Judgments from the Scottish courts in relation to data protection cases are much rarer than they are from other jurisdictions in the United Kingdom, but last week a judgment, from April, was published in relation to an action raised in Lanark Sheriff Court against the Chief Constable of the Police Service of Scotland under sections 167 and 169 of the Data Protection Act 2018 and at common law. The pursuer (Mr Prentice) had raised proceedings against the defender (the Chief Constable) seeking:

• a declarator that the defender had failed to comply with her statutory obligations under section 45(1) and (2) [of the Data Protection Act 2018] to fully and properly respond to subject access requests made on 17 November 2021, 22 February 2022, 31 July 2023 and 11 September 2023.
• a compliance order under section 167 of the Data Protection Act 2018
• damages of £5,000 for damage and distress suffered as a result of the defender’s failure to respond to the pursuer’s subject access requests.

The judgment followed a debate at the instance of the defender who sought to argue that the pursuer’s case was bound to fail and that it should be dismissed. A debate focusses on the pleadings and an action will only be dismissed after debate in circumstances where the pursuer is bound to fail even if they prove all that they offer to prove; it is a relatively high bar to meet. There was mixed success with only the issue of a compliance order being allowed to proceed to proof (for those not familiar with Scots law, a hearing on the merits of the action at which parties lead evidence).

It is a useful case as it considers pleadings in data protection cases from a Scottish perspective where pleadings take on a specific and important role and about which there are many important rules.

Turning first to the issue of declarator, the Sheriff determined that the crave for declarator was incompetent. At paragraph [43] the Sheriff encapsulates the Scots law in relation to declarators, stating:

“As per MacPhail, at Chapter 20 and Walker at Chapter 8, a crave for declarator is one which seeks that a right be declared in favour of the pursuer, or that it declares non-existent what appears to be an existent right.  The pursuer must have an interest in the declarator sought, and the court will only grant a declarator in respect of a live, practical issue.  It is incompetent to bring an action to have a fact declared which has no legal consequences for the pursuer, or to seek a judicial opinion on an abstract question of law.  Similarly, to do so where the right is not challenged, or doubted (Walker at page 105, MacPhail 20.01, Scott v Kate Frame (ibid) paragraph 88).”

The Sheriff continued, at para [44]:

“Crave 1 of the application does not seek a declarator of the rights provided by section 45 of the 2018 Act.  What is sought amounts to a finding in fact and law that on specified dates the defender failed to comply with her obligations in terms of that section.  That is not a competent declarator. (…) As per Walker, MacPhail and Scott v Kate Frame the court should not make declarators of rights which are not doubted.  The existence of section 45 rights, their availability to the pursuer, and the concurrent obligations they impose on the defender are not challenged in this case.  What is challenged is the pursuer’s assertion that the defender failed to comply with her obligations.”

Here we have a clear expression from the Sheriff that seeking a declarator from a Scottish court that a controller has failed to comply with their statutory obligations under the Data Protection Act 2018 is incompetent. This is only a first instance decision that is not binding upon any other court in Scotland; however, this doesn’t seem to me to be a controversial position for the Sheriff to have arrived at. The function of a declarator is to declare that someone has a right or that a right that appears to exist does not, in fact, exist. There is, and must be, some practical effect to the pursuer seeking the declarator (such as establishing that they have a particular right or that a right that appears exercisable against them is not, in fact, exercisable against them).

A declarator that a data subject has a right to have their subject access request responded to by the controller would do nothing more than state what the law already clearly provides. Where a data subject has made a subject access request which has not been responded to by the controller (or where the data subject contests some or all of the exemptions applied by the controller when responding to the request), data protection law provides two remedies: firstly, a complaint to the Information Commissioner and secondly, an application to the court for a compliance order. A declarator would do nothing for the pursuer in that it would not, nor could it, force the controller to address any deficiency in their handling of the subject access request.

Turning to the pursuer’s third crave, which was for damages in the sum of £5,000. This was dismissed by the Sheriff on the grounds of a lack of specification. In Scots law, a party is entitled to know the case that they must meet and so sufficient facts must be pled by each party to give the opponent fair notice of their respective cases. At paragraph [53] of his judgment, the Sheriff sets out what was lacking in respect of the pursuer’s averments concerning his claim for damages. The Sheriff states:

“Section 169(5) of the Act defines damages available under the Act as including financial loss and damage not involving financial loss, such as distress.  Those heads of claim are identified in the averments but not in a way that provides fair notice.  The existence of distress, stress, anxiety, and frustration, are all averred, but no averments are provided as of how, or when, or where, they manifested themselves.  The financial loss (styled as “detriment” by the pursuer) is averred to be the instruction of solicitors, however the legal expenses incurred are not specified at all.  Neither do the averments as to the purported “disadvantage” suffered during the successful appeal against the revocation of the pursuer’s firearm license explain the loss suffered, if indeed this head of claim is available as per section 169(5) at all.”

It is of note that right at the very end of this paragraph, the Sheriff raises some doubt as to whether some of the “disadvantage” the pursuer had allegedly suffered was something that could be competently claimed in an action under section 169 of the Data Protection Act 2018. However, the Sheriff dismissed the pursuer’s third crave on the basis of a lack of specification, rather than on any question of the competency of the remedy sought. It would seem from the Sheriff’s judgment that despite the Record (the document which brings both parties pleadings together) running to 38 pages there was little in the way of specification in relation to the sum sought for damages. It seems that it was not clear how much of the £5,000 was attributable to financial loss and how much was attributable to non-financial damage such as distress. It also appears, from the terms of the Sheriff’s judgment, that there was nothing about how each head of claim had been calculated (see, for example, the reference to there not being specification of how much the legal fees referred to in the pursuer’s pleadings were).

The defender’s challenge to the averments supporting the second crave (for a compliance order under section 167) was not successful. The defender contended that the 17 November 2021 communication was not a subject access request. The Sheriff was directed to no authority which would enable the court to determine that issue at debate and took the view that the matter was one for proof [46]. More generally, the Sheriff took the view that the pursuer’s case that the exemptions were not properly applied was not bound to fail. At paragraph [51], the Sheriff stated that he “was persuaded that there was sufficient information and circumstances pled pertaining to the subject access requests to allow the court to consider finding in facts that the exemptions were not properly applied.” The Sheriff went on to state, at paragraph [51] that “crave 2 would not necessarily fail if all of the pursuer’s averments pertaining to it were proved.” That is, of course, not to say that the pursuer will surely succeed, only that he is not bound to fail.

In relation to the data protection case, the pursuer appears to have been unrepresented throughout and the Sheriff has addressed the issue of equal treatment at paragraphs [55] – [57] of his judgment under reference to the judgment of the UK Supreme Court in Barton v Wright Hassall LLP and the opinion of the Sheriff Appeal Court in Royal Bank of Scotland PLC v Aslam.

Overall, a rare and interesting data protection judgment emanating from Lanark Sheriff Court. The importance of properly framing pleadings in any civil case in Scotland, including data protection claims, cannot be understated. A poorly drafted data protection case can come unstuck at an early stage and result in a data subject being unable to even attempt to prove their case against the controller.

_{Disclaimer: This article is for information purposes only and nothing in it should be taken as constituting legal advice.}