(1) TLU (2) TLV v (1) Secretary of State for the Home Department (2) Home Office

The Home Office accidentally uploaded a spreadsheet containing information relating to 1,598 people who were applying for asylum or leave to remain in the United Kingdom. The information included names, ages and nationalities. The spreadsheet was publically accessible for around two weeks and was downloaded by 22 different domestic and international IP addresses.

The Cs, TLT, TLU and TLV, were Iranian nationals and brought proceedings against the Ds in respect of misuse of their private and confidential data and under the Data Protection Act 1998 for the processing of their personal data. TLT was named in the spreadsheet; his wife and daughter, TLU and TVU, were not named. The issue of liability before the judge at first instance was whether TLU and TLV could recover damages at common law or under the Data Protection Act.

In his judgment, Mitting J had found for each of the claimants. He had held that the identity of TLU and TLV could readily be inferred from the name of TLT. The judge had ordered the Home Office pay damages to TLT and TLU of £12,500 and to TLV of £2,500 plus costs and interest in the case of TLU. Permission to appeal was granted on the issue of liability for TLU and TLV.

(1) Did the spreadsheet contain TLU’s and TLV’s private and/or confidential information?

(2) Did the spreadsheet contain TLU’s and TLV’s personal data?

The appeal was dismissed.

(1) The spreadsheet did contain information that was private and confidential information to TLU and TLV.

The information about TLT on the spreadsheet meant that TLU and TLV could readily be identified from it. The information went to their identities and their claims for asylum. The spreadsheet therefore contained information relating to TLU and TLV of which they had a reasonable expectation of privacy, regardless of the fact that they were not explicitly named.

(2) The spreadsheet did contain TLU’s and TLV’s personal data.

The wording of the statute should be taken at its natural meaning. The data on the spreadsheet “related to” TLU and TLV as they could be identified from the data. As such, despite not being named, the spreadsheet contained their personal data under the Data Protection Act 1998.

This case shows the wide scope of what can be classified as personal data and private information.

The Court of Appeal also declined to address the issue of whether TLU and TLV would be entitled to damages under section 13 of the Data Protection Act 1998 if they had been unsuccessful in relation to issues (1) and (2).