Question to the Ministry of Justice:

To ask the Secretary of State for Justice, with reference to the answer of 27 February 2026, to Question 112638, on Courtdesk: Data protection, why the unauthorised release of the sensitive personal data was deemed by the departmental data protection officer not to be a reportable data breach in this instance.

The departmental Data Protection Officer carefully considered the circumstances of this incident and concluded that it did not meet the threshold for notification to the Information Commissioner's Office. While the use of the data was found to be outside the agreed contractual arrangements, the information was processed using an enterprise-licensed AI service that had been subject to appropriate due diligence and contractual safeguards. There was no evidence of unauthorised access, wider disclosure, misuse of the data, or any resulting risk to the rights and freedoms of individuals. Following assessment in line with the Ministry of Justice Personal Data Incident Management Process, officials concluded that the incident did not meet the threshold for notification to either the ICO or the affected data subjects.

HMCTS, working with the Ministry of Justice, The National Archives and the Judiciary, has introduced a licensing framework for the computational re-use of court and tribunal hearing data published via the Court and Tribunal Hearings Service (CaTH).

The framework offers a one-year Experimental Licence for non-public proofs of concept and a three-year Transactional Licence for commercial products and services. All applications are subject to approval by the Third-Party Courts and Tribunals Governance Panel. Further guidance is available at Court and Tribunal Hearings Service or (HMCTS) Third-Party Courts and Tribunals Data Licence.