15. Before we decide if we should conduct a detailed investigation of a complaint, we look at whether there are signs the event complained about had a negative effect which the organisation has not put right. Having done so we have found HMCTS has already done enough to put right the impact of these events.
Incorrect disclosure of an email address
16. Mr U says HMCTS wrongly disclosed his email address to a small claims court claimant on 6 August 2024. He says HMCTS copied the claimant into an email sent to him, which has led to the claimant harassing him. He says HMCTS’ goodwill offer of £500 does not reflect the gravity of the data breach and the harm suffered.
17. Mr U has told us his and his wife’s mental health and work life have been affected. He has had to report the harassing behaviour to the police and other authorities. Mr U has told us he felt unsupported by HMCTS and has incurred financial loss trying to deal with the harassment. We are very sorry to hear this.
18. In this case, we reviewed the documents provided to us by Mr U and HMCTS. This included HMCTS’ data protection policy and its complaints handling policy. We consider both are relevant to this complaint.
19. Section 3.6 of HMCTS data protection policy says any person carrying out any function or work directly for or on behalf of the Ministry of Justice (MoJ) must comply with UK GDPR (General Data Protection Regulation) and the Data Protection Act 2018. Staff must keep protected the personal information of staff, suspects, offenders, victims and witnesses, and all other persons. They must only use and share data where strictly necessary and where a lawful basis exists.
20. We reviewed the documents provided to us by HMCTS. We identified the most relevant events regarding HMCTS sharing Mr U’s email address with the small claims court claimant.
21. On 1 July, Mr U provided his email address and telephone number to HMCTS. In his email, he noted there was an ongoing harassment case involving the claimant. He advised, due to the nature of the case, he did not feel comfortable or safe sharing his contact details.
22. On 3 July, the Judge waived the requirement for the defendant to send the claimant his phone number. We cannot see the Judge mentioned sharing the email address with the claimant. Whilst submitting his evidence on 26 July, Mr U reiterated the request not to exchange his evidence with the claimant directly.
23. On 6 August, an administrative officer at HMCTS emailed a court order to Mr U and the claimant. We can see the email was copied to both parties, meaning Mr U’s email address was visible to the claimant. We consider this is not in line with HMCTS’ data protection policy, which says staff must only share data where strictly necessary and must keep protected the personal information of stakeholders. We therefore consider there is an indication of a failing in HMCTS sharing Mr U’s email address with the claimant.
24. HMCTS’ complaints handling policy says when it makes mistakes or things go wrong, it should put them right as soon as possible. Staff should understand the impact on a customer when things go wrong, and where possible, should aim to put the customer back in the position they were in before HMCTS made the mistake.
25. Regarding financial redress, HMCTS’ complaints handling policy says staff should consider whether the mistakes have caused an injustice or had a serious or significant impact on the customer and make a payment on this basis.
26. In his complaints to HMCTS, Mr U stated, since the email was shared, he and his wife were subject to ongoing harassment by the claimant. Specifically, he stated they had received five to seven emails per day. In his escalation letters, Mr U documented the breach had ‘resulted in ongoing harassment and over 60 emails’ sent by the claimant. He stated the claimant also sent handwritten letters through his letterbox if the emails went unanswered.
27. In its complaint responses, HMCTS apologised for sharing Mr U’s email address with the claimant and for the disruption caused. It offered reassurance the matter was investigated at the time, and an incident report was completed. It also offered assurance the staff member responsible was reminded of the importance of protecting personal data.
28. In its initial complaint response, HMCTS offered an ex gratia payment of £250. It later increased this to £500. In its final response, HMCTS declined to increase this offer further. It explained this was because it had not disclosed Mr U’s home address to the claimant and it was satisfied this was already known.
29. We consider HMCTS has taken steps to put things right. It has apologised, spoken to the staff member involved to ensure the poor service does not happen again, and offered a financial remedy of £500. We note Mr U’s desired outcome is a financial remedy, which has been provided. As he has advised he is unhappy with this amount, we have considered whether the £500 offered is sufficient to remedy the injustice caused.
30. HMCTS’ complaints policy says when a customer has been given a poor service, staff should consider several factors which could increase or decrease the impact on that person. This includes whether there has been any financial loss, any injustice, and what the impact is on the customer.
31. The policy outlines the types of harm a customer may suffer from poor service. For example, minor harm resulting from lost time, moderate harm such as severe stress or anxiety affecting their work or health, and major harm which includes life-changing impacts such as homelessness, public embarrassment or lost guardianship.
32. If a payment is appropriate, HMCTS’ policy advises staff refer to the payment ranges, depending on the customer’s personal circumstances. We have identified the most applicable payment ranges for non-financial loss in this case:
• £250 – 500 awarded if a ‘customer’s personal and sensitive information sent to a third party by mistake – third party then contacted customer causing distress. Data loss and breach of the Data Protection Act. No evidence of harm or financial loss provided. Customer extremely upset and concerned about what happened.’
• £500+ awarded if the poor service constitutes ‘a one-off service failure which caused a damaging impact to someone’s situation – such as serious data losses or data breaches – information shared with someone who may be violent or puts the person at risk.’
33. In this case, HMCTS has offered an ex gratia payment of £500. In his complaint to HMCTS and correspondence with us, Mr U told us the claimant had harassed him and his wife via email multiple times a day and overnight and posted letters through their post-box. He also told us the claimant has videoed him and his wife and shared the videos on social media.
34. We need to consider whether we can link Mr U’s claimed impact to the failing of sharing his email address. Mr U has told us his mental health, work performance, and quality of life have been impacted. He and his wife suffered anxiety, sleep problems, and avoided leaving their property. They have reported the claimant’s behaviour to the police.
35. Based on what Mr U has told us, we understand the claimant is his neighbour. We therefore do not consider any injustice caused by the claimant posting letters or being physically near Mr U can be linked to the failings by HMCTS.
36. It is clear from the evidence presented (not least, his email to the court of 26 July 2024) that the claimant was already aware of Mr U’s physical address. Any action related to that address was not the result of HMCTS’s failure.
37. We consider Mr U has suffered an emotional impact as a result of his email address being shared. Based on this, we consider the £500 to be an appropriate remedy. There has been a one-off service failure which has caused a damaging impact to Mr U via the claimant’s harassment. We have not seen any evidence of harm caused and cannot say the harassment in person is due to the failings by HMCTS. We also consider the Judge did not explicitly waive the requirement for parties to share their email addresses, as they did telephone numbers.
38. In summary, we consider there are indications HMCTS failed to act in line with its own data protection policy. In its complaint responses, HMCTS has apologised, spoken with the staff member involved, and offered a financial remedy of £500 to put things right.
39. Based on our review, we consider this financial remedy is appropriate and in line with HMCTS’ complaints policy. We therefore do not consider there are any indications of unremedied injustice in this case. We do not intend to take further action on Mr U’s complaint.