What Can Public Bodies Do To Protect Your Confidential Information Inadvertently Disclosed To A Third Party?

Data Subject Access Requests are frequently made by individuals to public bodies under the Data Protection Act 2018 to obtain a record of their personal information or, alternatively, they can make requests for information under the Freedom of Information Act 2000.

Public bodies, including local authorities, Government departments, the police, and the NHS, have a duty to comply with these requests. However, it is common, in response to these requests, for confidential information to be inadvertently disclosed to unintended recipients. Can public bodies stop the use of such confidential information?

The High Court addressed this issue in detail in the case of London Borough of Lambeth v AM (No. 2) [2021] EWHC 186 (QB).

London Borough of Lambeth v AM (No. 2) [2021] EWHC 186 (QB)

Background

This case concerned a confidential referral made by the sister of the defendant to the Children’s Service department at the London Borough of Lambeth in respect of the defendant’s daughter’s wellbeing. The matter was closed after the defendant’s refusal to engage with the council.

Subsequently, the defendant made a Subject Access Request for copies of the case file held by the council. The council redacted electronically all information that may reveal the sister’s identity before sending the case file to the defendant. However, the defendant was able to remove the redactions simply by putting the file into Microsoft Word and became aware that his sister was the informant. The defendant threatened to bring a claim against his sister for defamation, breach of confidence, and harassment.

Upon discovery of what the defendant did, the council applied for injunctions to stop the defendant from using the confidential information and to destroy the unredacted copies of the file.

The judgment

The Court ruled that the identity of an informant is confidential and the council may refuse to disclose such information by reason of public interest immunity in preserving the confidence of anyone who reports their concerns about a child’s welfare to Children’s Services. The confidential nature of an informant’s identity is not lost even after any inquiry or investigation is concluded. This is in addition to the fact that the council obviously intended to keep the sister’s identity confidential through heavy redactions.

The Court then went on to consider whether the defendant can rely on the public interest defence. The defendant argued that his sister’s report to the council was malicious and therefore public interest immunity does not protect her identity as an informant. In this case, the Court concluded that the defence was not made out because the report was not made with malice.

The Court held that even if the sister’s malice in making the report was proven, whether the defence of public interest can be established still depends on the nature and degree of her conduct and whether such conduct outweighs the public interest in protecting the confidentiality of people who come forward to report incidents.

The council was granted the injunctions they claimed for.

Comment

With the growing use of requests for information under the various statutory regimes, public bodies often encounter an increasingly heavy workload in handling these requests which increase the risk of human error and thus inadvertent disclosure of confidential information to unintended recipients. The complex areas of law on breach of confidence and data protection interact in these circumstances. It is important that expert legal advice is sought in good time, whether you are on the disclosing end, or the receiving end, of suspected confidential information.