Various Claimants v Independent Parliamentary Standards Authority

Hearing date: 16 July 2021

Approved Judgment

I direct that no official shorthand note shall be taken of this Judgment and that copies of this version as handed down may be treated as authentic.

THE HONOURABLE Mr Justice Nicklin

The principal question I have to resolve is whether the Claimants, who wish to bring a claim against the Defendant for misuse of private information, breach of confidence and breach of the Data Protection Act 1998, should be granted anonymity and permitted to issue the Claim Form withholding their names and addresses.

The Proposed Claim

There are, in total, some 216 Claimants. In March 2017, they were all employees, or former employees of MPs. The Defendant was created by the Parliamentary Standards Act 2009. In its capacity as the regulator of MPs' business costs and expenses and as the body responsible for paying the salaries of MPs' staff, the Defendant held and processed confidential and personal information relating to the Claimants.

The Claimants allege that, at about 5pm on 30 March 2017, a member of the Defendant's staff uploaded to the Defendant's website several spreadsheets which contained private, confidential, and personal information of each Claimant. It remained accessible on the website for just over 4 hours. The publication of this information is alleged to amount to misuse of private information, breach of confidence and breach of the Data Protection Act 1998, for which the Claimants intend to claim damages.

The Application for anonymity

The Claim Form has not yet been issued by the Claimants. Under the CPR, the default position is that a claimant who wishes to issue a civil claim must provide in the Claim Form his/her full name and the address at which s/he resides or carries on business: CPR 16.2(1)(d), PD7A §4.1( 3), PD16 §§2.2 and 2.6. A claimant can, nevertheless, make an application to the Court to dispense with this requirement, and the Court can make an order permitting him/her to be anonymised, typically by use of a three-letter cipher in place of his/her name in all statements of case and other court documents. Additionally, where the Court has directed that the name of the party should be withheld in the proceedings, the Court has power additionally to impose restrictions that prohibit the identification of the anonymised party: CPR 39.2(4) and s.11 Contempt of Court Act 1981.

On 1 July 2021, the Claimants filed an Application Notice seeking:

i) an order dispensing with the requirements that they be required to provide their names and addresses on the Claim Form;

ii) an order permitting them, instead, to issue the Claim Form using C0001-C0217 for the name of each Claimant and to provide their solicitors' address;

iii) an order under CPR 5.4C and 5.4D “sealing the Court file to prevent access to non-parties” and that the “entire Court file shall be marked as confidential”; and

iv) the imposition of reporting restrictions to prohibit identification of the Claimants.

The Claimants provided a draft of the order they sought and asked that the Application should be dealt with either on paper or at a hearing held in private. Although the Application Notice stated that it was made without notice to the Defendants, helpfully it was in fact served on the Defendant's solicitors on 2 July 2021.

The Claimants had previously notified the Defendants of their intention to apply for these orders, in a letter dated 15 June 2021, and asked the Defendant to consent to the proposed Application. The Defendant's solicitors replied on 22 June 2021:

“… We take the view that the application is poorly framed/evidenced and does not on its face set out a coherent basis for departing from the open justice principle, or certainly not to the very wide extent suggested in your evidence and draft order.

Nonetheless, … our client is content to adopt a neutral position on the anonymity provisions in the draft order…

However, we are not remotely satisfied (and nor in our view would a court be) that the remainder of the provisions in your draft order can be regarded as justified in all the circumstances. Quite the contrary, it seems to us that your draft witness statement does not begin to justify the extensively withholding approach on the issue of access to documents on the court file.”

The Defendant's solicitors referred to several authorities emphasising the importance that derogations from open justice can be justified only in exceptional circumstances and when they are strictly necessary as measures to secure the proper administration of justice.

The Application Notice was supported by a “confidential” witness statement from the Claimants' solicitor, Nick McAleenan, dated 30 June 2021. Mr McAleenan provided a copy of draft Particulars of Claim. The draft Particulars of Claim identify the following categories of “ private, confidential and personal data” which it is alleged was wrongfully published by the Defendant on 30 March 2017: (1) name; (2) salary; (3) rewards; (4) working patterns; (5) holiday entitlements; (6) payroll number; (7) salary band; (8) employment start date; (9) whether s/he had an “IPSA contract”; (10) number of hours worked per week; (11) if s/he worked part time, what the full-time hours equivalent would be; (12) working pattern in terms of days worked; (13) employment status (i.e. whether s/he was a past or present employee); (14) the MP for whom s/he worked; (15) job title; and (16) job start date. The Particulars of Claim do not include information relating to any Claimant in these categories. The Particulars of Claim contain the following contention about loss and damage:

“In consequence of the said disclosures of each Claimant's private, confidential and personal information and data and processing and breaches of the 1998 Act and [the First and Second Data Protection Principles] each Claimant has suffered considerable distress, anxiety and upset, damage and a loss of control over his or her private, confidential and personal information and data. Accordingly, each Claimant is entitled to compensation in respect of the resulting effects on him or her of:

(1) Anger, distress, anxiety and upset at his or her loss of privacy and confidentiality in personal information and data and his or her loss of control over the same;

(2) Concerns for his or her personal safety and that of family members;

(3) Concern over possible damage to future career prospects;

(4) Concerns at his or her exposure to fraud and financial loss;

(5) Worry and embarrassment over the disclosure of private, confidential and personal information and data to colleagues, others working for MPs and in the media generally;

(6) Concerns in particular about the loss of control of private, confidential and personal information and data relating to:

a. Employment and employment conditions;

b. Personal finances including salary and rewards.”

The draft Particulars of Claim state that “illustrative summaries” of the harm alleged to have been suffered by five Claimants would be provided separately in Confidential Schedules. Copies of these “illustrative summaries” were not included in the exhibit to Mr McAleenan's witness statement.

Mr McAleenan summarised the Defendant's position in response to the Claimants' claim, as stated in pre-action correspondence. The Defendant denied liability but contended that, even if the Claimants could establish liability, the breaches were “technical contraventions” that would not lead to the award of any substantial damages because the Claimants had suffered no damage.

As to the basis of the application to anonymise the Claimants, Mr McAleenan stated:

“It is respectfully understood that there is no requirement, under s.12(2) [Human Rights Act] 1998 or Rule 23 of the CPR, to give notice to anyone else of this application. The claim engages the data protection rights and privacy rights of private individuals who happen to work for MPs and where their information would not otherwise enter the public domain. It is respectfully submitted that it does not engage any wider public interest arguments, nor that the balance of any such arguments would require that to enforce their data protection and privacy rights those individuals are required to be named and the information again made available to third parties to access. The disclosure of the proposed Claimants' identity would, it is respectfully submitted, undermine the purpose of the claim which is to protect the proposed Claimants' personal and private information and personal data, and to seek remedies for them arising from the loss of control and infringement of their data privacy rights. Their information has been exposed and identification of them would place them at further risk of suffering additional harm.”

As to justification for the anonymisation order sought, he stated:

“The proposed Claimants' claims concern the misuse of private and confidential information. The proposed Claimants are, or were at the material time, all employees of MPs. If their names or addresses were to be placed into the public domain, this may create a personal safety risk and expose them to the risk of harm. The purpose of...