High Court Permits University's Contravention Of Its Own Privacy Policy

The High Court in Bangura v Loughborough University [2016] EWHC 1503 (QB) ruled 19 May that Loughborough University acted lawfully under the Data Protection Act 1998 ("DPA") in supplying Leicestershire Police with the registration form of a student suspected of sexual assault and rape. In contravention of the university's data protection policy, the registration form was supplied to Leicestershire Police before a written request for the form was received.

The claimant, Mr Bangura (who had been a student at the university), appealed an earlier summary judgment against him, arguing that the university's disclosure of his personal data to the police - prior to receiving a written request - was an action which contravened its data protection policy. The claimant asserted that the policy formed part of his contract with the university, and sought permission to re-open his application for permission to appeal against an earlier order, and various other relief.

The court refused the application on the basis that it had no realistic prospect of success. Specifically:

The claim under the DPA was rejected on the basis that Section 29 does not state that a request for information must be made in writing, and that the test for legitimate interests had been met. Section 29(3) permits a data controller to disclose personal data without an individual's knowledge or consent (an exemption from Principle 1 of the DPA), where the disclosure is for the prevention or detection...