Hi everyone. A reminder that the ASA are still dealing with complaints about marketing. This time Burger King was one brand on their radar.
Burger King ‘plant-based’ Whopper ads banned
Verbal disclosure of sensitive personal data is not “processing” under DPA98
In a recent High Court case, involving in part a claim under the DPA98, a charity was found not to have been in breach when they disclosed sensitive personal data to the claimant’s GP by phone as they were concerned for his welfare.
Mr Scott sought damages for a breach of DPA98 from the LGBT Foundation for providing information about his mental state to his GP surgery in a phone call following discussions with Mr Scott during his visit to the charity in July 2016. Mr Scott claimed that this “processing” had taken placed without his consent.
The court considered whether the information disclosed satisfied the definition of “data” under section 1 of the Act. Mr Justice Saini found that, under the Act it was clear that personal data needs to be recorded, either manually or electronically to be “data” for the purposes of the Act, and therefore a verbal disclosure does not constitute processing of personal data.
Mr Justice Saini confirmed that he Act was concerned with records and processing; the nature of processing/recording of information, and therefore an oral disclosure was not prohibited.
The charity had further submitted as part of their defence that if this was “processing” then the disclosure was lawful as the processing was necessary to protect Mr Scott’s vital interests under condition 4 of Schedule 2, and condition 3 of Schedule 3 as this was sensitive personal data, a position that Mr Justice Saini agreed with, striking out the claim on both grounds.
Although this was decided on the law in force in July 2016, it is interesting to see how the definition of ”data” and “processing” changed with the introduction of the GDPR/DPA18. There is no specific definition of “data” in isolation, just “personal data”, and “processing” is much wider and not just focused on the nature of the processing/recording of the data. If the case was decided based on GDPR/ DPA18, this would be “processing” of personal data. However the lawful bases available for processing special category data under current legislation includes vital interests, so the outcome is likely to be the same.