KA-2023-MAN-000005 - [2025] EWHC 1593 (KB)

The essence of this cause of action is accurately summarised in Clerk & Lindsell on Torts (24^th ed.) §25-06:

“Traditionally, there are three requirements for liability for breach of confidence, authoritatively outlined by Megarry J in Coco v AN Clark (Engineers) Ltd [1969] RPC 41, at 47. First, the information in respect of which relief is sought must have the “necessary quality of confidence about it”: per Lord Greene MR in Saltman Engineering Co Ltd v Campbell Engineering Co Ltd (1948) 65 RPC 203, at 215. Secondly, the information must have been imparted in circumstances importing an obligation of confidence. The use of the word “imparted”, however, is now clearly too limited for the modern action, it now being established that there is no need for an initial confidential relationship. Thirdly, there must be an unauthorised use or disclosure of that information.”

As to the first requirement, the Defendant disputed before me that the Claimant’s mother’s mobile phone number constituted the type of information to which an employer’s duty of confidence could apply. This was under Ground 6, which I have already addressed in the context of misuse of private information. Mr Waite’s arguments under Ground 6 were the same in relation to breach of confidence as they were in relation to misuse of private information. They accordingly fail, for the same reasons.

As to the second requirement, it is well established that the relationship between employee and employer is capable in principle of give rise to obligations of confidence: Toulson & Phipps on Confidentiality (4^th ed.), §13-047 ff. The duty of confidence will affect personal information that the employee provides in the context of the employment, and will carry on after the employment has ended: §13-049.

As to the third requirement, the Defendant argued before me that the Claimant must be taken to have consented to disclosure of her contact details to the police or emergency services: Ground 7. However, the evidence before the Recorder was that the Claimant’s contact details were retained in case the Defendant itself needed to contact her: see the Judgment at [28], where the Recorder said:

“The Claimant’s confidential information was kept by the Defendant for three months after the cessation of her work. It seems to me that this is not, per se, unreasonable in that it may have been necessary to contact the Claimant for work-related matters for some short number of months after the termination of her employment.”

I do not accept that the Claimant had authorised the Defendant to disclose her mother’s mobile number to anyone else, let alone to Fletcher. She certainly cannot have anticipated that it would be released in circumstances that were unreasonable, as the Recorder rightly found the circumstances in this case to have been. Specifically, she cannot have anticipated that the Defendant’s employees (including the manager in charge at the time) would fail to put into practice the Defendant’s own training.

It follows that the disclosure occurred without the Claimant’s authority.

This means that all the three requirements for liability are met. None of the limiting principles referred to in Clerk & Lindsell at §25-07 arises, on the facts.

In relation to breach of confidence, the Defendant raised arguments under Grounds 4 and 5 that were the same, mutatis mutandis, as those under Grounds 1, 2 and 3 in the context of misuse of private information. I have already explained why the arguments under Grounds 1, 2 and 3 fail. The same points apply to the equivalent arguments Grounds 4 and 5, which also fail.

Accordingly, Recorder was right to find in the Claimant’s favour on liability, as regards this cause of action.

It follows that it is not strictly necessary to consider the Claimant’s Respondent’s Notice, by which she challenges the Recorder’s dismissal of her claim under the DPA/GDPR. In deference to the arguments that I received from both Counsel, I nevertheless do so, although this is not a point that is necessary for my decision or which can affect the outcome, in the light of my earlier conclusions.

The Recorder’s reason for dismissing the DPA/GDPR claim was that he accepted an argument developed to him by Mr Waite that the communication of data by purely oral means – here, the telephone conversation between Mr Bennet and Fletcher – is not sufficient. For this, Mr Waite relied on Scott v LGBT Foundation Limited [2020] EWHC 483 (QB), at [54].

However, the relevant claim failed in Scott not because the information in question was communicated by the defendant to the third party by purely oral means, but because the information had only ever been provided to the defendant orally; and because it then retained not in electronic or manual form in a filing system, but only in the memory of the individual who had received the original oral disclosure.

As Saini J noted at [63], the GDPR is concerned with records and processing. In that case, there was no record, and no processing. Here, there was a record of the relevant information, and it was processed: the personnel file was accessed by Ms Brockbank, the relevant information was extracted by her and provided in written form to Mr Bennett, for him to communicate to Fletcher.

As Mr McCracken submitted to me, this falls squarely within the definition of “processing” in the GDPR at article 4(2). If judicial confirmation is required that disclosure can constitute processing, even if the disclosure is oral, it is provided by Holyoake v Candy [2017] EWHC 3397 (Ch), per Nugee J at [457]. This is also the view of the European Court: Endemol Shine Finland Oy - Case 740/22 at [39].

Accordingly, the Recorder was wrong to accept Mr Waite’s submissions on this point, and (this being the only point taken by the Defendant on this claim) wrong not to find that this claim succeeded, alongside the claims for misuse of private information and breach of confidence.

The Claimant’s Respondent’s Notice was served out of time, with permission granted without notice by HHJ Sephton KC on 19 September 2024. The Defendant sought to have that order set aside on the basis that the Respondent’s Notice was, in substance, an attempt to cross-appeal. Mr Waite explained this essentially on the basis that, he said, the Claimant was seeking to alter or add to the Judge’s factual findings. I do not agree. It seems to me clear from the judgment that the Recorder only rejected the DPA/GDPR claim on the basis of the Defendant’s point on Scott – i.e., on the basis of a pure question of law, on which I have come to a different view. But for that, he would have found in the Claimant’s favour on this point as well, and his factual findings would undoubtedly have justified such a conclusion. I therefore reject the Defendant’s application to set aside the order of 19 September 2024.