018 is also relevant in relation to the processing of medical data. Section 10(1) and (2) provide:

“(1)

Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the [UK GDPR] (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2) -

…

(c)

point (h) (health and social care);

(d)

point (i) (public health);

…

(2)

The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the [UK GDPR] for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.”

The conditions in Part 1 of Sch 1 to the DPA 2018 include in [2]:

“2(1) This condition is met if the processing is necessary for health or social care purposes.

(2)

In this paragraph ‘health or social care purposes’ means the purposes of -

(a)

preventive or occupational medicine,

(b)

the assessment of the working capacity of an employee,

(c)

medical diagnosis,

(d)

the provision of health care or treatment,

(e)

the provision of social care, or

(f)

the management of health care systems or services or social care systems or services.

(3)

See also the conditions and safeguards in Article 9(3) of the [UK GDPR] (obligations of secrecy) and section 11(1).”

Section 11(1) provides:

“(1)

For the purposes of Article 9(2)(h) of the [F1UK GDPR] (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the [F1UK GDPR] (obligation of secrecy) include circumstances in which it is carried out—

(a)

by or under the responsibility of a health professional or a social work professional, or

(b)

by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.”

For the reasons I gave earlier in relation to Article 9(3) of the UK GDPR, this condition is satisfied in relation to YSL’s health data.

Overall, therefore, I consider that the Defendant has and had a lawful basis for processing YSL’s health data under the EU GDPR, the UK GDPR and the DPA 2018.

A distinct part of YSL’s pleaded case relates to risk assessments received from Surrey Police via the MASH (PoC, [21] et seq). There were four of them: three from 2016 and one from 2017. The concerned ‘Adults at Risk’.

I am bound to say that YSL’s pleaded case in relation to these seems to me to be somewhat confused, in that he has pleaded matters relating to their disclosure by the Defendant. But the evidence was that these were disclosed to the Defendant by Surrey Police, and the Defendant then uploaded them to its system for clinical assessment. That was the evidence of Mr Lau. As the Defendant pleaded in its Defence at [11], it is not responsible for the actions of Surrey Police or any other third party. There was no evidence that the risk assessments were somehow procured by the Defendant. An email dated 15 November 2016 sent from Surrey County Council via the MASH which accompanied one of the police risk assessments stated (H/276):

“Please see attached Police Notification regarding the above named client for you to make a decision about your involvement.”

Hence although the risk assessments ended up in the possession of the Defendants, it did not ‘obtain’ them in any meaningful sense, such as by taking some active step. Any liability it has is by way of its storage and retention of these documents, and not from any disclosure by it. In fact, there was no evidence that they have been disclosed by the Defendant to any third party.

I will not set out the detail of the risk assessments, which are contained in the evidence. They included concerns about YSL’s mental health and potential for suicide; an allegation that he may have assaulted his mother (although proceedings were never brought); and other matters.

YSL accepts (trial Skeleton Argument, [14]):

“14.

The completion and submission of an 'Adult at Risk' form indeed serves as an important component of safeguarding procedures, designed to protect individuals who may be vulnerable due to age, illness, or a mental or physical condition, and who are unable to protect themselves against significant harm or exploitation. Such forms are typically used to document and report concerns, not necessarily to instigate health or social care services.”

I have no doubt that the processing of these by the Defendant when they were received from Surrey Police via the MASH in 2016 and 2017 was lawful under the DPA 1998 for the reasons given earlier. They plainly concerned YSL’s health and needed to be uploaded and stored for clinical assessment. That was Mr Lau’s evidence, which I accept. It was not necessary for the Defendant to conduct some sort of balancing exercise before uploading them to its system, nor to notify the Claimant specifically and personally in advance. The right to be informed under data protection legislation (now, pursuant to Article 13 of the UK GDPR) plainly does not mean that every individual has to be specifically informed every time a data controller organisation receives personal data about them, before or at the time it is received.

Finally, in case it is thought I have overlooked it, YSL referred to data relating to criminal convictions in his PoC at [42(b)]. That, I take it, is the reference to one of the risk assessments alleging that YSL had assaulted his mother (see above).

The processing of this data (which was sensitive personal data by virtue of s 2(g) of the DPA 2008) was lawful for the same reasons I gave earlier in relation to YSL’s medical data. The data in question formed part of the narrative about concerns over YSL’s mental health, and was intimately bound up within it, the whole forming part of a risk assessment about YSL who was thought to be vulnerable.

So far as the subsequent data protection regime is concerned, Article 10 of the UK GDPR provides:

“Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

2.

In the 2018 Act -

(a)

section 10 makes provision about when the requirement in paragraph 1 of this Article for authorisation by domestic law is met;

(b)

section 11(2) makes provision about the meaning of ‘personal data relating to criminal convictions and offences or related security measures’.”

Section 10(4) and (5) provide:

“(4)

Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

(5)

The processing meets the requirement in Article 10(1) of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.”

Section 11(2) provides:

“In Article 10 of the UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to -

(a)

the alleged commission of offences by the data subject,

or

(b)

proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.”

There are several conditions in Sch 1 which might apply to the data in question, but the most obvious one is [2] of Part 1 (processing is necessary for health or social care purposes). The processing of the allegation of assault by continued storage post-2018 was therefore lawful, for the same reasons it was lawful under the DPA 1998.

I turn to the YSL’s claim about the retention of his data (PoC, [52] et seq).

YSL exercised his right to object under Article 21(1) of the UK GDPR, which provides:

“(1)

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions.

The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

(2)

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.”

He also requested that his data be erased, pursuant to Article 17(1), which provides:

“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

c the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

d the personal data have been unlawfully processed;

e the personal data have to be erased for compliance with a legal obligation [under domestic law];

f the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).”

Article 17(3) provides important exceptions to the general rights conferred by Articles 17(1) :

“(3)

Paragraphs 1 and 2… shall not apply to the extent that processing is necessary:

a for exercising the right of freedom of expression and information;

b for compliance with a legal obligation which requires processing [under domestic law] or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

c for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

d for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

e for the establishment, exercise or defence of legal claims.”

In my judgment YSL is not entitled, in other words, he has no right, to have his data erased under Article 17(1).

Firstly, that is because his request relates to data the processing of which is necessary in the area of public health in accordance with Articles 9(2)(h) and (i) and so his right to erasure is disapplied by Article 17(3)(c).

In this context, ‘necessary’ means ‘reasonably rather than absolutely or strictly necessary’: South Lanarkshire Council v Scottish Information Commissioner [2013] 1 WLR 2421, [27]. But whether this interpretation of ‘necessary’ is adopted, or some stricter test as in ‘strictly necessary’ (as per Elgizouli v Secretary of State for the Home Department [2020] 2 WLR 857, [6]-12], [155], [158], [168], [219]-[220], [225], [230], which concerned the derogations from the general prohibition on data transfers to a third country in s 73, DPA 2018), the test is satisfied. YSL has long standing and ongoing mental health issues that have led to reports of assaults on others and suicide attempts and it is therefore necessary for the Defendant to retain his medical data. The data is primarily being processed (ie, retained) for his potential benefit.

Second, the Defendant is entitled to rely on Article 17(3)(e). It is necessary for the Defendant to retain the data in question to defend itself from legal claims (and, from its Defence, I infer this is a condition of its liability insurance). Since at least 2016 YSL has been threatening litigation, which culminated in the present case and, per his fifth letter of claim from June 2023, he is threatening further litigation. He has also made regulatory complaints to the ICO about the Defendant’s handling of his data. All of this means that the Defendant is entitled not to erase his data so that it can defend itself in relation to these or any other legal matters (whether or not instituted by YSL).

For the same reasons, the Defendant has established a basis for not ceasing to process YSL’s data pursuant to his objection under Article 21. I find its reasons for continuing to process YSL’s data are compelling and satisfy the requirements of Article 21(1). I reject his contention at PoC, [56(b)], that the processing by way of retention is ‘highly prejudicial’ to him. The contrary is the case, as I said earlier, and as I shall return to.

In refusing to erase or cease to process YSL’s data, the Defendant was again acting entirely in keeping with its published Policy. Paragraph 28 provides:

As I will discuss in the next section, the relevant period in relation to YSL’s records is 20 years from when the records ceased to be operational.

YSL also brings claims under Article 8 and common law privacy/confidentiality (see PoC, [43] et seq). There is no meaningful difference between these different causes of action in this context.

Article 8 provides:

“Right to respect for private and family life

1 Everyone has the right to respect for his private and family life, his home and his correspondence.

2 There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

YSL’s case is that the Defendant has engaged in the ‘covert’ collection of data about him and has continued to store it unlawfully, and will continue to do so for the 20 year retention period under the NHSX Code. He said at [53] of his trial Skeleton Argument:

“53.

Even if the court were to find the retention schedule is a necessity for the retention of data and proportionate the court should give wight to very specific circumstances in this case as per [89] of Johnson J’s judgement in AB v Chief Constable of British Transport Police [2022] EWHC 2749 (KB). Having information about one’s life collected covertly with a running commentary and then to having the most sensitive parts of one’s life distributed to multiple parties without their knowing would be distressing to anyone and its continued retention continues to be extremely distressing to C and left them feeling fearful and violated..”

The Defendant denies that its retention of YSL’s medical data is an ‘interference’ with his Article 8(1) rights. It says that his records are retained on a confidential basis, and were created as an inevitable consequence of the medical treatment he received. It seeks to distinguish what Lord Sumption said in R (Catt) v Commissioner of Police of the Metropolis and another [2015] AC 1065, [6]:

“… the state’s systematic collection and storage in retrievable form even of public information about an individual is an interference with private life”.

The context of that case was as follows (at [1]):

“1.

This appeal is concerned with the systematic collection and retention by police authorities of electronic data about individuals. The issue in both cases is whether the practice of the police governing retention is lawful, as the appellant police commissioner contends, or contrary to article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, as the respondent claimants say. A particular feature of the data in question is that they consist entirely of records made of acts of the individuals in question which took place in public or in the common spaces of a block of flats to which other tenants had access. The information has not been obtained by any intrusive technique such as bugging or DNA sampling. In the first appeal, Mr John Catt objects to the retention on a police database of records of his participation in political demonstrations going back to 2005. In the second appeal, Ms T objects to the retention on a police database of a record of a minor altercation with a neighbour which the latter reported to the police. Each of them accepts that it was lawful for the police to make a record of the events in question as they occurred, but contends that the police interfered with their rights under article 8 of the Convention by thereafter retaining the information on a searchable database. I shall have to say more about the facts of these cases in due course. Both claims failed at first instance. In the Court of Appeal, they were heard together, and both appeals were allowed: [2013] 1WLR3305.”

The Defendant submits that YSL’s patient medical records, and the adult risk assessments received from the police, are qualitatively different from the sort of records gathered by the police that were considered in Catt. YSL’s records have not been produced because of state ‘surveillance’ or systematic collection (although I note YSL’s claim that the collection of information as part of his CAMHS treatment ‘felt like a form of surveillance’; see his trial witness statement, [16]). YSL’s records are the product of his interaction with the Defendant as a patient and of it receiving information from the police with the aim of protecting YSL’s health and welfare by providing medical services to him.

I am prepared to assume in YSL’s favour - without deciding definitively in the absence of full argument - that the processing of YSL’s patient records by way of storage and retention represents an interference with his Article 8(1) rights for the purposes of Article 8(2). However, it is clear that there is a substantial body authority which supports that view.

In Chave (née Jullien) v France (Application no 14461/88, decision of 9 July 1991) the European Commission on Human Rights (a Council of Europe body whose role was to determine whether a petition was admissible to the European Court of Human Rights which was abolished by Protocol 11 to the Convention in 1998) confirmed in respect of a case involving the retention of the applicant’s mental health records that:

“The Commission recalls that the notion of necessity implies that the interference corresponds to a pressing social need and, in particular, that it is proportionate to the legitimate aim pursued. However, the national authorities enjoy a margin of appreciation, the scope of which depends not only on the nature of the legitimate aim pursued but also on the particular nature of the interference involved … in the present case it is necessary to weigh the respondent State’s interest in protection of health or the rights and freedoms of others against the seriousness of the infringement of the applicant’s right to respect for her private life.”

The Commission went on to find that the continued presence in a central record of information about her confinement in a psychiatric institution was an interference with her private life, but that the interference was not disproportionate to a legitimate aim, ie, health. The Commission placed reliance, in particular, on the facts that the records were kept on a confidential basis.

In BB v France(Application no. 5335/06, 17 December 2009) (referred to in Catt, [5])a case concerning the inclusion of persons in a register of convicted sex offenders, it was held at [57] that the ‘mere storing by a public authority of data relating to the private life of an individual’ engaged Article 8 of the Convention so as to require justification.

In LH v Latvia(Application no. 52019/07, 29 April 2014) the applicant underwent a surgical procedure without her consent and she subsequently sued the hospital. Prior to that, the director of the hospital had written to the Inspectorate of Quality Control for Medical Care and Fitness for Work (the MADEKKI), requesting it to evaluate the treatment which the applicant had received. The MADEKKI was a government institution whose main functions were to inspect and monitor the professional quality of health care in medical institutions in Latvia. The Court said at [33]:

“33.

The parties agreed that the applicant’s medical data formed part of her private life and that the collection of such data by the MADEKKI constituted an interference with her right to respect for her private life. The Court sees no reason to hold otherwise. Therefore there has been an interference with the applicant’s right to respect for her private life. It remains to be determined whether the interference complied with the requirements of the second paragraph of Article 8 of the Convention.”

The European Court of Human Rights has dealt with the issue of the storage of sensitive health-related data of those with mental health issues. In Malanicheva v. Russia (dec.) (Application no. 50405/06, 31 May 2016), [13], [15]-[18], the applicant complained under Article 8 about the fact that between 1985 and 1992 her name had been present on the hospital register of persons suffering from psychiatric disorders and about allegedly false references to various aspects of her mental health in internal communications between the healthcare institutions and in their submissions to the domestic courts.

The Court said at [13]:

“It is well-established in the case-law of the Court that storing and sharing data relating to the private life of an individual and, more specifically, personal medical data, amounts to an interference with Article 8 of the Convention and therefore attracts its protection (see S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, § 67, ECHR 2008, and L.L. v. France, no. 7508/02, § 32, ECHR 2006-XI).”

At [15]-[18] it said:

“15.

It is evident in the present case that the healthcare institutions had the applicant’s medical records in their possession, had in the past kept her name on the hospital register of persons suffering from psychiatric disorders, and shared that information in their internal communications and submissions to the domestic courts. The applicant did not call into question the fact that that the storing and sharing of that data as such was prescribed by law or that it pursued a legitimate aim. Indeed, it has previously been accepted that within the meaning of Article 8 of the Convention the recording of information concerning mental patients serves not just the legitimate interest of ensuring the efficient running of the public hospital service, but also that of protecting the rights of the patients themselves (see Yvonne Chave née Jullien v. France (dec.), no. 14461/88, 9 July 1992).

16.

The crux of the applicant’s complaints concerning the presence of her name on the hospital register and the sharing of information concerning her mental health rests on her disagreement with the diagnosis given by the psychiatrists. At the same time, the applicant did not argue that her medical records were at any point divulged to the general public or made generally accessible in any other way. Nor did she argue that the procedures employed by the healthcare institutions and the courts to share the information regarding her mental health lacked sufficient safeguards.

17.

Having regard to the legitimate aim mentioned above, the Court accepts that it was necessary for the effective operation of the domestic healthcare institutions and the decision-making of the courts to store and share the relevant information (see, a contrario, L.L. v. France, cited above, §§ 45-46). Nothing in the material in the Court’s possession indicates that the information was made accessible to the public or was used for any other purpose [than deciding on the most suitable medical care for the applicant.

18.

Accordingly, the Court concludes that the complaints concerning the presence of the applicant’s name on the hospital register of persons suffering from psychiatric disorders between 1985 and 1992 and the allegedly false references to various aspects of her mental health in the subsequent internal communications between the healthcare institutions and in their submissions to the courts are manifestly ill-founded and must be rejected …”

Another case is Mockutė v Lithuania, (Application no. 66490/09, 27 February 2018), [93], where the applicant complained that a psychiatric hospital had revealed information about her private life to journalists and to her mother, thus breaching Article 8. The Court upheld her complaint and found a violation. It said at [93]-[95]

“93.

The Court reiterates that personal information relating to a patient belongs to his or her private life (see, for example, I. v. Finland, no. 20511/03, § 35, 17 July 2008, and L.L. v. France, no. 7508/02, § 32, ECHR 2006-XI). The protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general (see Z v. Finland, 25 February 1997, § 95, Reports of Judgments and Decisions 1997-I; P. and S. v. Poland, no. 57375/08, § 128, 30 October 2012; and L.H. v. Latvia, no. 52019/07, § 56, 29 April 2014). Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking such assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community. The domestic law must therefore afford appropriate safeguards to prevent any such communication or disclosure of personal health data as may be inconsistent with the guarantees in Article 8 of the Convention (see Z v. Finland, cited above, § 95).

94.

The Court has also held that information about a person’s sexual life (see Dudgeon v. the United Kingdom, 22 October 1981, § 41, Series A no. 45; Biriuk v. Lithuania, no. 23373/03, § 34, 25 November 2008; Ion Cârsteav. Romania, no. 20531/06, § 33, 28 October 2014; Magyar Helsinki Bizottság v. Hungary [GC], no. 18030/11, § 191, ECHR 2016) as well as moral integrity (see Couderc and Hachette Filipacchi Associésv. France [GC], no. 40454/07, § 83, ECHR 2015 (extracts)) falls under Article 8 of the Convention. Likewise, information regarding a mental health related condition by its very nature constitutes highly sensitive personal data regardless of whether it is indicative of a particular medical diagnosis. Disclosure of such information falls therefore within the ambit of Article 8 (see, more recently, Surikov v. Ukraine, no. 42788/06, § 75, 26 January 2017).

95.

The Court thus previously found that the disclosure – without a patient’s consent – of medical records containing highly personal and sensitive data about a patient, including information relating to an abortion, by a clinic to the Social Insurance Office, and therefore to a wider circle of public servants, constituted an interference with the patient’s right to respect for private life (see M.S. v. Sweden, 27 August 1997, § 35, Reports 1997-IV). The disclosure of medical data by medical institutions to a newspaper, to a prosecutor’s office and to a patient’s employer, and the collection of a patient’s medical data by an institution responsible for monitoring the quality of medical care were also held to have constituted an interference with the right to respect for private life (see Armonienė v. Lithuania, no. 36919/02, § 44, 25 November 2008, also see Fürst-Pfeifer v. Austria, nos. 33677/10 and 52340/10, § 43, 17 May 2016; Avilkina and Others v. Russia, no. 1585/09, § 32, 6 June 2013; Radu v. the Republic of Moldova, no. 50073/07, § 27, 15 April 2014; and L.H. v. Latvia, cited above, § 33; respectively).”

The authors of Harris, O’Boyle et al, Law of the European Convention on Human Rights (5^th Edn, 2023), the authors state at pp542-3 under the heading ‘Data Protection’ summarise the overall position as follows (my emphasis):

“The collection, storage, and disclosure of information by the state about an individual will interfere with his right to respect for his private life. Thus Article 8 is engaged in respect of data collection by an official census; fingerprinting and photography by the police; the collection and storage of cellular samples and DNA profiles; the collection of medical data and the maintenance of medical records, and the collection and storage of GPS data.”

Hence, as I have said, the weight of authority supports the view that the retention of an individual’s medical data is an interference with their right to a private life guaranteed by Article 8(1) of the Convention which requires justification under Article 8(2). However, the Court has readily concluded that retention is indeed justified because it serves the legitimate interest of ensuring the efficient running of hospital services, but also that of protecting the rights of the patients themselves.

I am therefore satisfied that in principle the retention and processing of YSL’s data was in accordance with the law and is necessary in a democratic society for the protection of health and for the protection of the rights and freedoms of others and hence authorised by Article 8(2).

It is authorised by law primarily because of the UK GDPR and the DPA 2018. Moreover, reg 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936), imposes (in general terms) an obligation on those providing health care to maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided.

These statutory provisions are supplemented by the NHSX Code. Whilst this not a statutory provisions, it is capable of providing a basis in law for the purposes of Article 8(2): Catt, [11], The Code is:

“… a guide for you to use in relation to the practice of managing records. It is relevant to organisations working within, or under contract to, the NHS in England. The Code also applies to adult social care and public health functions commissioned or delivered by local authorities.

The Code provides a framework for consistent and effective records management based on established standards. It includes guidelines on topics such as legal, professional, organisational and individual responsibilities when managing records. It also advises on how to design and implement a records management system including advice on organising, storing, retaining and deleting records. It applies to all records regardless of the media they are held on. Wherever possible organisations should be moving away from paper towards digital records.”

I said ‘in principle’ earlier because YSL complains about the 20 year retention period applicable in his particular case. He maintains that the NHS Code is unlawful in this respect because the retention period it has set it is disproportionate, and will therefore result in a violation of his Article 8(1) rights.

The NHS Code, Appendix II (Retention Schedule), states at p47:

“Retention periods begin when the record ceases to be operational. This is usually at the point of discharge from care when the record is no longer required for current on-going business, or the patient or service user has died.”

In the table which follows in Appendix II, for ‘Mental health records including psychology records’ the retention period is set at ‘20 years, or 10 years after death.’

The test for proportionality was set out in Bank Mellat v HM Treasury (No. 2) [2014] AC 700. Lord Sumption said at [20] that:

“… the question [of whether a measure is proportionate depends on an exacting analysis of the factual case advanced in defence of the measure, in order to determine (i) whether its objective is sufficiently important to justify the limitation of a fundamental right; (ii) whether it is rationally connected to the objective; (iii) whether a less intrusive measure could have been used; and (iv) whether, having regard to these matters and to the severity of the consequences, a fair balance has been struck between the rights of the individual and the interests of the community. These four requirements are logically separate, but in practice they inevitably overlap because the same facts are likely to be relevant to more than one of them.”

Lord Reed dissented on the facts, but at [74] adopted an approach to proportionality which was in substance the same as Lord Sumption's (and Lord Sumption expressly agreed with Lord Reed on this at [20]):

“74.

The judgment of Dickson CJ in Oakes [1986] 1 SCR 103], provides the clearest and most influential judicial analysis of proportionality within the common law tradition of legal reasoning. Its attraction as a heuristic tool is that, by breaking down an assessment of proportionality into distinct elements, it can clarify different aspects of such an assessment, and make value judgments more explicit. The approach adopted in Oakes can be 791summarised by saying that it is necessary to determine (1) whether the objective of the measure is sufficiently important to justify the limitation of a protected right, (2) whether the measure is rationally connected to the objective, (3) whether a less intrusive measure could have been used without unacceptably compromising the achievement of the objective, and (4) whether, balancing the severity of the measure’s effects on the rights of the persons to whom it applies against the importance of the objective, to the extent that the measure will contribute to its achievement, the former outweighs the latter. The first three of these are the criteria listed by Lord Clyde in de Freitas, and the fourth reflects the additional observation made in Huang. I have formulated the fourth criterion in greater detail than Lord Sumption JSC, but there is no difference of substance. In essence, the question at step four is whether the impact of the rights infringement is disproportionate to the likely benefit of the impugned measure.”

I make the following observations drawn from authority about steps (3) and (4) of this analysis.

Firstly, in relation to the third step, a measure does not become disproportionate just because (for example in this case) a lesser retention period of 19, 18 or 17 years could have been selected by the authors of the NHSX Code. Lord Reed explained at [75]:

“75.

In relation to the third of these criteria, Dickson CJ made clear in R v Edwards Books and Art Ltd[1986] 2 SCR 713, 781–782 that the limitation of the protected right must be one that “it was reasonable for the legislature to impose”, and that the courts were “not called on to substitute judicial opinions for legislative ones as to the place at which to draw a precise line”. This approach is unavoidable, if there is to be any real prospect of a limitation on rights being justified: as Blackmun J once observed, a judge would be unimaginative indeed if he could not come up with something a little less drastic or a little less restrictive in almost any situation, and thereby enable himself to vote to strike legislation down (Illinois State Board of Elections v Socialist Workers Party(1979) 440 US 173, 188–189); especially, one might add, if he is unaware of the relevant practicalities and indifferent to considerations of cost. To allow the legislature a margin of appreciation is also essential if a federal system such as that of Canada, or a devolved system such as that of the United Kingdom, is to work, since a strict application of a “least restrictive means” test would allow only one legislative response to an objective that involved limiting a protected right.”

Lord Sumption said of the third stage at [20]:

“The question is whether a less intrusive measure could have been used without unacceptably compromising the objective.”

He also approved the formulation of Maurice Kay LJ in the Court of Appeal at [2012] QB 101, [30], who said of the third step:

“It does not amount to insistence that the least intrusive measure is selected. It is that consideration be given to whether the legitimate aim can be achieved by a less intrusive measure without significantly compromising it.”

As to the fourth step, in R(SC) v Secretary of State for Work and Pensions [2019] EWCA Civ 615, Leggatt LJ (as he then was) said at [84]:

“84.

… Put more shortly, the question at step four is whether the impact of the right's infringement is disproportionate to the likely benefit of the impugned measure. Another way of framing the same question is to ask whether a fair balance has been struck between the rights of the individual and the interests of the community: see the Bank Mellat case at para 20 (Lord Sumption).”

In the case law of the European Court of Human Rights it is also well settled that states have a certain ‘margin of appreciation’ in applying the proportionality test, the breadth of which will vary according to "the circumstances, the subject matter and the background": see eg Rasmussen v Denmark (1985) 7 EHRR 371, para 40; Petrovic v Austria (2001) 33 EHRR 14, para 38. The Commission in Chave referred to the margin of appreciation in the passage I cited earlier. In its judgment on the merits in Stec v United Kingdom (2006) 43 EHRR 74, para 52, the Grand Chamber said:

“A wide margin is usually allowed to the state under the Convention when it comes to general measures of economic or social strategy. Because of their direct knowledge of their society and its needs, the national authorities are in principle better placed than the international judge to appreciate what is in the public interest on social or economic grounds, and the Court will generally respect the legislature's policy choice unless it is 'manifestly without reasonable foundation'.”

This statement has been reiterated in a number of cases: see eg, Carson v United Kingdom (2010) 51 EHRR 13, para 61; Andrejeva v Latvia (2010) 51 EHRR 28, para 83; Fábián v Hungary [2017] ECHR 744, para 115.

The test stated in the Stec case was referring to the margin of appreciation afforded to national authorities by an international court, and not to the approach which a national court should take towards a policy choice made by its own legislature. However, at the national level, there is a broadly analogous principle that in some circumstances it is appropriate for the courts to recognise that there are areas of judgement within which the judiciary will defer, on democratic grounds, to the considered opinion of the body or person whose act or decision is said to be incompatible with the ECHR: R v Director of Public Prosecutions ex parte Kebilene [2000] 2 AC 326, 381. In the domestic context, the term ‘margin of discretion’ rather than ‘margin of appreciation is used. In In Re Medical Costs for Asbestos Diseases (Wales) Bill [2015] AC 1016, [44], Lord Mance said the latter term does not apply at the national level. Lord Reed made a similar point in R(SC) v Secretary of State for Work and Pensions [2022] AC 223, [143]. Nevertheless, he went on to point out, as I have said, that domestic courts have generally endeavoured to apply an analogous approach to that of the European court.

In R (Lord Carlile of Berriew and others) v Secretary of State for the Home Department [2015] AC 945, Lord Sumption said at [34]:

“34.

Various expressions have been used in the case law to describe the quality of the judicial scrutiny called for when considering the proportionality of an interference with a Convention right: ‘heightened’, ‘anxious’, ‘exacting’, and so on ... But the legal principle is clear enough. The court must test the adequacy of the factual basis claimed for the decision: is it sufficiently robust having regard to the interference with Convention rights which is involved? It must consider whether the professed objective can be said to be necessary, in the sense that it reflects a pressing social need. It must review the rationality of the supposed connection between the objective and the means employed: is it capable of contributing systematically to the desired objective, or its impact on the objective arbitrary? The court must consider whether some less onerous alternative would have been available without unreasonably impairing the objective. The court is the ultimate arbiter of the appropriate balance between two incommensurate values: the Convention rights engaged and the interests of the community relied on to justify interfering with it. But the court is not usually concerned with remaking the decision-maker's assessment of the evidence if it was an assessment reasonably open to her. Nor, on a matter dependent on a judgment capable of yielding more than one answer, is the court concerned with remaking the judgment of the decision-maker about the relative advantages and disadvantages of the course selected, or of pure policy choices (eg do we wish to engage with Iran at all?). The court does not make the substantive decision in place of the executive. On all of these matters, in determining what weight to give to the evidence, the court is entitled to attach special weight to the judgments and assessments of a primary decision-maker with special institutional competence.”

As Steyn J succinctly put it in R (II) v Commissioner of Police for the Metropolis [2020] EWHC 2528 Admin, 63(iii), which was a retention case:

“iii)

The assessment of proportionality is a matter for the Court, giving appropriate weight to the views of those with particular expertise in the relevant field.”

Hence, my role is not to usurp the role of the primary decision maker (in this case, in substance, NHSX), and I have to afford an appropriate degree of deference for its judgement on how NHS data is to be managed and in particular how long it is to be retained for.

In the present case, the NHSX Code was plainly the result of detailed consideration by those expert in what was needed by way of retention of NHS data. It is relevant to point out that the Policy covers every conceivable type of data which the NHS might be in possession of. It is not limited to patient and medical data, but also covers, for example, complaints records and corporate records. In relation to patient records, there are different periods specified for different types of record. For example, adult health records not otherwise covered in Appendix II have a retention period of eight years. For some types of record, the retention period is far longer than 20 years. Hence, GP records where the patient de-registered from the practice for unknown reasons have to be retained for 100 years. Although there was no evidence directly on point, I can safely infer that 20 years was not some arbitrary choice, but that those who are expert in such matters decided that 20 years was the appropriate period for mental health records to be retained given their particular nature. It follows that I have to allow a significant margin of discretion on the grounds of institutional competence for NHSX’s decision that that was the appropriate period.

Applying these criteria to the 20 year retention period, I have concluded that that period does not render the otherwise lawful retention of YSL’s medical records disproportionate and so unlawful and in breach of Article 5 of the UK GDPR.

For the reasons I have already give, the first and second parts of the proportionality test are satisfied. The third and fourth overlap. In considering these, I adopt the approach of the Divisional Court in R(CL) v Chief Constable of Greater Manchester Police [2018] EWHC 3333 (Admin), [105]. This was a retention case concerning the retention by the police of crime reports arise from teenage ‘sexting’. Hickinbottom LJ and Moulder J said that proportionality is a matter of substance not form, and that it was the Court to consider whether, on all the evidence, the collection and retention of the claimant's personal data for the purposes identified in Article 8(2) is proportionate to the adverse consequences of that collection and retention of data to the claimant's right to respect for his private life. They said it was an exercise which required the Court to identify those matters in favour of allowing the collection and retention of data despite the infringement of the claimant's Article 8 rights that results, and those matters which are in favour of upholding the Article 8 rights and requiring deletion of the data; and then balance the one against the other: Polish Judicial Authorities v Celinski [2016] 1 WLR 551, [16].

I consider that the interference with YSL’d Article 8(1) rights occasioned by the Defendant’s retention of his medical records is modest. The material is very sensitive, I accept, and such interference as there is still requires justification, for sure (see Catt, [29]), but it is modest. I do not accept YSL’s claim in [26] of his trial witness statement that, ‘it is just a matter of when and not if the Defendant will further distribute them.’ The Defendant is part of the NHS, which has patient confidentiality at its heart. YSL’s medical data is held by the Defendant pursuant to a highly regulated data protection regime, and so the suggestion that there would be some arbitrary or unlawful further disclosure in the future strikes me as far-fetched. Absent some proper reason for the data to be accessed by a member of the Defendant’s staff (who are subject to a duty of confidentiality), YSL’s records will stay passively stored in the Defendant’s computer servers or filing system, in whatever form they are in. There has not been, is not, nor will there be, any stigma attaching to YSL arising from the Defendant’s retention of his medical records.

On the other side of the balance, there are very good reasons why it is necessary for the Defendant to retain YSL’s records for 20 years. I have already touched on some of these. It is now some 12 or 13 years or so since YSL first became a patient under CAMHS. Nonetheless, on his own evidence, YSL continues to have mental health issues which require treatment. As I say, he blames the Defendant in large part for these, however, whatever the reasons for them are, they exist.

It follows that YSL’s mental health may require treatment by the Defendant or another hospital in the future. Obviously I hope it does not, but if that were to happen, then the treating clinicians would obviously need to be able to see the Defendant’s full medical history in order to determine what would be in his best interests in terms of appropriate treatment going forward, exactly as they would if YSL had some chronic long-term physical condition which required treatment. If YSL needed mental health treatment the NHS would be bound to provide it if asked, and YSL is still young and his needs could change in the future. Hence, his records remain an important record of his vulnerability as a young person and a young adult, even if he himself does not agree with aspects of what has been said in the past.

The retention of YSL’s records is also necessary in the interests of the protection of the Defendant’s right to defend itself in litigation. As I said earlier, YSL has regularly threatened for or pursued litigation against the NHS for nearly a decade, and is threatening to do so again. If the Defendant deleted all YSL’s records, it would be left defenceless against YSL in the future (Article 17(3)(e), UK GDPR). The fact that there are limitation periods for litigation of less than 20 years does not mean that period is disproportionate. YSL has not been deterred by limitation from asserting a claim based on disclosure in 2011, because he says that the Defendant’s alleged breach is a continuing one, which it concealed, thereby defeating limitation: draft Amended Particulars of Claim, [95]-[96].

In his written submissions YSL cited a number of cases such as AB and the II case. I have not overlooked these, but I did not find them to be helpful. That is because, as Lord Sumption said in Bank Mellat, [20], and Steyn J said in II, [76], specifically in relation to retention periods, proportionality is intensely fact specific. Thus, Johnson J confirmed in AB at [89] that the case succeeded on the basis of the exceptional impact of retention on AB (who had Autistic Spectrum Disorder of the Asperger’s type, and who had produced a ‘wealth of evidence’ including medical evidence as to the impact on him [32]), and in any event the judge confirmed that in ‘many cases it will be proportionate to retain crime records of offences for long periods of time’. In R (C) v Northumberland County Council [2015] EWHC (Admin) 2134, Simon J upheld as lawful a retention period of 75 years for child protection records, that period starting after a case had been closed.

YSL’s challenge to the lawfulness of a 20 year retention period, and the lawfulness of the continued processing of his data, therefore fails.

Lastly, I turn to YSL’s complaints about the accuracy of the data held by the Defendant.

In the data protection context, accuracy has tended to mean ‘accurate as a matter of fact’, thereby tending to exclude expressions of opinion as capable of being ‘inaccurate’ in that context. Thus, s 70(2) of the DPA 1998 provided:

“For the purposes of this Act data are inaccurate if they are incorrect or misleading as to any matter of fact.”

The fourth data protection principle in Part I of Sch 1 to the DPA 1998 provided that,

Paragraph 7 in Part II of Sch 1 provided:

“7 The fourth principle is not to be regarded as being contravened by reason of any inaccuracy in personal data which accurately record information obtained by the data controller from the data subject or a third party in a case where - \

(a)

having regard to the purpose or purposes for which the data were obtained and further processed, the data controller has taken reasonable steps to ensure the accuracy of the data, and

(b)

if the data subject has notified the data controller of the data subject’s view that the data are inaccurate, the data indicate that fact.”

In NT1 and NT2 v Google LLC [2018] EWHC 799 (QB) Warby J (as he then was), said as follows in respect of the accuracy principle that:

“80.

NT1’s case is that there have been breaches of the first part of the Fourth Principle: the requirement that personal data “shall be accurate”. The requirement that data be “kept up to date” does not have any application in this context. There has been some dispute about how to decide whether a published article is “inaccurate” for this purpose. Two sources of law have been addressed.

81.

First, there is data protection law itself. DPA [1998] s 70(2) contains a ‘supplementary definition’ which explains that ‘For the purposes of this Act, data are inaccurate if they are incorrect or misleading as to any matter of fact.’ This does not take the matter much further, though the reference to fact emphasises that this Principle is not concerned with matters of comment, opinion or evaluation. The reference to “misleading” indicates that the Court should not adopt too narrow and literal an approach. The Working Party’s comments on its criterion 4 are helpful:

“In general, ‘accurate’ means accurate as to a matter of fact. There is a difference between a search result that clearly relates to one person’s opinion of another person and one that appears to contain factual information.

In data protection law the concepts of accuracy, adequacy and incompleteness are closely related. DPAs will be more likely to consider that de-listing of a search result is appropriate where there is inaccuracy as to a matter of fact and where this presents an inaccurate, inadequate or misleading impression of an individual. When a data subject objects to a search result on the grounds that it is inaccurate, the DPAs can deal with such a request if the complainant provides all the information needed to establish the data are evidently inaccurate.”

Article 5(1)(d) of the UK GDPR provides that personal data shall be:

“(d)

accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);”

Section 205 of the DPA 2018 provides that ‘inaccurate’, in relation to personal data, means ‘incorrect or misleading as to any matter of fact’. It thus mirrors the DPA 1998 definition. I therefore agree with the Defendant’s submission that this definition means that matters of comment, opinion, or evaluation are excluded where complaints of inaccuracy are made.

A further difficulty with this aspect of YSL’s case is that his complaints about inaccuracy not clearly or specifically pleaded, a point which Ms Golden made in her witness statement on the strike-out application:

“49.

Finally, any other relevant remaining allegations in the Particulars of Claim are too vague to succeed and in particular:

i.

YSL has failed to plead a proper case on how his records are inaccurate. He should have pleaded first the meaning of the records as to a matter of fact, and then set out why he says the records are factually incorrect …”

YSL’s main specifically pleaded complaint as to inaccuracy appears to relate to suggestions in his CAMHS records of a potential clinical autism diagnosis. Paragraphs 16-18 of the PoC state (sic):

Paragraph 3 of his trial Skeleton Argument alleged that Drs SW and DG;

“… initiated a campaign alleging C has autism without ever communicating this speculation to C”

It seems to me that the clinical diagnosis or diagnoses which YSL complains about, to the extent they can be understood, were all matters of medical opinion which therefore fall outside the data protection accuracy principle.

To the extent YSL has pleaded a separate cause of action based on inaccuracy I would strike it out as disclosing no reasonable cause of action and/or grant the Defendant summary judgment on it as having no prospects of success. It has no merit.

For all of these reasons, this claim fails. For the avoidance of doubt, I reject YSL’s summary judgment application. The Defendant made submissions that if I found for YSL on any aspect of his claim, he would not be entitled to any remedy. However, in the circumstances, I need not address these.

Accordingly, there will be judgment for the Defendant.

Following the circulation of this judgment in embargoed draft to the parties, I received an application notice and witness statement and exhibits (medical records) from YSL. In the application notice (dated 14 February 2024) he said he was asking the Court:

“… to hand down the judgement in private, restrict access to the judgment, amend the anonymity order in the case or extended the period of which the judgement is to be handed down. This request is made due to my current physical and mental health.”

No draft order was attached, and YSL did not specify how he wanted the anonymity order extended. I received a second witness statement and exhibit from him a few days later putting forward further reasons in support of his application. In short, he fears being identified from the judgment, and says that its publication would cause a worsening of his ongoing health issues and hamper his recovery. He prayed in aid inter alia Articles 3 and 8 of the ECHR and the Equalities Act 2010.

The Defendant objected to the course proposed by YSL. In summary, it submitted that there was nothing put forward by YSL which justified a departure from the principle of open justice. Among other things, the purpose of open justice is to enable the public scrutiny of the way courts decide cases; to hold judges to account; and to enable the public to understand how the justice system works and why decisions are taken: Cape Intermediate Holdings Ltd v Dring (for and on behalf of Asbestos Victims Support Groups Forum UK) [2020] AC 629, [41]-[42]. Furthermore, the Court is a public authority for the purposes of the Human Rights Act 1998, and Article 6 requires that judgment shall be pronounced in public.

It said that it was entitled to have a public judgment vindicating its position pronounced in public in the normal way. The trial was held in public, in open court, and there had been no application by YSL to sit in private. Members of the public attended. It would therefore be wrong in principle to have a private judgment following a trial heard in public.

The Defendant said that to the extent that I had the power to hand down the judgment in private or somehow restrict access to it, the required balance came down firmly in favour of the normal course being followed. To do so would be an unjustified derogation from the principle of open justice. The judgment deals with issues which engage the wider public interest, and could be of interest to other NHS trusts who might face similar data protection claims. Article 10 is engaged. That said, the Defendant did not object to any further edits I might make to the draft judgment in order to further safeguard YSL’s anonymity.

On the other hand, YSL’s Article 8 rights are adequately protected by the anonymity order which is in place. The Defendant said that it is not in principle opposed to the removal of specific details from the draft judgment, so long as they are details which would not, if removed, detract from the substance of the judgment, and would not offend against the principle of open justice.

I decline to depart from the principles of open justice. This judgment will be handed down in public in the normal way and then published. My reasons are as follows.

Firstly, open justice is a bedrock principle of our legal system. It has a number of facets including: the general rule that hearings are to be in open court to which the public and press have access (see Scott v Scott [1913] AC 417 and the commentary to CPR r 39.2(2) in the White Book 2023; that parties should be identified; and that judgments should be made public. Any derogation from the principle of open justice requires proper justification and must be necessary and proportionate.

No proper justification exists here. I am not unsympathetic to YSL’s health issues and the other matters he has raised, but they do not provide a basis for making the orders he seeks.

Second, YSL’s identity is protected by the anonymity order made earlier in these proceedings, which I referred to in [1] of this judgment. It made on YSL’s application on 4 April 2022 by Senior Master Fontaine. The recital stated:

“AND UPON consideration of the Claimant’s Article 8 right to respect for private and family life and the Article 10 right to freedom of expression.

AND UPON IT APPEARING that non-disclosure of the identity of the Claimant is necessary in order to protect the interests of the Claimant.”

That order is adequate to protect YSL’s privacy interests. The order is extensive and, besides protecting YSL’s identity from being published, provided among other things for the redaction of YSL’s details from the documents in the bundle. In fact, that was not done, and I took it that YSL did not object to his name and address appearing there. He is protected in any event by the usual order preventing a non-party from inspecting the court’s documents without permission.

Third, YSL chose to bring this litigation. He made his accusations against the Defendant publicly. As the Defendant has pointed out, he did not apply for the case to be heard in private. The trial was listed openly on the court list in the usual way. The interests at stake are therefore not just those of YSL. The Defendant is entitled to a public judgment demonstrating that it did not act unlawfully in the way YSL claimed publicly during the trial, and to the public vindication of its reputation.

I am wholly satisfied that the original draft of my judgment faithfully protected YSL’s anonymity and that there was no risk of him being identified from it, on a jigsaw basis, or otherwise. However, following up on the Defendant’s position, and being sensitive to YSL’s concerns, out of an abundance of caution, I have again reviewed the draft judgment and made some small further edits.