The High Court in Bangura v Loughborough University
 EWHC 1503 (QB) ruled 19 May that Loughborough University
acted lawfully under the Data Protection Act 1998 ("DPA")
in supplying Leicestershire Police with the registration form of a
student suspected of sexual assault and rape. In contravention of
the university's data protection policy, the registration form
was supplied to Leicestershire Police before a written request for
the form was received.
The claimant, Mr Bangura (who had been a student at the
university), appealed an earlier summary judgment against him,
arguing that the university's disclosure of his personal data
to the police – prior to receiving a written request –
was an action which contravened its data protection policy. The
claimant asserted that the policy formed part of his contract with
the university, and sought permission to re-open his
application for permission to appeal against an earlier order, and
various other relief.
The court refused the application on the basis that it had no
realistic prospect of success. Specifically:
The claim under the DPA was rejected
on the basis that Section 29 does not state that a request for
information must be made in writing, and that the test for
legitimate interests had been met.
Section 29(3) permits a data
controller to disclose personal data without an individual's
knowledge or consent (an exemption from Principle 1 of the DPA),
where the disclosure is for the prevention or detection of crime,
or the apprehension or prosecution of offenders.
The disclosure of the claimant's
registration form was not a breach of contract, as the policy was
not incorporated into the contract between the claimant and the
university by either the policy itself, or the registration
The Information Commissioner's Office provides guidance in
both its data sharing code of practice and its checklist for data sharing, for organisations
that disclose personal data. Organisations are advised to: (i)
consider whether the sharing would be justified; (ii) consider
whether it has the power to share; and (ii) record the decision to
share. Organisations could avoid the administrative burden of court
proceedings by including express wording in their data protection
policies specifying the extent to which the policy has contractual
force, and the potential of disclosure for criminal, fraudulent or
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
In light of the much anticipated ICO draft GDPR (the General Data Protection Regulation) Consent Guidance being published yesterday, 2 March 2017, we will be running a mini-series on the guidelines under consultation and the impact the GDPR will have on the much vexed position of consent and the impact on your business.
The first of our four discussions on the ICO guidelines for Consent will focus on the meaning of consent under the GDPR (General Data Protection Regulation) and how this change enhances the previous law on consent to data processing.
The fourth and final part of our mini-series on the draft ICO guidance on Consent, published on 2 March 2017, focuses on the practical impact the GDPR (General Data Protection Regulation) will have on how your organisation records and manages consent.
A fundamental aspect of all fair and lawful processing of personal data under the current data protection rules is the requirement for the party who is the data controller to meet one or more conditions ("the conditions for processing").
The second in our mini-series on the ICO guidance on Consent, published on 2 March 2017, focuses on how the changes to be introduced by the GDPR (General Data Protection Regulation) will impact upon your business and what you can do to pre-empt the changes before their introduction in May 2018.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).