Data protection vs. legal proceedings – which wins?

Data protection vs. legal proceedings – which wins?


In this case, the court considered whether the ordinary data protection rules were overridden by the legal proceedings exemption in the UK Data Protection Act.

The background to this case was a separate Employment Tribunal claim in which Mr Riley’s colleague was found to have been subjected to harassment and disability discrimination, largely at the hands of Mr Riley. Mr Riley was not involved in the Employment Tribunal claim, he was not a named Respondent, did not give evidence and was not asked to be a witness. He was therefore not happy when his name appeared multiple times in the judgment and was widely reported in the press.

Mr Riley’s claim

Mr Riley argued that the employer’s actions in processing his data breached its obligations under the GDPR, specifically that his data ought to be processed lawfully, fairly and transparently, and that it would only be used for specified, explicit and legitimate purposes (which he argued did not include for the purpose of engaging in litigation).

He sued for £75,000 for distress and anxiety and the impact on his employment prospects.

Mr Riley objected to the employer using his personal data during the course of litigation, and for a purpose he had not been told about. He was also unhappy that he had not been given the opportunity to provide a witness statement.

The employer’s defence

Mr Riley’s employer argued that since they were relying on the exemption that where processing is in connection with legal proceedings, the employer would not need to comply with these provisions of GDPR.

The question was therefore – does the legal proceedings exemptions override the need to comply with the ordinary data protection principles?

  • Yes. The employer’s right to conduct litigation as it sees fit and its right to have a fair trial overrides the GDPR protections.
  • If the employer was forced, against its will, to invite Mr Riley to comment on the allegations and to take a witness statement from him, this would have negatively affected its desired litigation strategy and this is why the exemption was introduced in the first place.
  • There would have been other ways for Mr Riley to deal with this (e.g. through an anonymity order).

This case is a helpful reminder for employers that they can rely on an exemption under the Data Protection Act when are conducting litigation.