TLT & Ors v The Secretary of State for the Home Department & Anor

The Home Office publishes quarterly statistics about the family returns process, the means by which those with children who have no right to remain in the United Kingdom are returned to their country of origin. As at October 2013 it comprised three phases: assisted return (the object of which was to assist those who agreed to return voluntarily to do so); required return (which was not voluntary but permitted and required them to make their own way to the port of departure), and ensured return (which, as it name implies, entailed a measure of compulsion, albeit under the oversight of an independent panel charged with taking the interests of the children concerned into account). The published statistics identify the number of families in each category and the outcome. They contained nothing which identified them or could have led to their identification.

The published statistics were based on a spreadsheet which contained two tabs. The first, a sheet with nothing but the statistics, whose publication was intended; the second a large spreadsheet with the raw data on which the first was based. The latter contained a substantial amount of personal and official details, including the name of the lead family member; his or her age and nationality; whether they had claimed asylum; the office which dealt with their case, from which the general area in which they lived could be inferred; and the stage which they had reached in the family returns process. I will refer to this as "the spreadsheet".

On Tuesday, 15 October 2013 the Home Office published family returns process statistics for the period 1 April to 30 June 2013 by uploading them onto the UKBA website on a page headed "Key Data on Family Returns Process". The page included a link to the first tab, which set out the statistical details for the period as intended. By error, the page on which this was displayed contained a further link to the spreadsheet. It contained details of 1,598 lead applicants for asylum or leave to remain. It is common ground that clicking onto that link would automatically download the spreadsheet onto the enquirer’s computer.

The error was discovered on 28 October 2013 and the web page immediately taken down, but not before at least one unknown individual had downloaded and saved the spreadsheet. While it was on the Home Office website, the first page, headed "Key Data on Family Returns Process", was accessed and therefore the spreadsheet could have been downloaded by non-Home Office internet protocol IP addresses within the United Kingdom on 27 occasions by 22 different IP addresses and by 1 in Somalia. After an internal debate it was resolved that a statement should be made to Parliament and that individuals still in the United Kingdom, who had been named in the spreadsheet, should be notified.

The discussion was criticised by Ms. Mansoori, for the claimants, because of its partial focus on reputational damage to the Home Office. I need say no more about it than that the documents which I have seen, and the evidence of the senior civil servant Andrew Wren, which I have read and heard, and which I accept to be truthful and accurate, leaves me in no doubt that Home Office officials and ministers conducted themselves entirely properly once the data breach had been discovered. They did consider, and were entitled to consider, various options for dealing with the problem, including not notifying affected individuals, before determining on the course in fact adopted - notifying the Information Commissioner's office (as they were obliged to do and always intended to do); making a statement to Parliament; and notifying individuals affected who were still in the United Kingdom.

The Information Commissioner's office was notified on 6 December 2013 and a statement made to Parliament on 12 December 2013. The affected individuals were notified in January 2014. I reject the suggestion, faintly advanced by Miss Mansoori, that determination of the issues of liability and quantum should in any way be affected in a manner adverse to the defendants by the manner in which Home Office officials and ministers dealt with the immediate aftermath of the breach.

On 24 November 2013 a person who had downloaded the "Key Data on Family Return Process" page and the spreadsheet uploaded both of them onto a US website, docstoc.com, an electronic depository aimed at the professional and business community. It was spotted by the Information Commissioner's office on 13 December 2013 and taken down on 18 December 2013. According to docstoc.com, the pages were accessed on 86 occasions but not downloaded.

TLT was notified of the data breach on 12 January 2014. He was told that the information published included his name and, inaccurately, his date of birth and some limited details about his immigration case, type and status. It is said that no other information, for example his address or financial details, had been published. It advised him to take precautionary measures to protect his finances and said that he might wish to inform his representative about the data breach and seek his advice. He did so and, in consequence, his immigration solicitors wrote to the Home Office asking for further details confirming exactly what had been disclosed. The Home Office replied on 10 February 2014 setting out verbatim what had appeared on the spreadsheet but without the headings, so that not all of the answers could be readily understood. For example, the letter "Y", in the space for "yes", appeared unexplained. It was, in fact, confirmation that the spreadsheet had recorded that he had claimed asylum. The letter contained an apology for the data breach.

A similar process was followed in the cases of PNA, PNB and PNC. All were notified of the data breach on 19 January 2014. Explanatory letters, similar to that sent to TLT, were sent to PNA and PNC on 16 April 2014 and to PNB on 3 March 2014. A redacted copy of the spreadsheet was not disclosed to any of them until 26 August 2015, following the making of an unless order against the defendants by Master Eastman on 5 August 2015.

Much of the law is common ground and the subject of pleaded admissions by the defendants and can, therefore, be taken shortly. It is accepted by Mr. Sanders, for the defendants, that the posting of details about TLT, PNA, PNB and PNC on the Home Office website from 15 October 2013 to 28 October 2013 contained in the spreadsheet amounted to a misuse of their private and confidential information, and to processing their personal data in breach of the first, second and seventh principles set out in Schedule 1 to the Data Protection Act 1998. It is also accepted by him that, subject to proof, damages are recoverable by these claimants for "distress" at common law and that, unless the judgment of the Court of Appeal in Vidal-Hall v Google Inc. [2015] 3 WLR 409 is overturned or qualified by the Supreme Court, I am bound to hold that damages for distress are also recoverable by them under s.13 of the Data Protection Act 1998. I accept this common ground and will act upon it.

There are four significant areas of contention:

As to the first contentious issue, I am satisfied that TLU and TLV can sue for both the common law and statutory torts. The family returns process had, as its object, the return of families with children under 18 who no longer had leave to be in the United Kingdom to their country of origin. The data collected related to that process. It was collected under the name of a lead applicant, in this case TLT but in others the mother of the children, but it applied to all of them. The fact that they had claimed asylum with TLT was just as much private and confidential information about them as it was about him. Their identity could readily be inferred from his name, as could the general area in which, like him, they lived in the United Kingdom. Further, the Home Office held personal data similar to that held about TLT.

"Personal data" is defined in s.1(1) of the 1998 Act:

disclosure of the information or data by transmission, dissemination or otherwise making available …".

This data was "used" and therefore processed by transferring some of it -- the fact that TLT had family members, including children who had claimed asylum and had reached a particular stage in the family returns process -- to the spreadsheet. It was then further processed by the disclosure produced by the posting of the spreadsheet on the Home Office website. Anyone with knowledge of the family, by reference to TLT's name, would be able to identify them. They were not anonymised or, in Scots legal terminology, "Barnardised", so as to render dissemination of statistical information about them permissible because it was no longer personal data (see Lord Hope's speech in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 155 at para.27). The processing of data in the name of TLT about his family members was just as much the processing of their personal data as his. Further, and for the same reasons, such processing also misused their personal and confidential information. TLU and TLV are therefore entitled to bring their claims and to be awarded damages, if appropriate, as is TLT on the same legal basis as him.

Mr. Sanders submits that there is a threshold below which damages for "distress" may not be awarded in respect of it. I agree there is. It is the de minimis principle. There is no other. It is not engaged on the facts of this case.

Miss Mansoori submits that I can, and should, derive guidance from awards in cases involving the deliberate dissemination of private and confidential information for gain by media publishers or individuals engaged in that trade, such as Max Clifford. I disagree. In the case of all claimants, they maintain that they were deeply shocked and put in fear by the Home Office's error. Their cases are far closer to cases in which claimants have been caused to suffer psychiatric injury by an actionable wrong, whether a careless act or deliberate wrong, such as child sex abuse.

I accept her submission that in principle damages can be awarded in respect of the loss of control of personal and confidential information, a proposition settled by the Court of Appeal in Gulati v MGN Ltd. [2016] 2 WLR 1217. On the facts of these cases, as Miss Mansoori accepts, it is neither necessary nor desirable to make a separate award in respect of this head of damage. What I should, and will, do is to take it into account in the awards which I propose to make.

The best guidance to the approach to the assessment of damages is I believe to be found in the judgment of Lady Justice Arden in Gulati at para.48, with modest amendments:

I also accept the observation of Lady Justice Arden that damages are to be assessed under English domestic law and not the approach adopted by the Strasbourg court.

When assessing the damages to be awarded to each claimant I have taken into account their loss of control over their private and confidential information. I do not intend to repeat the fact that I have done so in any individual case. I turn, therefore, to the individual cases.

TLT is a citizen of Iran. He arrived in the United Kingdom on a visitor's visa, together with his wife, TLU, his then 17 year old son and his daughter, TLV (now 16), in 2010. Following a reported search of their home in Iran by Iranian authorities, in which personal belongings and documents were seized, they claimed asylum. TLT was the lead applicant for TLU and TLV. Their son, by then 18, claimed asylum on his own account. The asylum claims of all four were rejected by the Home Office.

Their son was subsequently removed to Iran. TLT, TLU and TLV persisted in their asylum claim and were eventually recognised as refugees in May 2014 and granted leave to remain.

Each has made a detailed confidential witness statement and been cross-examined upon it. I have been able to form a clear view about their truthfulness and reliability as witnesses, despite the fact that TLT and TLU gave evidence through a very good Farsi interpreter. TLT was a calm, intelligent and straightforward witness. TLU was intelligent and thoughtful. Their daughter, TLV, was a bright and palpably honest young woman. All gave direct answers to Mr. Sanders' restrained and proper questions. I am satisfied that they told me the truth as they remember it, and, despite the upsetting nature of some of what they had to recount, that their evidence is unexaggerated and reasonably accurate. TLU and TLV have significant computer skills and an understanding of how the internet works.

The authenticity of the note of the exchange of messages between TLU and another person (“A”) has not been called into question. I am satisfied that it provides a contemporaneous account of what occurred in Iran, when their son returned, and in 2014. I am satisfied that TLT, TLU and TLV were entitled to believe, and did and do believe, what they were told by A. These exchanges, and TLT's own account of his family history, which has also not been challenged, sets the inadvertent disclosure of confidential details about TLT and his family in a context which was for them alarming. The details published by the Home Office included TLT's full name, his nationality and age, the fact that he had claimed asylum and that steps had been taken to secure the voluntary return to him and his family to Iran.

In March 2014 A reported to TLU that a member of her family had been detained and questioned about "you", in other words TLT and his family, and that "they", in other words the Iranian authorities, claim to have documents that "you" have sought asylum. TLT and TLU were asked by another relative to supply copies of their identity documents and passports and they did so, whereupon the family member was released. I cannot, of course, determine whether or not what A said was accurate or well-founded, but it was consistent with information published by the Home Office and with the fears of TLT and TLU that the Iranian authorities had picked it up. TLT, TLU and TLV are convinced that they have done so. Their belief is genuine and it is not irrational. It is not far-fetched that a well-resourced Iranian intelligence agency would monitor UK Government websites by the simple expedient of refining any search by reference to the nationality of those referred to, Iranian. It was not irrational for TLT, TLU and TLV to believe that the Iranian intelligence agency might have been able to match up their details on the spreadsheet with those held in one of their own databases.

TLU and TLV described the steps taken on their behalf to find out how often, and by how many people and by what means, the spreadsheet on which TLT's details had been set out had been accessed, and their frustration at the Home Office's delay in providing those details and a redacted copy of the spreadsheet, as I have noted, giving rise to continued concern about access to them by the Iranian authorities. In their case I accept that they, TLU and TLV, did know of these efforts and were concerned about what they would reveal, and that through their efforts TLT also knew and likewise was concerned.

In July 2014 the concerns of TLT and TLU led them to relocate from the area in which they had lived for four years to another area. They left behind friends, including TLV's school friends, and the place of worship which they had attended after their arrival in the United Kingdom. Mr. Sanders suggested to them that they would have moved anyway. I accept that they would have had to leave their NASS accommodation but I also accept the evidence of TLT that they were offered, and would have accepted, a tenancy of a home in the same area made by the local authority for the area to them. Their lives would not have been disrupted but for their concerns about the consequences of disclosure.

In their case the effects have been serious. At a time when they had not been recognised as refugees TLT and TLU feared genuinely for their own safety if returned to Iran like their son. They genuinely believed that their security while in the United Kingdom was compromised so that they had to move from an area where they had established shallow roots to an area where they had none. In addition, they had genuine and not irrational fears for the safety of their relatives, including their son, in Iran, vividly brought to life by A’s reports of what had happened to the above mentioned family member. To describe the totality of their experiences as "distress" is a misstatement and an understatement, and I use the word only because it is the label under which damages are assessed in cases of this type.

In the cases of TLT and TLU, their circumstances and the "distress" which they have experienced, are comparable and should result in an identical award. I assess damages in each of their cases at £12,500. This is not out of kilter with awards for moderate psychiatric and psychological damage.

The case of TLV is different. She was protected by her youth and by the care which her parents took to shield her from knowledge of what was happening. Nevertheless she too experienced genuine concern, in particular about her family in Iran, and did have her schooling and friendships disrupted. In her case I assess damages at £2,500.

The cases of PNA, PNB and PNC have one regrettable common feature. Their witness statements have been drafted in terms virtually identical to those of TLT and TLU about the impact on them of the delay in disclosure of the same documents by the Home Office, and their concern about what they revealed about the nature and extent of further possible dissemination of the posted information. When questioned about these passages they had little, if any, understanding of what they conveyed. For example, they did not know what was meant by an "IP", internal protocol address, even though they were purportedly expressing concerns about the searches which may have been carried out by the user of the address. This part of their evidence is worthless and I discount it entirely. I do not, however, on that account discount the remainder of their evidence which requires an individual assessment.

PNA is a Pakistani citizen. She entered into an arranged marriage in Pakistan to a Pakistani man in May 2009. He came to the United Kingdom on a student visa and she joined him in January 2011. They had a son, born in October 2011. Her husband was violent and abusive towards her. She left him in September 2012. She says that she applied for asylum in 2012, but Home Office records, if accurately summarised in the details disclosed about her, do not indicate that she did. She may well have applied for leave to remain under para.289A of the Immigration Rules. Her claim was refused. She appealed to the First Tier Tribunal. Her appeal was dismissed in 2013. Simultaneously she was involved in two other sets of proceedings, the prosecution of her husband for assault, of which he was convicted in February 2013 (a subsequent appeal was dismissed), and divorce proceedings which resulted in a decree absolute in February 2014, and in a restraint order against the husband prohibiting him from having contact with her. At that time her address was apparently not disclosed to him, although it was later. There are proceedings in train, brought by him, for contact with their son which have resulted in an order for supervised contact. She says that she feared and continues to fear that removal to Pakistan would put her at risk of violence from his family.

She was recognised as a refugee in May 2015 and granted five years' leave to remain. In August 2013 she was diagnosed by Dr. Rachel Thomas, a chartered clinical psychologist, as suffering from a major depressive disorder associated with post-traumatic stress disorder. It is not suggested that the cause of that was the erroneous Home Office posting.

The information posted about her included her full name, her age and nationality, the general area in which she lived (albeit very imprecisely) and her immigration removal status, including a reference to "children". She gave evidence in English, quietly and, for the most part, calmly. I believe that she was doing her best to tell me the truth as she remembers it, though her recollection of detail is imperfect. She said that publication of information about her came as a shock and caused her to feel panicky. It was an additional stress to her on top of the three sets of proceedings in which she was already involved. She sought the help of her general practitioner, who prescribed an increased dose of anti-depressant medicine.

In her witness statement she expressed her fear that disclosure might have permitted her Pakistani relatives to track her down in the United Kingdom, just as they might have been able to track her down if she was returned to Pakistan. This fear is not rational for two reasons: (1) the information published about her would not tell them anything material that they do not already know, her name and age and the fact that she has a child. Information about the general area in which she lived could not permit them to track her down. (2) It is fanciful to suggest that any private individual might have searched the Home Office website in October 2013, to look for references to particular named individuals. The non-existent chance that they might find her has been vindicated by events. They have not done so. The disclosure of her address to her husband has come about by other means entirely.

PNA must be compensated for the immediate shock of the discovery of the posting of information about her and for a period, to be counted in a few months at most, of genuine concern about the possible consequences and for her expressed feeling that, because of the posting by a body of the Home Office, to whom she had given information in confidence, she could no longer trust authorities. I assess the damages in her case at £3,000, an award which is not out of kilter with awards for less severe psychiatric and psychological injury.

PNB is a Tamil citizen of Sri Lanka. She is married to a husband, with whom she does not live, and has three children. She arrived in the United Kingdom with her three children in 2010 and claimed asylum. Her claim was rejected by the Home Office. She appealed to the First Tier Tribunal, which allowed her appeal in 2015. The Home Office appealed to the Upper Tribunal, ultimately unsuccessfully. The appeal was dismissed in 2016. I do not know if she has now been recognised as a refugee and granted leave to remain, but proceed on the basis that if she has not yet been she will soon be.

She has given a harrowing account of events in Sri Lanka which preceded her arrival in the United Kingdom. This account must have been accepted as credible, at least to the low standard by which asylum claims are assessed in the First Tier Tribunal and Upper Tribunal: is there a realistic possibility that her core account is true? Mr. Sanders has not challenged it in these proceedings. I am therefore content to accept that it is true in its essentials.

In 2006 she was detained, tortured and repeatedly raped by the Sri Lankan army. She escaped to France and then Malaysia. Following her return to Sri Lanka by the Malaysian authorities, she was again detained and raped repeatedly by members of a government agency and an allied paramilitary group. She fled again, this time to the United Kingdom. She impressed Dr. Mala Singh, a consultant psychiatrist, who examined her in connection with her asylum claim on 28 February 2014, six weeks after she was notified of the posting by the Home Office, as an honest historian of her experiences and symptoms. Though she gave evidence through an interpreter, she gave me the impression that she was doing her best to tell the truth as she remembered it.

The posting gave her full name, nationality, age and the area in which she lived, the fact that she had applied for asylum and her immigration removal status and that of her family. She said that for about ten days after hearing of it she was tearful and unable to look after her children properly. She was unable to take them to school for two days. In the medium term the disclosure imposed additional stress upon her. According to Dr. Mala Singh, whose opinion is not disputed, she suffered from severe post-traumatic stress disorder and depression, not caused by the posting, but the additional burden caused by it cannot have improved her mental state.

In her witness statement she cites published Home Office guidance about the reach of the Sri Lankan intelligence agencies. The posting occurred at a time when she was liable to be removed to Sri Lanka. She believed, and still believes, that they may have accessed the posting and so discovered information about her. Although there is no reason to believe that they have, I accept that it was a real concern for her and did cause her significant anxiety until finally her appeal was allowed.

She must therefore be compensated for an acute shock, the after effects of which endured for, at most, a few months. In addition, for two and a half years she has had to endure the nagging fear that if removed to Sri Lanka she might be the subject of adverse attention by the Sri Lankan authorities because they might have accessed the spreadsheet with her details on it. In her case I assess damages at £6,000, an award which is not out of kilter with the lower level of awards for psychiatric and psychological injury of a moderate kind.

PNC is a citizen of Albania. She says that in 2004 she met and married an Albanian man, by whom she had a son. He abandoned her in 2007 and she was inveigled into going to another country by a pimp and people trafficker and there forced into prostitution. She fled that country in the late stages of pregnancy and arrived in the United Kingdom in 2012. She gave birth to her second son a month later. She applied for asylum and she was refused. Her appeal to the First Tier Tribunal was dismissed, according to a Home Office letter of 11 January 2014, because the First Tier Tribunal judge was not satisfied to the low standards applicable in an asylum case that she had been trafficked, and because she had not shown that there were substantial grounds for believing that if returned to Albania she would face a real risk of serious harm. She made further representations to the Home Office, which refused to treat them as giving rise to a fresh claim under para.353 of the Immigration Rules. A claim for judicial review resulted in an undertaking by the Secretary of State to retake the decision. That decision is still pending.

Assessment of her truthfulness and reliability as a witness is made more difficulty by two factors. (1) The First Tier Tribunal's judge's disbelief of her core account. For reasons which I do not know, I have not been shown his determination and reasons but I accept the quotation to which I referred in the Home Office letter. (2) The flat tone in which she gave evidence through an interpreter, consistent with the diagnosis made by Jackie Roberts, the psychotherapist and counsellor with the Helen Bamber Foundation, of complex post-traumatic stress disorder and major depressive disorder. I am, on balance, satisfied that she attempted to tell me the truth about her circumstances in the United Kingdom. Most of her oral evidence was given in a calm and straightforward way. It included her acceptance of the Home Office apology, which it might not have done if she had consciously exaggerated her criticisms and fears, and she did not pretend to understand things attributed to her in her witness statement, such as what a "screen grab" was.

The posting included her full name, age and nationality and her immigration removal status. It did not say that she had claimed asylum. I accept, as she said, that when she was notified of the posting and had it explained to her, she took it badly. I accept that she may have feared that her claimed ex-pimp and his associates might try to trace her, but there was (and is) no rational basis for the supposition that the Home Office posting might have enabled him, or his associates, to do so, still less that they could now do so. It is notable that when she saw Jackie Roberts for the second time, in May 2015, she made no mention of the posting as a factor contributing to her fears or poor mental state.

She should be compensated for an unpleasant shock, the after effects of which have been dissipated after, at most, a few months. I do not accept that the fear occasioned by the posting genuinely lasted longer than that. In her case I assess damages at £3,000.