 |
| Southbank Marina |
Sheriff Appeal Court Civil (Appeal Sheriff O'Carroll) East Dunbartonshire Council v Paton [2026] SAC (Civ) 17 (4 March 2026)
This was an appeal by East Dumbartonshire Council against an award of compensation under art 82 (1) UK GDPR to the father of a child for damage incurred as a result of the council's delay in rectifying a risk assessment form. The local authority did not dispute that it had caused damage by the delay for which it had to pay compensation. Nor did it dispute the amount of compensation. The only issue in the appeal was whether the compensation had been paid to the right person.
Background
The child had been a pupil at a school maintained by the appellant council where she suffered bullying. Her father complained to the head teacher, who prepared a draft form assessing the risk to the child's physical safety as "medium" and the risk to her emotional well-being as "high". The school sent the draft to the child's father for his consideration.
The school introduced control measures which led it to reduce its assessment of the risk to the child's physical safety as "low" and her emotional well-being as "medium". The girl's father accepted that the measures had reduced the risks to his daughter but expressed concern that the risk to her well-being remained "medium". He sought further advice from the school on reducing the risk to his child's well-being which the school provided the same day.
Despite the control measures, further difficulties arose which prompted the father to complain to the school. The school rejected most of his complaints, whereupon the father resorted to the Scottish Public Services Ombudsman. The ombudsman requested a risk assessment from the council. Instead of sending the draft that had been shown to the child's father, the authority prepared a modified form showing the risk to her emotional well-being as "low".
Claim for Rectification
After seeing the modified form, the father asked the local authority to amend the risk assessment to his daughter's well-being. The council admitted that its risk assessment had been wrong but refused to modify it. The father issued proceedings in the Sheriff's Court claiming rectification of the assessment form under art 16 GDPR and compensation for damage resulting from the council's delay in rectifying the form under art 82 (1). The council admitted that the modified assessment form was incorrect and that it should be rectified, but contended that the data belonged to the child rather than her father and that, for that reason, the claim should fail.
The Sheriff's Decision
The Sheriff found in favour of the father and awarded him compensation under art 82 (1). He held that the information on the form was the father's personal data. He found that it was incorrect and should be rectified. He also found that the father had sustained damage as a result of the council's delay in rectifying the record. In reaching his decision, the Sheriff relied on the judgments of the Court of Justice of the European Union in Case C-434/16 Nowak v Data Protection Commissioner [2017] EUECJ C-434/16, [2018] WLR 3505, [2018] 1 WLR 3505, EU: C:2017:994, [2018] 2 CMLR 21, ECLI:EU:C:2017:994, [2018] WLR(D) 8 and Mrs Justice Heather Williams in Ashley v Commissioners for His Majesty's Revenue and Customs [2025] EWHC 134 (KB).
The Appeal
The Council appealed to the Sheriff Appeal Court on the ground that the data relating to the child's risk assessment belonged to her and not her father and that he had not been entitled to seek rectification or compensation. The appeal came on before Appeal Sheriff O'Carroll who delivered judgment in East Dumbartonshire Council v Paton [2026] SAC (Civ) 17 on 4 March 2026. In para [23] of his judgment, the learned Appeal Sheriff dismissed the appeal.
Approach
In para [16], Appeal Sheriff O'Carroll and adopted considered the approach of the court below:
"What the case law and the two cases cited demonstrate in my view is that the correct approach to determining whether a right to access and associated rights exist, once the controller or processor of the data is identified, is firstly to identify the data to which access and rectification is sought. Then decide whether that data is personal data or not considering the statutory definition and wide interpretation of personal data adopted by the courts. Then, the task is to identify who is the subject of the data, that is to say the identified or identifiable person to whom the data relates. Then determine whether the data subject is entitled to rights of access or rectification or any other rights provided by the data protection legislation. Then, ascertain whether that that right has been asserted and exercised. Then, where the asserted right has been refused or blocked in some way, determine whether the data subject has a remedy and if so what and on what basis. Remedies include access, erasure, rectification, blocking and compensation, among others."
Whose Data?
The learned Appeal Sheriff observed that the parties and first instance sheriff had narrowed the issue in dispute to a single question. Was the disputed data the personal data of the girl or her father? In doing so, all concerned appeared to have assumed that the question was binary, that the data could be the personal data of only one or the other.Not a Binary Question
The Appeal Sheriff explained why that was wrong:
"However, as frequently occurs in practice, any given piece of information may amount to personal data simultaneously of more than one person. See the useful discussion in Jay, Data Protection Law and Practice (5th Edition), at paragraphs 13-033 et seq. Information may inextricably form personal data of two or more persons. In the Novak case for example, the court noted that the personal data sought by Mr Novak was also the personal data of the examiner. In DB v General Medical Council [2019] 1 WLR 4044, , the independent expert report obtained by the GMC regarding the competence of a GP's treatment, sought by the patient who alleged negligent treatment, was simultaneously the personal data of the patient and the GP (and it might be said, though not argued, that of the author as well). Another example might be a joint bank account statement: that will comprise the personal data of each joint account holder. In this appeal, the Council itself states in its submission, correctly, that the disputed data was also that of the head teacher. The legislation itself makes specific provision for access rights in such cases of mixed personal data: see Articles 5 and 15 of GDPR and Schedule 2, Part 3, paragraph 16 to the 2018 Act. See also paragraph 17 of Part 3 for specific provision made in the case of education officials (such as risk assessor in this case) which removes the reasonableness test as regards the disclosure of that education official's personal data in certain circumstances."
He concluded that it cannot be said that if the information comprised the personal data of the child, it could not also be the personal data of her father.
It was obvious that the risk priority rating for emotional well-being was the girl's, but it was also her father's in the particular circumstances of the case. The sheriff found after hearing evidence that the purpose of the data was not only to inform the council's employees’ decisions regarding the safety and well-being of the child, it was also to satisfy her father that those matters were being adequately dealt with by the council's officers.
Comment
The fact that the same data may relate to more than one data subject is often used as a reason for withholding data on a subject access request. This decision makes clear that such excuses cannot be relied upon. That does not mean that third-party rights can be overridden. They have to be protected by redaction or otherwise.
Anyone wishing to discuss this article may call me on 020 7404 5252 during normal UK office hours ot send me a message through my contact form at any time.
