DPA TEST
Supreme Court upholds employer’s right to process personal data in background checks in first challenge
Published:Tuesday | November 12, 2024 | 12:09 AMBarbara Gayle/Gleaner Writer
The Supreme Court has ruled that an employer’s processing of personal data for background checks is permissible as the Data Protection Act (DPA) of 2020 faced its first legal challenge.
Justice Dale Palmer delivered the decision after denying an injunction that would have prevented three defendant companies and their agents from processing any personal data related to the claimant, Kasie Ann Morrison.
The judge said there was no evidence suggesting that the data would be processed beyond the scope of the Industrial Disputes Tribunal (IDT), where Morrison’s employment dispute was being heard.
The defendants were Elephant Group Ltd (trading as Centerfield Jamaica), ADV Communications Ltd (trading as Advantage Communications), and A&A Services Solutions Consultants Ltd (SSCL).
Morrison was employed to Centerfield from December 13, 2018 until her termination on June 24, 2020. She challenged the dismissal, which led to the proceedings before the IDT.
One of the key issues in the case was the compensation owed to Morrison from July 24, 2020 to December 25, 2023. However, investigations revealed that she had obtained employment elsewhere, a fact she had not disclosed to the IDT
In filing her claim before the IDT in April, Morrison omitted her recent employment history. To prepare its defence, Centerfield engaged SSCL, a private investigations firm, which conducted a background check. SSCL obtained Morrison’s personal data – including her full name, age, date of birth, address, and taxpayer registration number (TRN) – and produced a report showing that she had been employed by ADV since July 6, 2020, despite her claim of unemployment following her departure from Centerfield.
Centerfield then wrote to ADV on June 11, 2024, requesting Morrison’s employment history to support its defence in the case before the IDT. It supplied her name and TRN.
ADV responded on June 17, confirming her employment with them from July 6, 2020 to May 1, 2024 when she was involuntarily separated, and provided details of her positions and compensation.
These findings were submitted as evidence at the IDT hearing on June 18.
A legal expert noted that, if the IDT determined Morrison’s dismissal was unjustified, her subsequent employment could reduce any compensation awarded. It was also suggested that the employer has the burden of proving that the worker would have found alternative employment, potentially mitigating compensation.
Morrison filed a claim in the Supreme Court against the defendants on July 12, 2024, seeking damages and declarations that the defendants had violated the DPA. She also sought an injunction barring the defendants from processing of her personal data without her consent or compliance.
Justice Palmer noted that the claimant is alleging that the three defendants’ disclosure and dissemination of her personal data was unlawful and in breach of the DPA. The judge said she did not provide to the IDT her employment history after termination.
Attorney-at-law Robert Moore, who represented Morrison, argued that while she was not seeking to exclude evidence already before the IDT, the goal of the application was to prevent further unlawful processing of her data, which could damage her employment prospects. Moore said the information could have been obtained by less invasive means, adding that there was no request by Centerfield for her to disclose and that, furthermore, the IDT has the regulatory powers to subpoena documents.
Attorney-at-law Stuart Stimpson – instructed by Hart Muirhead Fatta – who represented Centerfield, argued that Morrison had come to the IDT with “unclean hands” because she had dishonestly maintained that she was unemployed during the disputed period. He further contended that she was attempting to suppress evidence of her employment with ADV.
Attorneys for ADV, Emile Leiba, and Kymberly Hanniford – instructed by DunnCox – argued that there was no serious issue to be tried as there was no breach of the DPA based on the class of information provided.
SSCL’s attorney, Jerome Spencer, argued that the data was processed in accordance with section 23 of the DPA, as it was intended to support Centerfield’s legal position in the IDT proceedings.
Justice Palmer, in interpreting Section 2(1) of the DPA, found that it allows for the processing of personal data in certain circumstances, including for confidential background checks related to prospective employment.
The judge said: “There does not appear to be either the evidential basis to fear that the defendants would breach the DPA in regards to any future processing and, if done as a confidential background check, as a future prospective employer might commission, it may be permissible.
“This conclusion is further supported by the fact that when one considers that the letter of request clearly outlines the purpose for which the data would be used, and there is no evidence to suggest that the defendants have or may process it contrary to what has been indicated. The court had also considered that the processed data has remained confidential and has only been accessed by the parties who have an interest in the matter.”
Justice Palmer ruled that there was no serious issue to be tried and refused the injunction, stating that there was insufficient evidence to support Morrison’s fear that her data would be processed inappropriately or to her detriment.
In his written decision on September 27, 2024, the judge further explained that “having found that the application is made on the foundation of inequity, an award of damages to the claimant would not be justified.
“Notwithstanding the view expressed above regarding a lack of evidence to support a real risk of unlawful processing of her data, if at trial the court is to find differently, damages will be an adequate remedy for the claimant,” he added.