Sheriff rejects prisoner’s £15,000 data breach claim after Parole Board letter sent to wrong inmate

About this case:

• Citation:
  [2026] SCGLA104
• Judgment:
  External link
• Court:
  Sheriff Court
• Judge:
  Sheriff S Reid

Sheriff S Reid accepted that the Scottish Prison Service had committed a data protection breach by sending Joseph Henderson’s decision letter to the wrong inmate, but held that the more detailed and sensitive Parole Board minute on which his action was founded had not been disclosed. The sheriff further found that Mr Henderson had failed to prove that he suffered any material or non-material damage as a result of the error.

Mr Henderson sought £30,000 in his initial writ, reduced to £15,000 in closing submissions, for alleged breaches of the UK GDPR, the Data Protection Act 2018 and his right to respect for private life under Article 8 of the European Convention on Human Rights. He alleged that a detailed minute following a Parole Board hearing in August 2022 had been delivered to another prisoner at HMP Low Moss and circulated within the prison. The minute contained sensitive information concerning his criminal history, health and previous risk assessments.

The Scottish ministers admitted that a Parole Board document had been sent to the wrong prisoner, but maintained that it was only the much shorter decision letter issued following the hearing, which contained no sensitive information of that kind.

The case was heard by Sheriff S Reid, with Ms Dewar, advocate, instructed by Mellicks, Glasgow, appearing for the pursuer and Ms Turner, instructed by Anderson Strathern, Edinburgh, appearing for the defender.

Conflicting accounts of document

The central factual issue was which document had actually been mis-delivered. Three different possibilities featured in the evidence: the full dossier supplied to a prisoner before a Parole Board hearing, the brief decision letter issued shortly afterwards and the more detailed minute subsequently setting out the Board’s reasons.

Mr Henderson’s description changed over time. When the mistake was discovered, he told his mother that his decision letter had been sent to another prisoner and his formal complaint to SPS referred to his “parole decision”. In his initial writ, however, he alleged that his entire dossier had been disclosed. He gave the same account to a psychiatrist instructed on his behalf. The pleadings were subsequently amended first to refer to the decision letter and later to allege that the detailed minute had been wrongly delivered. At proof he maintained that it was the minute.

A fellow prisoner who gave evidence for him, meanwhile, insisted that the document he had seen was the full dossier. Sheriff Reid said: “Confusion was heaped upon confusion.” The court heard evidence over four days from eight witnesses called by Mr Henderson, including prison officers, social workers, a fellow prisoner, his mother and a consultant psychiatrist. SPS called one witness.

Decision letter sent to wrong prisoner

The sheriff preferred the contemporaneous documentation. He found that the decision letter had been emailed by the Parole Board to SPS on 22 or 23 August 2022 and was then printed by an SPS administrator. Although the envelope contained Mr Henderson’s name, the administrator mistakenly wrote on it the prisoner number and cell location of another inmate, David Henderson. The letter was consequently delivered to that prisoner and its contents were subsequently disclosed to others.

When the error came to light on 1 September, SPS recovered the letter and envelope, corrected the prisoner number and cell location and delivered them to Mr Henderson. The court found that the decision letter contained no sensitive details concerning his criminal history, health or previous risk assessments. It principally recorded that the Parole Board had deferred consideration of his release pending further information.

By contrast, the detailed minute did contain sensitive and confidential material, but the sheriff found that it had not even been sent by the Parole Board to SPS until after 1 September 2022. Sheriff Reid said that, faced with conflicting testimony, he had sought “refuge within the contemporaneous documentation”, which pointed to the decision letter as the document which had gone astray. That distinction was fatal to the pleaded case. Mr Henderson’s action was founded specifically on wrongful disclosure of the sensitive minute and contained no alternative claim for compensation based on disclosure of the decision letter.

Damage still required

The sheriff went on to consider whether Mr Henderson had in any event established compensable damage. There was no dispute that SPS was a data controller and that sending a document intended for Mr Henderson to another prisoner meant his data had not been processed in accordance with its data protection obligations. However, Sheriff Reid emphasised that an infringement does not automatically entitle a person to damages. He observed that under Article 82 of the UK GDPR a claimant must prove both material or non-material damage and a causal connection between that damage and the unlawful processing.

Non-material damage could include distress or a well-founded fear that personal information might be misused, and there was no minimum threshold of seriousness which had to be crossed. But a claimant was still required to establish that actual damage had occurred. Mr Henderson alleged that the disclosure had caused severe anxiety and fear for his safety and had led to verbal abuse, threats and assaults by other prisoners. He also relied on psychiatric evidence diagnosing an adjustment disorder with anxiety.

The sheriff rejected those claims. The findings in fact recorded that there had been no deterioration in Mr Henderson’s mental health caused by the wrongly delivered decision letter and that he had not suffered fear for his life, assault or verbal abuse as a consequence of it. There was also no documented deterioration in his mental health in either SPS or medical records during the relevant period. He continued working within the prison, attending the gym and exercising regularly.

Expert report altered

The sheriff was also critical of the history given to the psychiatric expert. When Mr Henderson was examined in December 2023 he explicitly told the psychiatrist that his “dossier” and “entire dossier” had been wrongly disclosed and circulated. The expert’s report was later amended at the request of Mr Henderson’s solicitors so that every reference to the “dossier” was replaced by “Tribunal Hearing Minute” or “minute”. Sheriff Reid ultimately rejected the evidence that Mr Henderson had developed an adjustment disorder because of the disclosure. The court found that he had a history of depression and anxiety predating the incident, but that there was no contemporaneous medical record of any deterioration following the error.

Action fails

Sheriff Reid therefore held that Mr Henderson had failed on two separate grounds. First, he had not proved the specific data protection breach on which his action was based, because the sensitive Parole Board minute was not the document delivered to the other prisoner.

Secondly, even if the relevant breach had been established, he had not proved any material or non-material loss, injury or damage flowing from it. The sheriff also held separately that an award of damages was not necessary to provide just satisfaction under section 8 of the Human Rights Act 1998.

The Scottish ministers were accordingly assoilzied from the action, with the question of expenses reserved.