Defamation Act & Data Protection Act issues

[JCE]

Hi - I would like some clarification - preferably from someone with a sound legal knowledge in these areas - it is in the context of sensitive personal information which was supposed to be kept confidential and which one government run institution (or rather some employees of that institution) has released without consent of the person concerned to another (government financed) institution in the course of a complaint procedure. The receiving institution 'forces' applicants to sign their data-handling clause when applying (there is only one field to provide a signature) as they would not process it otherwise: "The [receiving institution] will need to handle personal details about [the applicant], which could include sensitive information (for example, relating to health matters), in order to deal with my complaint effectively."
According to my reading, this phrase does not allow them to bypass any statutory data protection regulations when it comes to collecting new/additional data about applicants, especially regarding information which the releasing institution covered in their data protection policy - implying that they are not forwarding any sensitive personal information to third parties without consent of the person concerned.

In addition the material contains some medically stigmatizing allegations/classifications, which lack sufficient evidence - hence I'm wondering whether it qualifies for suing the [releasing] institution for defamation of character as these details have been used by the [receiving] institution to support their dismissive conclusions.

Many thanks

[enquirer]

Re: Defamation Act & Data Protection Act issues

So, you deal with Department A. This is not satisfactory, so you complain to Department B. A releases information to B in order that B may deal with the complaint. Some of the data is incorrect. As a result, B comes to a negative conclusion.

You object to A sharing information with B.
You object that the information shared was incorrect, leading to some detriment to yourself.

Presumably for B to deal with the complaint they must have this information. It is also likely that in your initial dealings with A, you authorised data sharing.

The recipient is also bound by the Data Protection Act. They are bound even if the acquisition was accidental or unwanted.

If the data is incorrect, then to knowingly maintain in incorrect database is an offence. The conclusions that they draw from that data is another matter entirely.

[CleverClogs]

Re: Defamation Act & Data Protection Act issues

Defamation actions are:

1. restricted to being commenced in the High Court
2. horrendously expensive, even if one does most of the work oneself
3. not capable of being funded by legal aid
4. likely to ruin a claimant were he/she to lose
5. not wise to bring against a defendant with unlimited resources
6. for all of the above, inherently unjust.

Unless you can find a barrister who'll do it pro bono (and also insure yourself for costs if you lose) one would be far wiser not to consider suing.

[JCE]

Re: Defamation Act & Data Protection Act issues

Thanks for your response - re:

If the data is incorrect, then to knowingly maintain in incorrect database is an offence.

Which law would best cover this offence?

It is also likely that in your initial dealings with A, you authorised data sharing.

No, originally the data sharing policy of Dept. A had deliberately not been signed as it stated there: "If you do not complete and return this form... WE WILL ALSO ASSUME YOU DO NOT WISH US TO DIVULGE INFORMATION ABOUT YOU TO A NOMINATED PERSON"

[JCE]

Re: Defamation Act & Data Protection Act issues

Thanks re -

Defamation actions are:horrendously expensive, even if one does most of the work oneself

I'm aware, though it seems it seems it is often dealt with on a CFA basis.

not wise to bring against a defendant with unlimited resources

As the context is remotely similar - here is one were someone succeeded!

[Sparkie1723]

Re: Defamation Act & Data Protection Act issues

Processing data and/or information is NOT an offence under the DPA it is a Breach of the Act........"Breaches" and "Offences" are two completely different animals under the Act

Sparkie

[enquirer]

Re: Defamation Act & Data Protection Act issues

Which law would best cover this offence?

Data Protection Act 1998.

No, originally the data sharing policy of Dept. A had deliberately not been signed as it stated there: "If you do not complete and return this form... WE WILL ALSO ASSUME YOU DO NOT WISH US TO DIVULGE INFORMATION ABOUT YOU TO A NOMINATED PERSON"

Right, you may have them there, but check that the small print of complaints procedure. There may be something in there.

If you want to hurt them, your best bet is to pursue the DPA angle. Be aware however that they may bounce it back at you, pointing out that they cannot deal with your complaint unless they data share.

For resolution of the incorrect decision, it would be best to continue escalating the internal complaints procedure. Based on the information you have given, an action in defamation is not a viable option.

[JCE]

Re: Defamation Act & Data Protection Act issues

Processing data and/or information is NOT an offence under the DPA it is a Breach of the Act........"Breaches" and "Offences" are two completely different animals under the Act

Thanks for the clarification - I used the wording enquirer had used before

So are the actions of Dept. A - ie releasing the data without consent and the action of Dept. B - processing the data (& 'publishing' it in their outcome of the complaints procedure) breaches of the DPA then?

[JCE]

Re: Defamation Act & Data Protection Act issues

For resolution of the incorrect decision, it would be best to continue escalating the internal complaints procedure. Based on the information you have given, an action in defamation is not a viable option.

Thanks, as stated the circumstances bear similarity to this case .

Dept. A had requested in writing medical information from another medical institution C.. This document (the one sent from Dept. A. to medical institution C) makes defamatory medical allegations without evidence. The other information that was forwarded by Dept. A. is an unsigned handwritten note which makes further defamatory medical allegations without evidence.
Dept. B has acted on this information provided by incorporating this medical allegation/statement from the handwritten note in order to support their arguments in dismissing the complaint. As the information released ('published' in the sense of the defamation act) from Dept. A to B (along with other insinuations and misrepresentations Dept A had made in the course of the complaint procedure), discredited and lowered the claimant's estimation in the view of others (including medical institution C) and contributed to the preliminary dismissal of the complaint - does that not validate defamation?

Neither Dept. A nor Dept. B are medical institutions, only C is.

[enquirer]

Re: Defamation Act & Data Protection Act issues

This document makes defamatory medical allegations without evidence.

What is a 'defamatory medical allegation'?

If it is a reasonably held medical opinion, then you are on thin ice. If Dr X says 'I think this patient is making it all up', this is unlikely to be defamatory. On the other hand, if he says 'I reckon this guy is stealing from his employers', it probably would be.

It should also be borne in mind that a lot of medical notes are necessarily speculative. 'Please investigate Mr Z, I suspect he may have ...".

... does that not validate defamation?

It might do, but that would depend very much on content. It would have to be quite serious - outright and demonstrable lies, for instance - if it were to sway a jury. Bear in mind too, that a counter suit is also a possibility - after all, you are accusing the other party of something rather nasty.

[FlamingParrot]

Re: Defamation Act & Data Protection Act issues

Defamation actions are:

1. restricted to being commenced in the High Court
2. horrendously expensive, even if one does most of the work oneself
3. not capable of being funded by legal aid
4. likely to ruin a claimant were he/she to lose
5. not wise to bring against a defendant with unlimited resources
6. for all of the above, inherently unjust.

Unless you can find a barrister who'll do it pro bono (and also insure yourself for costs if you lose) one would be far wiser not to consider suing.

Did you mean to say LIMITED resources instead? :confused2: Because I would think there would be little point in bringing a defamation lawsuit against someone who hasn't got the money to compensate you, even if you win, you can't get blood out of a stone. And they couldn't pay your legal costs either, which, as you so aptly pointed out, can be very high.

If, on the other hand, the defendant had UNLIMITED resources, it would be worth pursuing - provided you had solid grounds, of course.

[JCE]

Re: Defamation Act & Data Protection Act issues

Further to the aspects discussed in this thread so far - does the above data-handling statement automatically include consent to the processing and sharing of sensitive personal data under the Common Law Duty of Confidentiality?
Institution 'A' requested quite a while back to sign their Confidentiality policy statement which explicitly excludes sharing data with third parties without consent. Would they be in breach of contract (and the CDLC) if institution 'B' has statutory power to place any obligation on institution 'A' in the course of a alternative dispute resolution?

In more general terms I would like to know if any consent (even if the wording of this consent statement were misleading) to the processing of sensitive personal data (in the context of the DPA) automatically warrants processing of this data under the CDLC?

[CleverClogs]

Re: Defamation Act & Data Protection Act issues

Did you mean to say LIMITED resources instead? :confused2:

No. I will explain why presently.

Because I would think there would be little point in bringing a defamation lawsuit against someone who hasn't got the money to compensate you, even if you win, you can't get blood out of a stone. And they couldn't pay your legal costs either, which, as you so aptly pointed out, can be very high.

Indeed - apart from obtaining a retraction of the defamatory statement(s), an apology for having made the same and an injunction against their repetition, there is bugger all sense in suing a man of straw.

If, on the other hand, the defendant had UNLIMITED resources, it would be worth pursuing - provided you had solid grounds, of course.

Except that, if the defendant did have unlimited resources, their legal team would be rather expensive and they would doubtless wish to spin the case out for as long as possible. Even if they were to perceive that they were losing, they might make an offer to settle in the sum of a few thousand quid (which they would pay into court) but with no admission of blame or any apology; were one to continue the action and be awarded less than the offered amount, one would then have to pay not only one's own costs but also those of the defendant.

If I recall correctly, it was the late offer by Olswang (and payment into court) of a few thousand quid that persuaded Dr Godfrey to settle the two actions he had brought against Demon Internet; he ended up with nominal damages in the first action and £5,000 in the second, plus his costs for both. Demon quibbled a bit on his costs as he had done much of the secretarial work himself but, after the costs had been taxed (assessed) properly, they paid up.

His costs were a sum not significantly different from £500,000. Demon's costs were more than twice as much.

[JCE]

Re: Defamation Act & Data Protection Act issues

Could someone update me on the CDLC aspect as well please - I thought the duty of confidentiality applies independently of the Data Protection Act? Accordingly aren't there circumstances where there may be not necessarily a breach of the DPA, yet still of the CDLC?

[labman]

Re: Defamation Act & Data Protection Act issues

Could someone update me on the CDLC aspect as well please - I thought the duty of confidentiality applies independently of the Data Protection Act? Accordingly aren't there circumstances where there may be not necessarily a breach of the DPA, yet still of the CDLC?

Possibly, as the DPA is very specific about how the data is, or is intended to be held.