Key takeaways
Speaking personal data counts as processing
Even verbal sharing triggers data protection responsibilities.
Policies aren’t enough without action
Managers must follow procedures to avoid legal risk.
Structured personal data must be protected
Details stored in organised files fall under GDPR rules.
Data protection: oral disclosure of personal data is ‘processing’
Employers have obligations under data protection law when they process a workers’ personal information is stored in a structured filing system, such as personnel files. If a manager reveals information from a worker’s personnel file to a hostile actor, after falling for an act of deception, does this oral disclosure amount to ‘processing’ for data protection purposes? That question has recently been considered by the High Court.
A former employee of a pub chain, R, brought various claims after private information from her personnel file was wrongly disclosed to her abusive ex-partner. As is standard practice, R’s personnel records contained an emergency contact number for her mother. Managers at the pub were aware R was a domestic violence victim and that her ex-partner was on remand for violence and harassment against her. To avoid his constant calls, R had changed her mobile number. After R had left the pub’s employment, the pub received a call from someone claiming to be a police officer who needed to speak to R urgently. In reality, this was R’s ex-partner, who had somehow secured access to an illicit phone whilst on remand. With the pub manager’s consent, who believed he was a police officer, he was orally provided with the mobile number for R’s mother saved on her personnel file. He then called R’s mother, again pretending to be a police officer urgently trying to contact R, and persuaded her to give him R’s new mobile phone number. Now that he had her new phone number, he called R to verbally abuse her and make various threats, causing her great distress and anxiety. Afterwards, R successfully brought claims against her former employer in the County Court for misuse of private information and breach of confidence, but her data protection claim failed.
On appeal, the High Court rejected the employer’s arguments that R’s mother’s mobile phone number was not R’s personal information, and that she had no reasonable expectation of privacy in that information. This was a case where a manager had permitted the active oral disclosure of R’s mum’s phone number to a third party, albeit after falling for an act of deception and in breach of the data protection policy, meaning this case could be distinguished from one involving a cyber-attack by external hackers. The High Court therefore upheld the County Court’s decision on liability for misuse of private information and breach of confidence.
Secondly, the High Court also held that the County Court was wrong to reject R’s data protection claims on the basis that oral disclosure of personal data did not amount to ‘processing’. The oral disclosure of information from a worker’s personnel file can constitute ‘processing’ for data protection purposes. The phone number had been recorded in R’s personnel file (which was stored in a structured filing system) on a form clearly marked private and confidential, before it had been extracted from R’s personnel file with the manager’s consent and orally disclosed to a third party. This “fell squarely” within the definition of ‘processing’ for data protection purposes.
The decision is a reminder that employers must take proactive steps to preserve the security and integrity of the personal data stored in staff personnel files. As the oral disclosure of private information stored on those files can amount to ‘processing’, the data protection principles must be complied with, and proactive steps must be taken to preserve its security. It also illustrates that written data protection policies will only take the employer so far – they will not act as a ‘shield’ if managers and other employees fail to follow them as they should.
