Oral Disclosure & GDPR

The recent decision in Scott v LGBT Foundation Ltd [2020] EWCH 483 (QB) has clarified the position as to whether an oral disclosure of sensitive personal data contravenes the Data Protection Act 1998 (DPA)/and or the General Data Protection Regulation (GDPR) that has now superseded it.

Scott v LGBT Foundation Ltd

Case background

In this case, an employee of the LGBT Foundation disclosed sensitive personal data about Mr Scott to his GP during a telephone call. Mr Scott argued that this disclosure was in breach of DPA 1998 and also contravened his rights under the Human Rights Act 1998.

The case is particularly helpful as it finally provides some much needed clarification as to whether oral disclosures are contrary to the DPA 1998/and or the GDPR.

Decision

It was held that an oral disclosure of information did not breach the DPA 1998. The Court made it clear in their decision that the definition of ‘data’ under the DPA 1998 is limited to information that is recorded electronically or manually, it does not extend to oral information.

As discussed above, the DPA 1998 has since been superseded by the GDPR. What effect therefore does this decision have in respect of oral disclosure and the GDPR?

In reaching the conclusion that oral disclosure does not contravene the DPA 1998, the Court referred to Article 2(1) of Directive 95/46/EC of the Data Protection Directive (implemented by DPA 1998). This Article essentially states that data must be processed wholly or partly by automatic means or forms or is intended to form part of a filing system.

The same provision is quoted almost word for word in the GDPR as such it is clear that the decision reached in Scott v LGBT Foundation Ltd is equally applicable to the GDPR regime.

The Judge was clear in his decision that the DPA 1998 is an Act specifically based around records and processing. There are however other areas of law (such as the law of confidence) that could be relevant to an oral disclosure of sensitive personal data.