Nadine Dorries MP (© http://www.TheyWorkForYou.com)
Today, Nadine Dorries MP issued on her blog a personal statement to the press. In the statement she describes how she has embarked upon a romantic relationship with an old family friend. However, the statement also includes personal statements from her new partner and her partner’s daughter. From these secondary statements the wife of the partner can be identified, and she is stated to be a long-term alcoholic and a domestic abuser.
You will note that we have not named the partner, his wife or his daughter. To do so would mean that we would be processing personal data, including sensitive personal data, about these individuals. For the reasons set out in this post, we consider that such processing, being done without the explicit consent of the wife of the partner, would be unlawful under Data Protection Act 1998 (the “DPA”).
The first question that needs to be answered in connection with the press statement is whether the DPA applies at all. Whilst the DPA would apply to our use of the partner’s family personal data, there is a question as to whether the disclosure of this information on Nadine Dorries’ blog is within the scope of the DPA. This is because section 36 of the DPA exempts processing for domestic purposes by an individual. There is no UK case law to assist in determining where the boundary lies for this domestic purposes exemption, but there can be little doubt that if the courts were asked to consider these circumstances, they would be bound by the Court of Justice of the European Union decision in Case 101/01 Bodil Lindqvist. We would expect a UK court to apply the Bodil Lindqvist decision to find that the publication by an MP of personal data of third parties on the internet was not covered by the section 36 exemption. Section 36 is clearly the implementation in the UK of the second limb of Article 3(2) of the Data Protection Directive 95/46/EC. The Bodil Lindqvist case facts are very similar to this Nadine Dorries case; both cases involve the publication of personal data, including sensitive personal data, on the internet in circumstances where a non-commercial, private purpose was or could be claimed. The Court of Justice was particularly influenced by Recital (12) of the Directive to decide that internet publication could not be considered to be domestic processing within the exemption at Article 3(2):
(12) Whereas the protection principles must apply to all processing of personal data by any person whose activities are governed by Community law; whereas there should be excluded the processing of data carried out by a natural person in the exercise of activities which are exclusively personal or domestic, such as correspondence and the holding of records of addresses;
The next question, having decided that the DPA applies, is whether there has been any breach of the DPA by disclosing the personal statements. To comply with the First Data Protection Principle under the DPA, a data controller (in essence, the owner of the data or the one who decides what to do with it) must process the data in accordance with one of the appropriate conditions set out in two schedules to the DPA: Schedule 2 for “ordinary” personal data or Schedule 3 for sensitive personal data. For the purposes of this post, “ordinary” personal data is data which identifies an individual and which is not sensitive personal data. Sensitive personal data is defined in section 2 of the DPA as:
In this Act “sensitive personal data” means personal data consisting of information as to—
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
Even taking the most favourable interpretation of this definition to the information disclosed about the partner’s wife, it is clear that information about her alcoholism (physical or mental health or condition) is sensitive personal data. There does not appear to be any legitimate purpose under Schedule 3 that would permit the disclosure of this information without the explicit consent of the partner’s wife. It therefore appears that the disclosure is unlawful.
Having decided that the publication of a third party’s medical condition, if it is without explicit consent, is unlawful, raises the question of the consequences. We will deal with this in our next post.
TiMeriTy 