Case Summary and Outcome

The High Court of England and Wales refused a student’s application to re-open his case against Loughborough University for allegedly disclosing his personal data to the police in breach of contract and the Data Protection Act 1998. Bangura, a student at the university who had been accused and later exonerated of allegations of sexual assault and rape, argued that the university had breached the Data Protection Act by disclosing his personal details to the police without his consent. The Court held that the university’s disclosure fell within an exemption under the Data Protection Act for the processing of personal data for the purpose of the prevention or detection of a crime or the apprehension or prosecution of a criminal offender. Furthermore, it found that the university’s data protection policy had not created a contractual obligation on the university that could be enforced by Bangura.

Facts

In March and April 2010, there were a number of reports of sexual assault against male and female students at Loughborough University. In May 2010, an informant told the university’s security staff that they suspected that Bangura, a student at the time, was connected with these sexual assaults. The security staff subsequently called the Leicestershire police. The informant, who was not an employee or officer of the university, disclosed Bangura’s name and his address in Loughborough to the police. The security staff then provided the police with a copy of the details contained in Bangura’s university registration form; which included his full name, date of birth, address, and his photograph. This information was provided prior to a formal written request from the police, and without Bangura’s consent.

After being exonerated of any sexual assault allegations, Bangura filed a claim to the High Court against the university, the Leicestershire Police, and the university’s student’s union. In his claim against Loughborough University, Bangura alleged that the school had violated the Data Protection Act 1998 by disclosing his personal information without his prior consent. He further submitted that the release of his information in advance of a formal written request by the police was contrary to the university’s own data protection policy, which he alleged was a contractual document between him and the university.

Bangura’s claim against the university was dismissed by a summary judgment in favor of the university, finding that the claim against the university was wholly without merit. Subsequently, the High Court refused an application from Bangura requesting permission to appeal the summary judgment. Bangura then filed an application before the High Court requesting permission to re-open his application for permission to appeal the summary judgment.

Decision Overview

Bangura argued that he was entitled to relief against Loughborough University for breach of the Data Protection Act 1998, breach of contract, breach of trust and possibly for conspiracy. The university, on the other hand, submitted to the Court that there was no breach of the Data Protection Act or contract in this case, even where the details had been provided by the university in advance of a written request from the police.

Justice Nicol held that section 29 of the Data Protection Act clearly provides an exemption to the principle that data must be “handled fairly and lawfully”. This exemption applied where data is sought by police for the purpose of the prevention or detection of a crime or the apprehension or prosecution of a criminal offender. Furthermore, section 29 does not stipulate that the request for disclosure of personal data must be in writing. Nonetheless, even where the exemption applies, the processing needs to meet at least one of the conditions set out under the Data Protection Act. Justice Nicol observed that the university’s disclosure fell within the exemption and met one of the conditions because the disclosure was necessary for the purpose of a legitimate interest pursued by the police and the disclosure was not unwarranted by reason of prejudice to the rights, freedoms or legitimate interest of Bangura (Condition 6.1, Schedule 2 of the Data Protection Act). Justice Nicol highlighted in particular that the disclosure of Bangura’s personal data by the university came at the time when police were actively investigating a number of sexual assault incidents that were of great concern to the university community, and the university was assisting the police through the investigation.

Justice Nicol went on to find that the university’s data protection policy had not created a contractual obligation because the school registration document signed by Bangura did not incorporate the policy, and the policy itself did not purport to be incorporated into the registration document. Instead, it was a non-contractual policy that articulated what the policy was that the university expected to adopt in relation to data processing. Even though the policy stated that the university would only release personal information to the police where there was a written request to do so, Justice Nicol reasoned that “it is inconceivable that the drafter of the policy would have intended that the university should be precluded from providing such information if the circumstances of the situation precluded a written request in advance.” [par. 36]

Justice Nicol also accepted that the university’s disclosure did not cause the loss claimed by Bangura, namely his arrest. This was because his arrest at his Loughborough home would have occurred regardless of whether the university disclosed that address to the police, because the informant had provided the address to the police independently.

Based on the foregoing reasons, the High Court dismissed Bangura’s application to reopen his request to appeal the summary judgment of his data protection claim against the university.