In the High Court case of J D Wetherspoon v Raine, J D Wetherspoon has been held liable for damages following the oral disclosure of the private information of an ex-employee which was given to an ex-partner of that employee following a deception. This disclosure was held to have constituted “processing” for the purposes of the GDPR, misuse of private information and also a breach of confidence.

Background

The Claimant, Ms Raine, was a former employee of the Respondent, J D Wetherspoon (Wetherspoons). During her employment she had provided her mother’s mobile number as her emergency contact number. This information was kept in the Claimant’s personnel file which was marked as “Strictly Private and Confidential”. It was known to her employer that the Claimant had suffered from abuse and harassment from her former partner and she had raised that she feared contact with him.

On Christmas Day 2018, Ms Raine’s abusive ex-partner called the Wetherspoons branch where the Claimant formerly worked pretending to be a police officer needing to contact the Claimant urgently. Following authorisation by the manager on the premises, an employee disclosed the Claimant’s mother’s phone number despite having received training on “pretexting” (the use of a fabricated story to gain a victim's trust and trick them into sharing sensitive information). On obtaining the mother’s phone number, the ex-partner used it to allow him to continue to harass the Claimant.

The Claimant brought a claim in the County Court against Wetherspoons for damages, alleging causes of action for (1) misuse of private information, (2) breach of confidence and (3) breach of duties owed under the Data Protection Act 2018 (“DPA”) and the General Data Protection Regulations (“GDPR”). She won part of her claims as first instance.

Appeal

On appeal, the High Court upheld all the Claimant’s claims.

Misuse of private information

The court found that the mother’s mobile number constituted the Claimant’s information and the fact that the mobile number was the Claimant’s mothers was immaterial. It was found that (1) the Claimant had a reasonable expectation in the privacy of the emergency contact number which was stored in her confidential personnel file, and (2) the expectation of privacy was not outweighed by Wetherspoon’s freedom of expression to justify the disclosure.

Breach of confidence

All 3 elements of the test for breach of confidence were satisfied: (1) the mother’s mobile number constituted information which an employer’s duty of confidence applies; (2) there was an obligation of confidence; and (3) the disclosure was unauthorised.

Data protection

The court held that an oral disclosure of information can constitute “processing” under the GDPR. The fact that the mother’s mobile number was stored in her confidential personnel file which was recorded, it was subsequently accessed, extracted and then communicated to her ex-partner meant that it fell within the definition of processing.

Comment

This case highlights how important it is for employers to provide training to staff who have access to employee personal data about their duties under data protection law and in relation to risks such as pretexting.