Isma Ali v Luton Borough Council
| Jurisdiction | England & Wales |
| Judge | Richard Spearman |
| Judgment Date | 27 January 2022 |
| Neutral Citation | [2022] EWHC 132 (QB) |
| Docket Number | Case No: QB-2020-001180 |
| Year | 2022 |
| Court | Queen's Bench Division |
[2022] EWHC 132 (QB)
IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Royal Courts of Justice
Strand, London, WC2A 2LL
Richard Spearman Q.C.
(Sitting as a Judge of the Queens Bench Division)
Case No: QB-2020-001180
Tom Clarke (instructed by Irvings Law) for the Claimant
Jack Harding (instructed by Weightmans LLP) for the Defendant
Hearing dates: 17 and 18 January 2022
Draft Judgment
Richard Spearman Q.C.:
INTRODUCTION
In this case it is not in dispute that an employee of the Defendant, Rhully Begum, breached the rights of the Claimant by accessing and disclosing to the Claimant's husband information about the Claimant (and also the two young children of the family) which was stored on the Defendant's IT system. The issue is whether the Defendant is vicariously liable for Ms Begum's admittedly wrongful, and indeed criminal, acts.
It is common ground that this issue falls to be determined by applying the law as declared by the Supreme Court in Various Claimants v Wm Morrison Supermarkets plc [2020] AC 989, and in particular the test reiterated by Lord Reed PSC at [25]:
“… in a case concerned with vicarious liability arising out of a relationship of employment, the court generally has to decide whether the wrongful conduct was so closely connected with acts the employee was authorised to do that, for the purposes of the liability of his employer, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment.”
On behalf of the Claimant, Mr Clarke submits that the proper application of that test to the facts of the present case leads to the conclusion that vicarious liability is made out. He further submits that other decided cases, including those which are concerned with claims for sexual abuse, provide additional helpful guidance. In that context, he emphasises in particular the role which Ms Begum was entrusted by the Defendant to perform and the nature of the information in question. There were welfare and safeguarding aspects to both that role and that information, and these considerations, as Mr Clarke submits, are relevant and give rise to an analogy with the sexual abuse cases.
On behalf of the Defendant, Mr Harding submits that the Morrison case is not only the starting point but for all practical purposes the finishing point for the analysis which is applicable in the present case. He draws attention to the factual similarities between the two cases: both concerned data breaches, and an employee who misused data to further the employee's personal agenda (as opposed to furthering the business of the employer). Indeed, Mr Harding submits that the argument against a finding of vicarious liability is, if anything, stronger in the present case: for example, in Morrison the employee had misused for purposes of his own vendetta against the employer data which the employer had tasked him with using lawfully for purposes of the employer's business, whereas in the present case Ms Begum misused for her own purposes of assisting the Claimant's husband data which she was not required to use in any way by the Defendant and instead accessed improperly and in breach of both the Defendant's protocols and her own contract of employment. Mr Harding contends that there is no need to look beyond Morrison for the purposes of deciding the present case, but in any event the further authorities upon which Mr Clarke relies do not assist the Claimant, and indeed, in common with the outcome in Morrison, point to the conclusion that the claim fails.
I am grateful to both Counsel for their clear and carefully presented submissions.
The claim was originally framed more widely, and included a case that the Defendant had a direct liability to the Claimant under various heads. However, that wider case was abandoned shortly before the beginning of the trial. In addition, neither side sought to challenge any aspect of the evidence of the other. The trial accordingly proceeded without oral evidence, and on the basis of the witness statements and documents alone. Finally, the parties agreed that, if liability was made out, the sum of £6,250 represented the amount of compensation which it would be appropriate to award to the Claimant.
THE FACTS
The Claimant was married in 2015, and she and her husband later had two children. The marriage ran in to difficulties, which in due course culminated in a divorce. In the meantime, their problems led to the family having contact with social services, and to data relating to the Claimant and the children being compiled by the Defendant on a case management system utilised by the Defendant which is known as “Liquid Logic”.
On 1 March 2019, before the marriage had come to an end and while it would appear the husband was still living in the family home, the Claimant made a complaint concerning the husband to the police. That in turn resulted in a Multi Agency Referral by the police to the Defendant, in essence on the basis that the subject matter of the complaint gave rise to safeguarding concerns relating to the Claimant and the children.
A few weeks later, the Claimant began to suspect that information relating to her had been leaked. Her family and friends began asking her questions about why she had involved the police, and when she asked people why they believed that she had gone to the police it emerged that her husband was saying that he had been informed of this by an individual who worked for the Council who he was now seeing. In light of what she had learned, the Claimant made complaints to both the police and the Defendant in relation to the way in which they had dealt with information concerning her. The complaint against the police has evolved into separate proceedings, which have yet to be tried. The complaint against the Defendant has evolved into the present proceedings.
In the meantime, the Defendant has accepted that it did not handle the complaint against it in a satisfactory manner, and, following an investigation and an apology, it paid the Claimant compensation in the sum of £2,570 in respect of that separate shortcoming.
It is the evidence of Steven Scott, who is employed within the IT team of the Defendant, that on 9 May 2019 he received a request to undertake a full audit trail of the case records relating to the Claimant and the children to see how they had been accessed. That request followed earlier contact with the Defendant. According to Mr Scott's evidence, that contact included: two telephone calls on 29 April 2019 in which the Defendant was informed that the Claimant's husband was saying that he had information which emanated from the Defendant and that he had a mistress working for Children's Services within the Defendant; and an email from the Claimant dated 8 May 2019 in which she stated (among other things) that her husband had pictures of her information on file and quotes of conversations held by Social Services, and had been showing people her records. Mr Scott completed his report on 14 May 2019. It showed, in summary: (i) that a total of 10 reports relating to the Claimant had been accessed on the Liquid Logic system on 26 April 2019 by Ms Begum, (ii) that 3 of those reports contained data of a highly sensitive nature which was capable of placing a family at risk; (iii) that Ms Begum had not accessed these records at any time prior to 26 April 2019, and was not shown to have printed anything on that date; and (iv) that Ms Begum had printed a 9-page document on 7 May 2019 which the Defendant suspects may have comprised information copied and pasted from the records into a blank Word document. Mr Scott further states that it was “never established” whether Ms Begum had printed any documents from the system or if she prepared a Word document which contained information extracted from the records and that “It may well be that she took photographs of the information on her personal mobile phone”. Mr Scott based this last comment on the fact that Claimant had said in the course of her contact with the Defendant that her husband had pictures of her information. Finally, for reasons which he explains, involving encryption of USB drives and audit trails of the same, Ms Begum could not have downloaded information onto a USB drive.
While these matters were being investigated, Ms Begum was denied access to the Defendant's IT system. In light of what was discovered about her conduct, Ms Begum was dismissed, and, further, was arrested and charged with one offence of unauthorised access to computer material, contrary to section 1 of the Computer Misuse Act 1990. On 13 October 2020, following her conviction on her own plea of guilty, she was sentenced at Luton Crown Court to 3 months' imprisonment, suspended for 12 months, together with 150 hours of unpaid community service. In passing sentence, Her Honour Judge Mensah referred to and endorsed the comments of Ms Begum's line manager at the material time that her conduct was “deliberate, planned and goes against every professional code of conduct we adhere to and… put the family at risk of harm”.
In addition to the witness statement of Mr Scott, the Defendant served witness statements of Leigh Jolly, the Defendant's head of IT, and Diane Rushby, who is employed by the Defendant as head of service for the multi-agency safeguarding hub and family partnership service of the Defendant, which incorporates the Manor Family Resource Centre where Ms Begum was employed as a Contact...
To continue reading
Request your trial
-
Isma Ali v The Chief Constable of Bedfordshire Police
...not. It was heard by Richard Spearman QC, sitting as a Deputy High Court Judge, in January 2022 and dismissed on 27 January 2022: see [2022] EWHC 132 (QB). Luton was held not vicariously liable for the unlawful (and indeed criminal) acts of its 3 The present claim is brought on the basis t......
-
Data Protection: Vicarious Liability Following Morrisons ' Again No Liability For An Employee's "Frolic Of Her Own"
...v Luton Borough Council [2022] EWHC 132 (QB) it was found that Luton Borough Council was not vicariously liable for a breach of the claimant's data protection rights by one of its employees. By doing so the Court adopted the approach of the Supreme Court in WM Morrison Supermarkets v Variou......
-
Data Protection: Vicarious Liability Following Morrisons ' Again No Liability For An Employee's "Frolic Of Her Own"
...v Luton Borough Council [2022] EWHC 132 (QB) it was found that Luton Borough Council was not vicariously liable for a breach of the claimant's data protection rights by one of its employees. By doing so the Court adopted the approach of the Supreme Court in WM Morrison Supermarkets v Variou......
-
Judgment Handed Down In Ali v Luton Borough Council
...liability set out by the Supreme Court in Various Claimants v Morrisons Supermarkerts [2020] AC 989. In Ali v Luton Borough Council [2022] EWHC 132 (QB), an employee - RB - worked for the local authority's services department as a Contact Assessment Worker. Her role was to supervise and ass......
-
Judgment Handed Down In Ali v Luton Borough Council
...liability set out by the Supreme Court in Various Claimants v Morrisons Supermarkerts [2020] AC 989. In Ali v Luton Borough Council [2022] EWHC 132 (QB), an employee - RB - worked for the local authority's services department as a Contact Assessment Worker. Her role was to supervise and ass......