Scottish Court of Session Decisions

You are here: BAILII >> Databases >> Scottish Court of Session Decisions >> ROBERT BARTOSIK FOR ORDERS UNDER SECTIONS 167 AND 169 OF THE DATA PROTECTION ACT 2018 [2022] ScotCS CSOH_55 (16 August 2022)
URL: http://www.bailii.org/scot/cases/ScotCS/2022/2022_CSOH_55.html
Cite as: [2022] CSOH 55, [2022] ScotCS CSOH_55

[New search] [Printable PDF version] [Help]

OUTER HOUSE, COURT OF SESSION

[2022] CSOH 55

P578/21

OPINION OF LORD CLARK

In the petition of

ROBERT BARTOSIK

Petitioner

for orders under sections 167 and 169 of the Data Protection Act 2018

Petitioner: Party Litigant

Respondent Fraser, Ledingham Chalmers LLP

16 August 2022

Introduction

[1]

The petitioner seeks orders under the Data Protection Act 2018 ("the 2018 Act") for

erasure of personal data retained by the respondent (Police Scotland) and compensation for

distress caused by the failure, thus far, to erase it. The respondent contends that the data

should not be erased and that there is no right to compensation.

[2]

The background is set out more fully below. By way of overview, it can be

summarised as follows. The petitioner reported alleged crimes to the police. There was no

response and so he complained about the matter not having been taken forward. His

complaint was investigated. Part of that investigation involved taking a statement from a

person who worked in the police office. Her statement included information about his

report of the alleged crimes and it also included other information about him which was of

no direct relevance to the investigation. He received a letter which referred to her statement,

including the other information, and which acknowledged that the police had not properly

responded to his report of the alleged crimes. The petitioner was concerned about the other

information, which was inaccurate. He requested that it be erased. It was later confirmed to

be inaccurate. Accordingly, the request for erasure is in respect of certain information given

in a letter from the respondent dealing with the petitioner's complaint about failure by the

police to investigate alleged crimes reported by him. The respondent has refused to erase it

on the ground that a record of the information must be maintained for a period of time,

albeit for restricted purposes.

Background

[3]

The petitioner is a taxi driver. On 5 May 2020 he went to Gorbals Police Office in

Glasgow and handed in a "Victim Statement" prepared by him, which reported and sought

investigation of eight instances in which individuals had, after taxi journeys, allegedly made

off without paying him ("taxi frauds"). On 13 July 2020 the petitioner submitted a

complaint to Police Scotland, stating that they had failed to record and investigate the taxi

frauds and had not responded to his report. An investigation into his complaint, which was

given the reference CO/01933/20, was carried out. Chief Inspector MacIntyre was appointed

to investigate. As part of that investigation a statement was obtained from a Public Enquiry

Support Assistant ("PESA") at Gorbals Police Office.

[4]

Chief Inspector MacIntyre wrote to the petitioner on 16 December 2020. Broadly

speaking, the content of the letter was to set out the petitioner's complaint, then to set out

what the PESA had said in her statement and then to give the Chief Inspector's decision on

the complaint. The reference in the letter to the statement of the PESA included things said

by her about the petitioner which had no direct bearing on the complaint made by the

petitioner about the taxi frauds. It is this part of the letter, which I shall refer to as "the

challenged information", that has given rise to this petition. I do not regard it as necessary

or appropriate to set out in full the challenged information. It suffices to say that in the

challenged information the PESA referred to seeing the petitioner, on a police CCTV camera,

standing outside the police office for some time, she went out to see him and he made

certain comments about his partner and custody of his child. The letter from the Chief

Inspector went on to set out further parts of the statement of the PESA, about the taxi frauds,

not challenged in this petition. The letter then stated that the petitioner's complaint about

failure to investigate the taxi frauds reported by him was upheld and it gave an apology to

him.

[5]

The petitioner replied on 29 December 2020, seeking erasure of the challenged

information in the letter. By letter dated 6 January 2021, Chief Inspector MacIntyre advised

the petitioner about the means of making a formal request to have the data erased. That

letter also contained the challenged information. On 24 March 2021 the petitioner sent his

formal request to the respondent. He sought erasure under the 2018 Act of the challenged

information on the basis that he had not entered Gorbals Police Office on that occasion or

shared information with the PESA.

[6]

The respondent says that its Information Assurance Officer sent a letter dated 1 April

2021, by email, to the petitioner, stating that his request was refused. The grounds for

refusal, set out in the letter, included that the statement of the PESA was processed for the

purposes of law enforcement. Further, it formed part of the official record of the petitioner's

complaint against the police and had accordingly been archived. In terms of the Police

Scotland Record Retention Standard Operating Procedure the statement would not qualify

for weeding out until January 2026.

[7]

The petitioner states that he did not receive the email dated 1 April 2021, attaching

the letter, and so was not made aware of the refusal of his request for erasure. The petition

was lodged on 29 July 2021. The petitioner described the challenged information in the

PESA's statement as fake and in particular that he did not have an ex-partner or a child. The

petitioner seeks an order for erasure of the challenged information from the respondent's

record. It was, the petitioner claims, only on 6 October 2021, when the respondent lodged

the letter of 1 April 2021 in process, that he was made aware of that letter.

[8]

At a by-order hearing on 20 January 2022, the court was advised by counsel for the

respondent that another statement had been taken from the PESA. The PESA stated that she

now believes that she mistook the petitioner for another man and that in fact she has never

actually met the petitioner. By letter dated 27 January 2022, the respondent' solicitors

explained to the petitioner that the respondent would make a decision as to how to deal

with the erasure request in light of this new information. On 15 February 2022, the

Information Assurance Officer of the respondent wrote to the petitioner, by email, stating

that the PESA's further statement corroborated the petitioner's position that the challenged

information was incorrect. The letter then explained that the data would not be erased but

would be restricted in its use. It refers to the petitioner's complaint against the police in July

2020 as a "CAP" and states:

"The new PESA statement provides information which may affect the outcome of the

CAP resolution and, accordingly, this has been presented to Professional Standards

Department (West) for them to determine whether or not the CAP should be subject

to re-investigation.

The statement you requested be deleted forms part of the official record of CAP

CO/01933/20, as will the new statement received from the PESA.

However, the original (incorrect statement) is now of only very specific worth

(should the CAP be re-investigated, for example) and meets the criteria for personal

information which should be subject to restrictions in processing detailed in DPA

2018 s47 (2). Accordingly, the original PESA statement, dated 14 December 2020, will

be subject to restrictions in processing, meaning that it can only be used as evidence

in the re-investigation of CAP/01933/20 (should that be implemented).

I have applied the guidance within the Record Retention SOP (Section PST-001,

Pg 117), which states that records of this type are subject to retention for the current

year, plus six years, whereupon the records will be destroyed. Accordingly, this

record, including the statements made by the PESA, will not qualify for weeding

from the PSD (West) archive until January 2026 at the earliest. It should be noted

that reinvestigation of the CAP will re-open the case file and move this date into the

future.

Accordingly, your request for deletion of the PESA statement dated 14 December

2020 is denied.

Examination of the guidance in respect of the criteria for the application of

alternative retention and/or weeding rules indicates that no other rules apply..."

[9]

At a continued by-order hearing on 24 February 2022, the petitioner advised that he

had not received the email with this letter attached. He was then given a copy of the letter.

Adjustments were made to the petition and answers and a substantive hearing was fixed.

Relevant provisions of the Data Protection Act 2018

[10]

The key sections of the 2018 Act for present purposes are:

"37

The third data protection principle

The third data protection principle is that personal data processed for any of the law

enforcement purposes must be adequate, relevant and not excessive in relation to the

purpose for which it is processed.

The fourth data protection principle

(1)

The fourth data protection principle is that--

(a) personal data processed for any of the law enforcement purposes must be

accurate and, where necessary, kept up to date, and

(b) every reasonable step must be taken to ensure that personal data that is

inaccurate, having regard to the law enforcement purpose for which it is

processed, is erased or rectified without delay.

(2) In processing personal data for any of the law enforcement purposes, personal

data based on facts must, so far as possible, be distinguished from personal data

based on personal assessments.

...

(4)

All reasonable steps must be taken to ensure that personal data which is

inaccurate, incomplete or no longer up to date is not transmitted or made available

for any of the law enforcement purposes.

..."

Submissions

Submissions for the petitioner

[11]

The email allegedly sent on 1 April 2021, attaching the letter of that date, had not

been received. As the respondent did not reply to the pursuer's request for erasure within

one month, as required by sections 48(2)(b) and 54(2) of the 2018 Act, those provisions were

breached. In any event, the decision to refuse the request for erasure, in that letter, was in

breach of sections 37 and 38 of the 2018 Act as the data was not adequate, accurate and

relevant to the petitioner. The information did not concern his person. It interfered with his

private life. If disclosed to someone it could, for example, result in an employer saying he

did not trust the petitioner any more. There was no reason why the fake information must

be kept. That decision should be revoked.

[12]

In relation to the decision in the letter dated 15 February 2022, the 2018 Act did not

allow the data controller to review the earlier decision of 1 April 2021 and so that second

decision was invalid. It was also reached well beyond the one month period. If the second

decision dated 15 February 2022 was held to be valid then the decision dated of 1 April 2022

was invalid and should be revoked in terms of section 167 of the 2018 Act. The part of the

statement of the PESA that he complained about did not concern his complaint regarding

taxi fraud and there was no reason to keep it. It concerned another person.

[13]

In terms of section 169 of the 2018 Act, an award of compensation should be granted

because the petitioner has suffered "distress" as the data controller had taken much longer

than the one month period allowed to deal with the request for data erasure and had refused

the request.

Submissions for the respondent

[14]

The petition should be dismissed. The witness statement of the PESA forms part of

the record of the respondent's complaint against the respondent. It is evidence of the way in

which the complaint was dealt with. As such it should not be deleted. Its retention protects

the rights of the petitioner. Witness statements are by their nature subjective and are not

subject to the requirement of accuracy contained in section 38 of the 2018 Act. In terms of

section 38(1)(a) personal data requires to be kept up to date where "necessary". In terms of

section 38(1)(b) every "reasonable" step must be taken to ensure that personal data, which is

inaccurate, having regard to the law enforcement purpose for which it is processed, is erased

or rectified without delay. If the statement is personal data; it would not be necessary to

keep it up to date in the way it would be necessary to keep, for example, a credit file up to

date.

[15]

Further it would not be reasonable to expect the respondent to investigate the

content of statements. The respondent has already restricted the use which can be made of

the statement and no order should be made under section 167. There having been no breach

of the petitioner's data protection rights, the petitioner should not be awarded damages. If

there was any breach, any harm caused was de minimis. The content of the statement was

innocuous and no prejudice flowed from it. The letter of 1 April 2021 was sent by email to

the petitioner. The email address it was sent to was the email address he had used when

contacting the respondent. There was nothing to suggest that the email did not reach him

and there were no further emails from him asking for a response.

Response for the petitioner

[16]

There was no clear basis for describing the statement as a witness statement. It was

not, for example, a signed affidavit. It was not referred to in the letter of 6 January 2021 as

being a witness statement. It was simply inaccurate information which should be erased. It

was a lie. He had suffered distress, had special treatment for insomnia and had difficulties

preparing for the hearing.

Decision and reasons

Preliminary points

[17]

The petitioner founds his claim for erasure upon provisions in Part 3 of the 2018 Act.

Part 3 deals with processing of data for "law enforcement purposes", defined thus in

section 31:

"the purposes of the prevention, investigation, detection or prosecution of criminal

offences or the execution of criminal penalties, including the safeguarding against

and the prevention of threats to public security."

The decisions issued by the respondent to refuse his requests for erasure were expressly

founded upon the data being processed for law enforcement purposes, under Part 3.

Accordingly, each party proceeds upon the basis that the processing of data in the

investigation of a complaint to the police about failing to record and investigate an alleged

criminal offence falls within the definition of law enforcement purposes. The arguments for

each side having been presented solely on that basis, I will not embark upon an analysis of

whether that approach is correct.

[18]

Section 48(1)(b) of the 2018 Act required the respondent to "inform the [petitioner] in

writing" that his request had been refused. Section 54(2) gives the period of one month for

that to be done. Parties did not refer to any of the authorities dealing with, for example,

presumptions about receipt of a letter posted to the correct address. In any event, the

present issue concerns the sending of an email. In his complaint submitted to the

respondent on 13 July 2020, the same email addresses for home and work were stated by

him. He also said "Please contact me via email only please". His formal complaint on

24 March 2021 was sent from that same email address. In the section of the form dealing

with "Contact details", he inserted that email address. The letter dated 1 April 2021 (eight

days after his formal complaint) refers to it being sent by email and states the email address

used and referred to by the petitioner. The email itself was not produced but counsel for the

respondent advised the court that she had seen the email and it was indeed to that same

address. The petitioner's position, recorded in an email sent to the respondent' solicitors on

24 February 2022, is that he had changed his email address at some point in 2021 because his

previous email account had been hacked. He notified Information Assurance on

10 September 2021 that the only email address for service was his new email address or

postal address.

[19]

I conclude that the email sent on 1 April 2021 attaching the letter refusing the

petitioner's request for erasure was sent to the email address he had used eight days before

and that he stated should be the means of informing him. If the position is that in that eight

day period he changed his email address, there is no suggestion that he told the respondent

he had done so during that time. Indeed, the only evidence is that it was several months

later that he told them. Nor was there any suggestion that the email, had, as it were,

bounced back to the respondent as undelivered. In all of these circumstances, I am satisfied

that sending an email to the petitioner's email address, stipulated by him as the means by

which he was to be contacted, complied with the statutory requirement to inform him. I

therefore reject the petitioner's contention that there was a breach of sections 48(1)(b) and

54(2).

The decision in the letter of 1 April 2021

[20]

The petitioner's formal request for erasure was made on 24 March 2021. The

respondent was correct to refuse that request. While the court was not given a copy of the

"witness statement" from the PESA, I do not consider that the formality of that document is

of any substance for present purposes. There is clear evidence that she gave a statement,

recorded in the letters sent by the respondent. Section 38(2) of the 2018 Act, noted above,

refers to the need to distinguish, so far as possible, personal data based on facts from

personal data based on personal assessments. The wording of the statute does not explain in

any real detail the effect of making that distinction, but assistance can be found in paragraph

187 of the explanatory notes issued in relation to the 2018 Act:

"Section 38: The fourth data protection principle

187

The fourth principle (section 38) requires personal data held by a controller to

be accurate and kept up to date. In the law enforcement context, the principle of

accuracy of data must take account of the circumstances in which data is being

processed. It is accepted that, for example, statements by victims and witnesses

containing personal data will be based on the subjective perceptions of the person

making the statement. Such statements are not always verifiable and are subject to

challenge during the legal process. In such cases, the requirement for accuracy

would not apply to the content of the statement but to the fact that a specific

statement has been made. Section 38(2) recognises the distinction between personal

data based on facts (for example, the details relating to an individual's conviction for

an offence) and data based on personal assessments, such as a witness statement.

The requirement to keep personal data up to date must also be viewed in this

context. If an individual's conviction is overturned on appeal, police records must be

amended to reflect that fact. However, this principle would not require the

retrospective alteration of a witness statement which the appellate court found to be

unreliable."

[21]

In R (on the application of O (a minor, by her litigation friend AO)) v SSHD [2022] UKSC 3

Lord Hodge (with whom Lord Briggs, Lord Stephens and Lady Rose agreed) held (at [29]

and [30]) that the court is seeking the meaning of the words Parliament used, viewed in

context and that external aids to interpretation therefore must play a secondary role.

Lord Hodge stated that while explanatory notes, prepared under the authority of

Parliament, may cast light on the meaning of particular statutory provisions none of these

external aids displace the meanings conveyed by the words of a statute. Here, the

explanatory notes do not displace the meaning and indeed they make the rather obvious

point that the police should not erase or rectify the content of inaccurate witness statements

used for law enforcement purposes. This is supported by the Guide to Law Enforcement

Processing issued by the Information Commissioner in January 2021. In the chapter dealing

with Categorisation of Individuals, it explains that the duty to distinguish under

section 38(2) results in the requirement for accuracy not applying to the actual content of the

statement but simply that a specific statement has been made. The police will not

retrospectively alter a witness statement even if the court has found it to be unreliable.

Accordingly, as the challenged information formed part of statement by a witness there is no

basis for the petitioner's contention that it required to be erased because it was inaccurate.

The decision was also based upon the information available at that time which did not

include that the challenged information from the PESA's statement was accepted as

inaccurate.

[22]

However, if that conclusion is incorrect, either because the PESA's comments should

not be viewed as being in a witness statement, or that the requirement for accuracy of the

data should nonetheless be applied, the data still required to be maintained for the purposes

of evidence in relation to the petitioner's complaint about the investigation of taxi frauds. It

is open to argument that in those circumstances processing of the data would require to

have been restricted (sections 46(4) and 47(2) of the 2018 Act). This is, however, academic

for present purposes. The petitioner does not base his case on a failure to restrict processing.

The decision in the letter dated 15 February 2022

[23]

On 15 February 2022, many months after the petition was raised, the respondent

decided to restrict the processing of the information because they had now been told that the

relevant passage in the statement of the PESA was incorrect. The petitioner contends that

they had no right to "review" the earlier decision. I see no force in that submission. New

data about the petitioner, to the effect that earlier comments about him were incorrect, had

been obtained. A decision had to be reached about that and its effect on the earlier data.

Doing nothing about it would make no sense. Section 46(1) deals with rectifying inaccurate

personal data and section 47(1) deals with erasing or restricting data where it would infringe

particular provisions in the Act. It was necessary under these provisions for the matter to be

re-considered.

[24]

However, even if there was a duty to rectify or erase the data complained about by

the petitioner, where the data must be maintained for the purposes of evidence the

controller must restrict its processing (sections 46(4) and 47(2)). The duty requires this to be

done "without undue delay". On the information available to the court, there was no undue

delay in restricting the processing of the data, as that decision was reached shortly after the

further information from the PESA was made available. It took some time to identify the

specific PESA who had made the statement and to raise the issue of accuracy with her.

[25]

For the reasons given, the decision of 15 February 2022 did not breach any of the

provisions in the legislation.

[26]

In passing, I note that the new statement from the PESA was placed before the

Professional Standards Department of Police Scotland. The reason for doing so is its

relevance to the investigation into the petitioner's complaint about his report of taxi frauds

not being taken forward, reference CO/01933/20. It was explained by counsel for the

respondent in submissions that Professional Standards do not intend to review complaint

CO/01933/20 as the misunderstanding of the PESA did not alter the investigation process or,

outcome. Further, no disciplinary proceedings have been taken against the PESA.

Nonetheless, the data, in its restricted processing, forms part of the true official record of

how the petitioner's complaint against the police was handled and determined. Deleting it

would affect the record. The data will come to be removed in due course, as explained in

the letter dated 15 February 2022.

Compensation under section 169

[27]

As a result of the decisions I have reached, no right to compensation under

section 169 arises. If there had been such a right, I would have had some difficulty in

concluding that the sum sought (£10,000) was a fair and reasonable amount of

compensation. The part of the PESA's statement that is incorrect (the challenged

information) contains no particular negative connotations about the petitioner and indeed is

innocuous. It is hard to see why it would cause distress to the petitioner. He relied upon

the possibility of it being disclosed to, for example, an employer but given the restrictions on

processing that cannot occur and indeed it is difficult to see if it ever could have occurred.

The data can now be viewed only in relation to the complaint against the police. Moreover,

it is not possible to see how someone could draw, as the petitioner suggests, some

conclusion about lack of trust in the petitioner from the data. However, if I had found in his

favour about breaches I would have given consideration to continuing the case to allow

evidence to be provided about his distress.

Conclusion

[28]

It is perhaps worth observing that the petitioner achieved a somewhat limited degree

of success by bringing this petition in that, as a consequence, the respondent's decision of

1 April 2021 was reviewed after obtaining a further statement from the PESA and on

15 February 2022 the processing of the petitioner's personal data was restricted. However,

his claims are for erasure and compensation and those have not succeeded.

Disposal

[29]

I shall sustain the fourth and fifth pleas-in-law for the respondent and refuse the

petition, reserving in the meantime all questions of expenses.