About this case:

• Citation:
  [2026] SAC (Civ) 17
• Judgment:
  External link
• Court:
  Sheriff Appeal Court
• Judge:
  Appeal Sheriff O'Carroll

East Dunbartonshire Council was ordered to pay damages following a simple procedure action raised by a claimant, referred to by the pseudonym “Paul Paton” to protect his identity, in which he alleged he had suffered loss as a result of the appellant’s failure to rectify inaccurate personal data. The council argued that the sheriff had erred in concluding that the data was that of the claimant instead of that of his daughter “Caitlin”, who at the material time was a primary school pupil.

The appeal was heard by Appeal Sheriff Derek O’Carroll, with McLaughlin, solicitor, appearing for the appellant and the claimant and respondent appearing as a party litigant.

Conceded it was wrong

In 2019, the claimant’s daughter experienced bullying at her primary school, which led him to raise his concerns with the head teacher. The head teacher proceeded to prepare a draft risk assessment on a standard form, which recorded that a series of incidents at the school had left the claimant concerned for Caitlin’s wellbeing. After he was given sight of the draft assessment, the claimant queried the risk priority rating scores, particularly the lowering of the emotional wellbeing hazard from “high” to “medium”, which had lowered over the course of the review due to control measures put in place after the draft was first created.

Further events caused the claimant to make a formal complaint to the council, which rejected most of his complaints, and then an appeal to the Scottish Public Services Ombudsman. At some stage, the council prepared a second risk assessment form, apparently dated 31 May 2019, which gave the risk of emotional hazards as “low”, which was not provided to the claimant but was provided to the Ombudsman during its investigation. Following other procedures, the claimant sought rectification of the inaccurate rata insofar as it recorded the risk priority for Caitlin’s emotional wellbeing as low. The council conceded that the second risk assessment had been wrong but refused to rectify that version of the document.

The council’s refusal led the claimant to raise proceedings for compensation relying on Article 82 GDPR and the Data Protection Act 2018, based on the proposition that the false data was his personal data. Taking into account a case from the Court of Justice of the European Union, Nowak v Data Protection Commissioner (2018), and an English case, Ashley v Revenue and Customs Commissioners (2015), the sheriff concluded that the inaccurate data was sufficiently linked to the claimant to justify an award of damages.

On appeal, the council maintained its position that the data in question was not the personal data of the claimant, and therefore his claim for compensation should fail. They did not appeal against the finding of the sheriff that the claimant suffered loss and damage and there was a causal connection between that and the council’s breach of its data protection statutory responsibilities.

Responsibilities for safety

In his decision, Appeal Sheriff O’Caroll began by observing: “In this appeal, the parties and the sheriff narrowed the issue in dispute to a single question: was the disputed data the personal data of the claimant or of Caitlin? In doing so, all concerned appear to have assumed that the question was binary, that the data could be the personal data of only one or the other. However, as frequently occurs in practice, any given piece of information may amount to personal data simultaneously of more than one person.”

He continued: “In this appeal, the Council itself states in its submission, correctly, that the disputed data was also that of the head teacher. The legislation itself makes specific provision for access rights in such cases of mixed personal data: see Articles 5 and 15 of GDPR and Schedule 2, Part 3, paragraph 16 to the 2018 Act. See also paragraph 17 of Part 3 for specific provision made in the case of education officials, (such as a risk assessor in this case) which removes the reasonableness test as regards the disclosure of that education official’s personal data in certain circumstances. Accordingly, it cannot be said that if the information comprised the personal data of Caitlin, it cannot also be the personal data of the claimant.”

Explaining why the data was also the claimant’s personal data, Appeal Sheriff O’Carroll said: “The sheriff found in fact that the content and the extent of the recommended control measures directly related to the risk priority rating in question. Furthermore, given that Caitlin was at the time a primary school pupil, it is obvious that the claimant, as her father, required to exercise his parental responsibilities, which included responsibilities for his daughter’s well-being and safety. In the circumstances of this unusual case, it is clear that the personal data was mixed personal data being that of Caitlin, her father, the claimant (and the head teacher).”

He concluded: “There would have been no sensible argument that it was not reasonable to disclose such mixed data to the claimant. In any event, he supplied the written consent of his daughter in 2024 when making the formal rectification request. Therefore, the claimant being a data subject had the right to seek rectification. The Council accepts that rectification was required. It accepts the data was not rectified without undue delay. In terms of Article 82 UK GDPR, the claimant was entitled to seek compensation as a person who had suffered loss and damage as a result of a breach of the Council’s statutory duties.”

The appeal was therefore refused.