Section 7(9) DPA is about privacy, not employment disputes

August 22nd, 2012 by Robin Hopkins

Disputes about subject access requests under section 7 of the Data Protection Act 1998 only rarely make their way to the Higher Courts. The leading – and often bedevilling – case of Durant is, for example, now 9 years old. Given this scarcity of precedent from the High Court and Court of Appeal, up-to-date illustrations of the judiciary’s approach to the DPA are most usefully sought in County Court judgments – see for example Panopticon’s post on the case of Elliot v Lloyds TSB Bank from earlier this year.

The most recent notable judgment is that of the County Court (HHJ May QC) in Professor Karim Abadir v Imperial College.

The applicant is an eminent econometrics professor employed by Imperial and has been since 2005. In 2011, Professor Abadir took issue when another professor at Imperial began to assess the academic staff by means of subjective metrics. The applicant objected to this, considering those metrics to be inappropriate for the academic staff in his department, and sought disclosure of the discussions that had taken place prior to their implementation.  Aggrieved, he made a subject access request. He was given some information, apparently of the human resources variety in the main. He objected to the nature of some of the comments which had been circulated about him and took the view that some of the emails he sought had been deleted. Imperial informed him in July that it would be implementing an email system upgrade and change of server in August. The applicant feared that some of the emails he wished to obtain would be permanently deleted. He sought an injunction preventing the systems work and requiring Imperial to search for and disclose to him “every document where reference is made” to him, including in deleted files.

Professor Abadir’s application was refused for a number of reasons.

Two reasons were matters of form, in that they related to what was missing from the application. The application was “objectionable” on the grounds that the applicant had not specified the nature of the underlying claim he would bring in due course. Also, assuming the underlying intended claim to be under section 7(9) of the DPA, the Judge expected the applicant to provide a draft order specifying exactly what information or searches he sought. The applicant had not done so. Instead, he asked for “generalised search of all computer systems, to include deleted data”.

Two further reasons were fatal in substantive terms. One was that there was no evidence to support the claim that the systems work would lead to the permanent loss of relevant emails. In fact, Imperial’s evidence contradicted that. There was thus no urgency to justify granting an injunction.

The final reason concerned the purpose or motive behind Professor Abadir’s claim. It was confirmed that his purpose was “to obtain disclosure of documents for purposes of deciding how to frame and pursue against Imperial College employment grievances which Prof Abadir believes he has. Put this way, the process by which documents are sought, given the purpose to which they are intended to be put, is much more akin to an application for pre-action disclosure.  It is disclosure, not right of access to personal data, which Prof Abadir is really seeking from Imperial College.”

On this point, HHJ May QC concluded that “disclosure is sought is not for the purposes of protecting Prof Abadir’s privacy but for the purposes of pursuing a claim against his employer.  To use the provisions of the DPA to pursue such a purpose is an abuse: Ezsias v The Welsh Ministers”.

Unusually, the Judge also awarded the University costs on an indemnity basis. In part, this was because the applicant had failed to identify the underlying cause of action, or to contact Imperial to make enquiries about its server changes before issuing his application for an injunction. HHJ May QC also concluded as follows: “to the extent that the injunction was sought for the purposes of supporting an intended action for DPA disclosure, it was clearly misconceived.  To seek disclosure under the DPA for the purposes of considering an employment claim is an abuse.  In any event, as DPA proceedings are for the purposes of protecting privacy, deletion/destruction of documents would not be contrary to those purposes, quite the reverse.”

It is apparent, therefore, that Courts continue to be unimpressed by the pursuit of subject access requests motivated by prospective litigation, and that they tend to see privacy concerns (rather than employment grievances) as the underlying rationale for the right of access to personal data. This will be welcomed by many data controllers.

Anya Proops appeared for Imperial College.

Robin Hopkins

Tags: , , , ,
Posted in INFORMATION LAW | Comments Off on Section 7(9) DPA is about privacy, not employment disputes

The Data Protection Act in defamation cases: increasingly relevant, potentially primary?

August 20th, 2012 by Robin Hopkins

The Data Protection Act 1998 is increasingly being deployed as part of a claimant’s arsenal in defamation claims. The Information Commissioner has historically resisted policing DPA breaches in the context of allegedly defamatory expressions of opinion by one person about another.

Courts, on the other hand, have accepted that expressions of opinion about individuals are (as the definition at section 1 of the DPA makes clear) personal data, and that the DPA can therefore bite. This has arisen, for example, in the context of Norwich Pharmacal claims seeking the disclosure of the identities of users posting allegedly defamatory material. See for example Applause Store Productions Ltd and another v Raphael [2008] EWHC 1781 (QB), on which Anya posted here.

The use of the DPA in defamation claims (or cases which, though brought under the DPA, look in substance like defamation claims) has, it seems, gathered momentum. In late 2011, Tugendhadt J gave judgment in a case about the ‘solicitors from hell’ website:  The Law Society and others v Rick Kordowski [2011] EWHC 3185 (QB), on which Rachel Kamm posted here.

Last month, the DPA was again successfully relied upon as founding an arguable defamation-type claim. Desmond v Foreman, Shenton, Elliott, Cheshire West and Cheshire Council and Cheshire East Council [2012] EWHC 1900 (QB), involved a cover teacher who was suspended and ultimately dismissed following allegations that he had conducted himself in an inappropriate sexual manner towards a sixth-form student. The case involved a number of communications: meetings to discuss the allegations; requests for information from the police and previous employers; referrals to the Independent Safeguarding Authority, and queries about his home situation made by an officer of one local authority to an officer at another.

The claimant contended that a number of these communications implied that he was actually guilty of and had actually committed various serious offences (including rape, of which he had been accused in 2001 but exonerated through court proceedings). He brought a defamation claim, also contending that the allegedly defamatory statements infringed his rights under Article 8 and the DPA (in particular, breaches of data protection principles 1, 2, 3, 4 and 6).

The defendants – two local authorities, a headmaster and two local authority officers – sought summary judgment. They said the communications complained of were no more than expressions of concern that matters needed investigating, they asserted qualified privilege (based on the performance of their public duties) and justification.

The judge – as in Kordowski, Tugendhadt J – dismissed the application for summary judgment in part, finding that the claimant’s case under Article 8 and the DPA had a real prospect of success in relation to some of the communications complained of.

The judgment is of interest not only as an illustration of the difficulties of lawfully sharing sensitive information (including opinions) in the context of safeguarding children. It also illustrates that the DPA is increasingly – and realistically – being pressed into the service of types of complaint traditionally brought under other heads. The DPA and Article 8 are, of course, long-standing and natural complements to each other. Defamation, however, is slightly more alien territory for the DPA. Copyright infringement (on which, see a post of mine from last year here) is another area to which the DPA is increasingly relevant.

What, it is sometimes wondered, does a claim under the DPA add which is not already covered by claims under Article 8, defamation and so on? After all, as the defendants in Desmond argued, if someone is aggrieved at DPA breaches, then he has another remedy available, namely a complaint to the ICO. Interestingly, Tugendhadt J’s judgment in Desmond reverses this: what, he asked, would an Article 8 or defamation claim add to the DPA claim – at least with respect to one of the communications complained of? In particular, he was concerned with how best to deal with the claim that information about the 2001 rape allegation had been processed (retained, communicated) without reference to the judgments exonerating the claimant.

This last point about fair and accurate records of serious allegations is important: see an older post of mine here.

For the moment, back to Desmond and how best to deal with legal claims about this sort of complaint. Tugendhadt J said this:

“81. How and why it is that the references to the 2001 incident came to be recorded, but recorded without mentioning the public judgments of the court containing the police’s explanation for not charging the Claimant, is a question for which the proceedings under the DPA may provide the most appropriate form of investigation (as the Court of Appeal suggested in para 51 of their judgment). It is for consideration whether claims under the HRA or in defamation would add any benefit to the Claimant over and above a claim under the DPA. And as noted above, a claim under the DPA appears to raise no issues of limitation.

82. I invited the parties to consider why the Court should not direct that the claim under the DPA proceed first and separately from the other two claims, and give directions as to the filing of evidence (or agreed statements of facts) so that the matter could be determined in accordance with the overriding objective, and in particular with the objective of allotting to the case an appropriate share of the court’s resources.”

This demonstrates that, at least in some circumstances, the DPA may appropriately play the lead role rather than a supporting one in a complaint about unjustifiable and damaging communications about individuals. It looks as if the DPA will continue to flex muscles it did not even know it had.

Robin Hopkins

Tags: , , , , ,
Posted in INFORMATION LAW | Comments Off on The Data Protection Act in defamation cases: increasingly relevant, potentially primary?

The BBC in the Tribunal: not a public authority under the EIR; strong arguments for disclosure of licence fee legal advice

August 17th, 2012 by Robin Hopkins

In Montford v IC and BBC (EA/2009/0114), the appellant had asked the BBC various questions about its expenditure in relation to Cambridge Media and Environment Program, which researched and planned a programme of seminars that had been running since 2005 at which BBC editorial staff discussed issues such as environmental change and world development, with the objective of improving BBC journalism in those areas.

The BBC is a public authority within Schedule 1 of FOIA only within the following parameters: “The British Broadcasting Corporation, in respect of information held the purposes other than those of journalism, art or literature”. The Supreme Court addressed this “derogation” from FOIA in Sugar v BBC [2012] UKSC 4: see our post here. Montford concerned not only the application of Sugar to this request, but also an argument that, given the subject matter of the request and the BBC’s activities, the BBC was a public authority within the meaning of regulation 2 of the EIR.

The Tribunal considered the leading cases on the latter point (Smartsource, Port of London, Network Rail, Bruton) and – applying the multifactorial approach from Smartsource – concluded that the BBC was not a public authority under the EIR. Further, the requested information was not environmental: that requires more than a remote link to the environment, and in the present case there was no link. It was therefore FOIA which applied, and Sugar meant that the requested information fell within the derogation. The BBC therefore did not have to provide it.

The BBC also featured – though not as a party – in another Tribunal decision of late. Crawford v IC and DCMS (EA/2012/0018) concerned the conclusion of the ‘BBC settlement’, ie the funding arrangements (freezing of the licence fee, BBC taking over World Service funding and so on) agreed with extraordinary speed between Jeremy Hunt and BBC Trust chair Michael Lyons in October 2010. The requester – a BBC journalist – sought information about that agreement. By the time of the hearing, the only disputed information was legal advice, which fell within section 42(1) of FOIA. The argument focuses on the public interest.

As readers will be aware, information falling within section 42(1) has very rarely been ordered for disclosure by the Tribunal. One gets the sense from the Tribunal’s decision in Crawford that the appellant here came closer than most to getting the information he sought.  The Tribunal noted the unprecedented speed with which negotiations about matters of great public interest were concluded in 2010. In the circumstances, there were “weighty factors in favour of disclosure of any information which can shed light on how this speedy settlement which affects so many people was reached. In other words there is a significant public interest in transparency and accountability in this case”. The stumbling block, however, was that the disputed legal advice shed only limited light on those concerns. Disclosure was thus not ordered. The Tribunal concluded on a note of sympathy with the requester:

“We would observe that we can understand why Mr Crawford has pursued this matter to a hearing despite disclosure of most of the information originally requested. It seems to us, that despite the exceptional nature of the CSR, the haste of the negotiations and lack of record of what took place means that Mr Crawford has quite understandably had to challenge the DCMS into providing whatever contemporaneous record there might be to help him in his journalist pursuit to provide the public with the facts of this unprecedented Licence Fee Settlement with its far reaching effects.”

Robin Hopkins

Tags: , , , , , , ,
Posted in INFORMATION LAW | Comments Off on The BBC in the Tribunal: not a public authority under the EIR; strong arguments for disclosure of licence fee legal advice

Commercial prejudice: the importance of precise and limited redactions

August 17th, 2012 by Robin Hopkins

In the recent decision in UK Coal Mining v IC, Nottinghamshire County Council & Veolia [2012] UKUT 212 AAC, the Upper Tribunal has dismissed an appeal concerned with section 43(2) of FOIA (commercial prejudice): the First-Tier Tribunal (decision EA/2010/0142, on which see our post here) had been entitled to find that only very limited redactions could be made to provisions from a PFI contract for a waste incinerator. Upper Tribunal Judge Wikeley’s decision, while largely fact-specific, illustrates two significant points.

First, appeals against FTT decisions are liable to fail where they are simply attempts to re-run questions of fact and judgment.

Secondly, those seeking to rely on section 43(2) FOIA should be as precise as possible. Sometimes, for example, a clause in a contract might appear commercially sensitive at first glance, but upon closer scrutiny all that really warrants withholding might be the numbers.

The background to the decision is briefly as follows. UK Coal entered into a complex PFI agreement with the Council for an option to lease a former colliery site the site, with Veolia then sub-leasing the site from the Council to operate an incinerator. Upon a request for the contracts, the Commissioner found that regulation 12(5)(e) of the EIR (confidentiality of commercial or industrial information) was engaged, but that the public interest favoured disclosure. Upon what was effectively UK Coal’s appeal, the FTT found that the matter should have dealt with under FOIA rather than the EIR. Section 43(2) was engaged, but the public interest favoured disclosure of at some of the disputed information. Eventually, the Tribunal largely endorsed the Commissioner’s (very limited) redactions, rejecting the much more extensive redactions proposed by UK Coal. UK Coal’s appeal to the Upper Tribunal failed.

As regards challenges to the FTT’s decision, Upper Tribunal Judge Wikeley said that it was important that the FTT’s statement of reasons is read as a whole, rather than highlighting particular phrases and taking them out of their wider context. The FTT had allowed for the redaction of what it called “core financial information”, but this was simply a convenient shorthand not amenable to close textual analysis or to legal challenge per se.

Notably, he said that this of the FTT’s assessment:

“This was a quintessential issue of fact and degree for the tribunal at first instance to determine… The bottom line is that UK Coal is essentially seeking to re-argue questions of fact and judgement which have been litigated and adjudicated upon on their merits by the FTT.“

Judge Wikeley also warned that the caution against relying too heavily on other FTT decisions (see the Upper Tribunal’s decision in LB Camden v IC and Voyias GIA/2986/2011) applies with even greater force to attempts to rely on other decision notices by the ICO (as UK Coal sought to do here).

Turning to the section 43(2) redactions urged by UK Coal, the Upper Tribunal considered these to be “far too wide-ranging” and its arguments unsustainable. Some of the terms it sought to withhold were commonplace to commercial agreements. The FTT had approached its redaction analysis with care and precision, and correctly struck a balance between protecting UK Coal’s proper commercial interests under section 43 while ensuring that other information is disclosed. In some cases, the FTT allowed only for the redaction of figures rather than terms as a whole. This nonetheless ensured that a member of the public would have “no idea as to either the commercial methodology or the key financial and other numerical variables used”.

The Upper Tribunal’s decision cites specific examples of the scope of redactions to commercial terms which the FTT applied and which the Upper Tribunal found to be entirely understandable. The examples merit close attention by those seeking to withhold information in similar cases.

Robin Hopkins

Tags: , , , ,
Posted in INFORMATION LAW | Comments Off on Commercial prejudice: the importance of precise and limited redactions

11KBW Information Law Reports with JUSTIS, 4th edition update released

June 20th, 2012 by Panopticon Blog

The fourth edition of the Information Law Reports is now available. Reported cases include: Kennedy v IC, All Party Parliamentary Group on Extraordinary Rendition v IC & FCO, Breeze v IC and the Chief Constable of Norfolk Constabulary and the Crown Prosecution Service, Bolton v IC & East Riding Yorkshire Council and Cranfield University v IC

The reports are edited by Timothy Pitt-Payne QC, Anya Proops, and Robin Hopkins, three of the leading practitioners in the field of information law and members of 11KBW’s Information Law Group.

The reports were written by Members of the Information law team including  Timothy Pitt-Payne QC, Anya Proops, Robin Hopkins, Jane Oldham, Clive Lewis QC, Akhlaq Choudhury, Julian Milford, Holly Stout and Rachel Kamm.

For more information on the Information law reports and how you get your free trial click here

Posted in INFORMATION LAW | Comments Off on 11KBW Information Law Reports with JUSTIS, 4th edition update released

Restriction on Local Authority surveillance

June 18th, 2012 by James Goudie QC

The Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Sources) (Amendment) Order 2012, SI 2012/1500 (“the 2012 Order”), made on 11 June 2012 and coming into force on 1 November 2012, restricts the circumstances in which local authorities may authorise directed surveillance under the Regulation of Investigatory Powers Act 2000 (“RIPA”).  The 2012 Order amends the Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Sources) Order 2010, SI 2010/521 (“the 2010 Order”), which prescribes the offices, ranks and positions of the individuals within a public authority who have power to grant authorisations for the carrying out of directed surveillance, as defined by s26(2) of RIPA, and sets out the restrictions on the circumstances in which authorisations can be granted.

Article 2(4) of the 2012 Order inserts a new Article 7A into the 2010 Order, to impose a new restriction on individuals holding a prescribed office, rank or position in any county council in England, a London borough council, the Common Council of the City of London in its capacity as a local authority, the Council of the Isles of Scilly, or any county council or county borough council in Wales. Such an individual may not now grant an authorisation for the carrying out of directed surveillance unless it is for the purpose of preventing or detecting a criminal offence and it meets the condition set out in New Article 7A(3)(a) or (b). Those conditions are that the criminal offence which is sought to be prevented or detected is punishable, whether on summary conviction or on indictment, by a maximum term of at least 6 months of imprisonment, or would constitute an offence under sections 146, 147 or 147A of the Licensing Act 2003 or section 7 of the Children and Young Persons Act 1933.

Posted in INFORMATION LAW | Comments Off on Restriction on Local Authority surveillance

Information Law in the Facebook Age

June 11th, 2012 by Anya Proops

Facebook has now been in existence for some eight years. Its active users exceed 900 million. However, we are still very much in the early days of understanding how information law applies to information, including personal data, which is stored and shared on Facebook. In this context, it is worth noting two recent judicial decisions which bring into sharp focus the way in which information on Facebook may be both used and misused.

The first case involved a claim brought in the High Court by Nicola Brookes. Ms Brookes had been subject to extremely serious abuse on Facebook after she posted a comment online supporting a contestant on the X-Factor. The abuse included the setting up of a fake Facebook page which purported to be in her name and which resulted in Ms Brookes being falsely accused of being a paedophile and drug-user. Ms Brookes’ abusers of course operated anonymously so there was no way for Ms Brookes to identify them merely by use of the site. Having then apparently failed to obtain details of the identity of the abusers directly from Facebook, Ms Brookes was obliged to apply to the court for a Norwich Pharmacal order requiring Facebook to disclose the names, email addresses and IP addresses of the people who had launched the abusive messages. It is understood that this may be the first case in which an individual has been able to secure a court order requiring Facebook to disclose personal data about its users. No doubt, this judgment (which it seems has yet to be reported) sends out an important message to those individuals who would wish to engage in anonymous cyber-bullying. However, query just how much reassurance the judgment gives to those who realistically are not in a position to incur the considerable costs entailed on engaging in the type of litigation which Ms Brookes was obliged to undertake.

The second case involved the application of s. 40 FOIA (the personal data exemption) to the names of a number of Youth Councillors, including a number of Youth Councillors who were minors, in circumstances where it was discovered after the Commissioner issued his decision notice that many of the names could be found by accessing an effectively public-facing Facebook page: Morley v IC & Surrey Heath Borough Council (EA/2011/0173).

The background to the Morley case was as follows: in 2010, the Council approved a planning application to allow for the creation of a recreation park within its area; as part of the planning process the Council unofficially consulted the Surrey Heath Youth Council; the Youth Council is funded by Surrey County Council and comprises youth councillors who are all aged between 13 and 19; after the planning application was approved, Mr Morley, who objected to the development, requested disclosure of the names of the members of the Youth Council who had been consulted by the Council; that request was refused by the Council on the basis that the names amounted to personal data which were exempt from disclosure under s. 40. It appears that after the Council refused Mr Morley’s request, Mr Morely discovered that the Youth Council had a Facebook page and, further, that information on that page included the names of various Youth Council members along with their photographs. Mr Morley’s position was that all the names should be released on the basis that there is a strong need for the planning process to be fully transparent and that this principle applied equally to those who are unofficially consulted and, indeed, irrespective of whether they may have been minors at the time they were consulted or, further, at the time of the request. He further submitted that there was in any event no proper justification for withholding the names of those Youth Councillors who had voluntarily agreed to place their data on a Facebook page which was open and accessible to anyone who registered with Facebook. The Commissioner and the Council argued before the Tribunal that all of the names should be withheld, not least because it could not be assumed that the individual Youth Councillors listed on the Facebook page had been listed at the time of the request.

By a majority decision, the Tribunal concluded that s. 40 was not engaged with respect to the Youth Councillors who were listed on the Facebook page but that it was engaged in respect of the other Youth Councillors. With respect to those Youth Councillors who were listed on Facebook, the Tribunal held as follows:

’77. … their decision to put their names and photographs into the public domain considerably diminishes the strength of the respondent’s arguments for why disclosure of their names would not be fair. In particular, arguments that they may not have expected that the information would be disclosed, that they have not consented to their names being disclosed, and that disclosure would cause them distress, rapidly fall away, in our view, where the Youth Councilors have themselves chosen to make the information available in a widely used and easily accessible social networking site, without placing any restrictions on access. In our view, it cannot be said to be unfair to disclose the names of the Youth Councillors whose names appear on Facebook’.

With respect to the argument that the names should still be withheld because it could not be assumed that the individuals in question were listed on Facebook at the time of the request, the tribunal said this:

’80. However, while we acknowledge the problems identified by the Council and Commissioner, FOIA does not require a public authority to comply with a request only when the information it holds precisely matches what the requester has asked for. A requester will often have the disadvantage of not knowing exactly what the public authority holds. What the public authority must do in this situation is to engage with the requester, pursuant to its obligations under section 16 (obligation to provide advice and assistance), to explore whether the information it does hold, even if imperfect, can satisfy the request. The Council has not done this. We do not criticise it. We are mindful that the Council was not aware of the Facebook page at the time that it refused the request, and in any event has taken the position that the information is exempt. However, the mismatch between what the Appellant has requested and what the Council can provide is not itself a reason for refusing to disclose the information under section 40(2), nor is it a basis on which disclosure can be said to be unfair’.

With respect, it is not entirely clear how these points answer the argument which the Commissioner and the Council was advancing. But perhaps the more important point emerging from this decision is that it suggests that individuals, even where they are minors, must have a substantially lower expectation of privacy in respect of their personal data in circumstances where they opt to place that data on an effectively unrestricted Facebook page.

Anya Proops

Posted in INFORMATION LAW | Comments Off on Information Law in the Facebook Age

Important new privacy judgment: police retention of protestor’s data not an Article 8 infringement

June 1st, 2012 by Robin Hopkins

The Admin Court (Gross LJ and Irwin J) has handed down judgment this week in Catt v Association of Chief Police Officers and Commissioner of Police of the Metropolis [2012] EWHC 1471 (Admin). It is an extremely important judgment on Article 8 ECHR in the context of personal information retained for policing purposes. It is also notable for its analysis of protest as an inherently public activity.

The background

ACPO launched a National Domestic Extremism Database containing information provided by police forces. The Metropolitan Police subsequently assumed responsibility for the database. The database contained information relating to the attendance by the claimant (an 87-year old protestor of good character) at various political protests made by a group called “Smash EDO”. Smash EDO opposes a US arms manufacturer with a factory in Brighton; its activities have often involved violent disorder and criminality (though apparently not by the claimant), necessitating a substantial police presence. Police officers overtly gathered information (including photographic and video material) at those protests. They then compiled reports on the protests, identifying a number of individuals including the claimant. The information at issue in this case comprised those sorts of reports – they were about incidents rather than the claimant per se, although the claimant was identified in the reports. The defendants retained that information pursuant to the statutory Code of Practice on the Management of Police Information, made under the Police Acts 1996 and 1997, and associated Guidance on the Management of Police Information.

The issues

The overarching issue was whether this infringed Mr Catt’s rights under Article 8 ECHR, the right to respect for private life.

It is important (if not entirely surprising) to note how the parties and the Court saw Article 8 and the Data Protection Act 1998 interacting (see paragraph 6(iv)). All agreed that the DPA was theoretically in play, but added nothing: if the Article 8 claim succeeded then the DPA claim was not needed; if Article 8 was engaged, but the interference was justified, then the DPA claim would automatically fail; if Article 8 was not engaged, the prospects of success under the DPA were negligibly remote.

The issues were therefore: (i) whether there was an interference with the claimant’s rights under Article 8(1), and (ii) if so, whether this interference was justified. The Court said no on both counts, by application of the authorities to three crucial findings.

Crucial findings

First, the Court accepted the need for such information to be retained by the police. Gross LJ said this at paragraph 19:

“… the use of intelligence is a fundamental policing tool.  Investigators need the ability to identify relationships within protest groups. Likewise, they need to be able to identify individuals associated with the use of particular tactics, together with those with a propensity to violence, disorderly behaviour and organised coordinated actions.  Although Mr. Catt has not been convicted of any offence, the evidence, which again I accept, is that his close association with violent members of Smash EDO and knowledge of this association is of intelligence value.  Such knowledge forms part of a “far wider picture of information”… needed by the police, inter alia, to investigate incidents of criminality and to assist the policing of future events.”

Secondly, “the essential nature of such activity [protesting] is that it is of a public nature. Indeed, its very object is to make others aware of his views and the causes to which he lends his support” (paragraph 36).

Thirdly, given the violent disorder which characterised Smash EDO’s activities, it was reasonable to expect the police to gather and retain such information. This was especially so as this information had been gathered by over rather than covert policing.

Issue 1: Article 8(1) neither engaged nor infringed

Given those findings, the Court concluded that the claimant’s rights under Article 8(1) were not engaged at all. The claimant’s reliance on R (Wood) v Commr of Police of the Metropolis [2009] EWCA Civ 414 did not assist: the facts were different, and it would be “unreal and unreasonable” to find an infringement of Article 8(1) in the present case.

Issue 2: interference would in any event be justified

The Court went on to conclude that even if there had been an interference with Article 8(1), this would be justified. The claimant had argued inter alia that he was not personally suspected of criminality and that there was no democratic oversight of the database system. The defendant argued inter alia that, given Smash EDO’s activities, the retention of this sort of information – police reports as opposed, for example, to photos or video material – was reasonably necessary and proportionate.

Gross LJ (with whom Irwin J agreed) had “no hesitation in concluding that any interference with Mr. Catt’s rights was amply justified under Art. 8.2”.

His reasons included the following (paragraph 64):

“Any interference with Mr. Catt’s Art. 8.1 rights was at the margins. The reports, the product of overt policing, did no more than record Mr. Catt’s public activities, the very object of which was to convey his views to as wide an audience as possible.  The reports were compiled and retained for intelligence purposes, in accordance with the Code and the Guidance, with a view to an appropriate police response to a campaign marred by serious, persistent criminality and posing a significant public order problem.”

Irwin J agreed that there was no expectation of privacy here, applying the approach in Campbell v MGN [2004] UKHL 22.

At paragraph 70 he added that it was not easy to see “… how it can affect the engagement of Art 8.1 that the material is recorded by police officers as opposed, say, to journalists; or collated and held within the National Extremism Database, as opposed to a local history archive in the town where the demonstrations have been held.  The latter distinction was advanced by Mr Owen (“the entries were not recorded on any database…”).  The issue is not whether the individual concerned likes or dislikes the thought of the data being held by this or that body: the issue is whether a reasonable expectation of privacy arises.  In my judgment, it does not arise in respect of any of the information in this case.”

Irwin J did, however, add this observation at paragraph 70, which might give rise to interesting arguments in future cases on such issues:

“Different questions might arise if material recorded in that context were collated with material which was private in its nature.  That does not arise in this case.”

What about ongoing retention of this information?

Gross LJ thought it sensible for the police to review its retention of this sort of information when the Smash EDO campaign concludes, but he agreed with Irwin J’s comments at paragraph that 73:

“… even when the Smash EDO campaign ends, it may yet be justifiable to retain some or all of this information.  The picture here is that there are connections between this group and parts of the animal rights movement, active before this group was formed.  It may be a legitimate function of intelligence to keep records of this group after it has ceased to be active, the better to understand the risks associated with after-coming groups with overlapping membership.  To my mind, there is no expectation that a review at a suitable point in the future will conclude otherwise.”

Robin Hopkins

Tags: , , , , , ,
Posted in INFORMATION LAW | Comments Off on Important new privacy judgment: police retention of protestor’s data not an Article 8 infringement

Statutory bars on disclosure: don’t construe too widely

June 1st, 2012 by Robin Hopkins

The Tribunal’s decision in Cubells v IC and Wrightington, Wigan & Leigh NHS Foundation Trust (EA/2011/0183) is notable for the approach taken to construing a statutory bar on disclosure for the purposes of s. 44 of FOIA. There are hundreds of bars. Usually, they were drafted prior to FOIA. Tricky issues often arise as to how widely the prohibition extends, especially in a FOIA world.

Mr Cubells’ mother died while in the care of the Trust. He complained to the Parliamentary and Health Service Ombudsman, who declined to investigate. Mr Cubells then made a request under FOIA for information passed by the Trust to the Ombudsman pursuant to his complaint, and internal Trust information about the complaint.

The Trust refused the request, relying on s. 44 of FOIA and the prohibition of disclosure imposed by s. 15 of the Health Service Commissioners Act 1993, which provides that:

“Information obtained by the [Ombudsman] or his officers in the course of or for the purposes of an investigation shall not be disclosed except-

(a) for the purposes of the investigation and any report to be made in respect of it…”

The Commissioner agreed – but the Tribunal did not. Interestingly, it allowed and considered submissions by Maurice Frankel of the Campaign for FOI in support of Mr Cubells’ appeal. Relevant points from those submissions included the following. The prohibition was designed to provide reassurance to those supplying information that no improper disclosure of that information will occur. The prohibition should not interpreted as meaning that any third party holding information which it happens also to have supplied to the Ombudsman was itself bound by the same prohibition. Otherwise, strange results would follow. For example, the Trust would be prevented from even sharing information which had been passed to the Ombudsman with a patient’s GP or another health authority into whose area the patient moved. On the ICO’s reading, the Trust would be bound indefinitely by a prohibition on disclosure apparently aimed not at the Trust but at the Ombudsman. That cannot have been what Parliament intended.

The Campaign for FOI also raised arguments under the European Convention on Human Rights: an outcome that resulted in a blanket prohibition on the disclosure of information about the medical treatment of a family member would breach Article 8 ECHR. Also, on the ICO’s reading, the prohibition would extend to a complainant as well – in other words, if a complainant passed information to the Ombudsman, they would thereafter be prohibited from disclosing it further. That would breach Article 10 ECHR.

Before the Tribunal, the ICO relied on the judgment of Mrs Justice Dobbs in R (on the

application of Kay) v Health Service Commissioner [2008] EWHC 2063 (Admin) in contending that the prohibition should regarded as extending to both those to whom information was passed by the Ombudsman as well as those from whom the Ombudsman obtained it.

The Tribunal disagreed. It distinguished Kay and concluded that the prohibition:

“should be interpreted as imposing a prohibition only on the Ombudsman and her staff. It may follow, from what we have said above, that the prohibition should continue to apply, or should be imposed, if the Ombudsman needs to disclose any of the information she has obtained to a third party. There is no inconsistency there. The information, once obtained during an investigation, should obviously not be released from the prohibition on disclosure just because it becomes necessary for the Ombudsman to disclose it to a third party. There is no logical reason, however, for the prohibition to be imposed on those holding information that has been shared with the Ombudsman. The profoundly unattractive consequences which Mr Frankel outlined demonstrate the absurdity of such an outcome.”

In reaching its conclusion, the Tribunal did not need to consider the ECHR arguments. Those arguments may well, however, be raised again in future cases.

Robin Hopkins

Tags: , ,
Posted in INFORMATION LAW | Comments Off on Statutory bars on disclosure: don’t construe too widely

Section 40 FOIA, NCND and the public interest

June 1st, 2012 by Robin Hopkins

The requester (anonymised for the purposes of the decision) in Mr A v IC and The Health Professions Council (EA/2011/0223) asked for information about the response given by a named registrant to an investigation allegedly being carried out by the HPC into that registrant’s fitness to practice. The IC found that a ‘neither confirm nor deny’ response was appropriate, given that to confirm or deny (NCND) whether or not the HPC held the information requested would in and of itself disclose to the public whether there a complaint as to the registrant’s fitness to practise had been made. This would breach the first data protection principle. Section 40(5)(b)(i) FOIA therefore applied.

The Tribunal agreed. Curiously, it approached its task under section 58 FOIA thus: “The Tribunal does not take the IC’s decision again, rather its task is to consider the Decision Notice and to consider whether it can be impugned on legal grounds.”

Its decision turned largely on the usual features of a request for personal data: privacy implications, reasonable expectations and so on. The Tribunal’s decision does, however, contain a number of points of interest concerning the correct approach to section 40.

First, when judging whether, for section 40(5) purposes, confirmation or denial would breach any of the data protection principles, the appropriate reference point was disclosure to the public, not disclosure to the individual requester, given the overall wording of section 40 and the ‘motive blind’ approach to FOIA. The Upper Tribunal in All Party Parliamentary Group on Extraordinary Rendition v Information Commissioner [2011] UKUT 153 (AAC) appeared to think otherwise, but its observation was obiter, and the Tribunal in the present case declined to follow it.

Secondly, it followed that for the purposes of condition 6(1) of Schedule 2 to the DPA (which refers to the “legitimate interests of the … third party or parties to whom the data are disclosed”), the appropriate reference point was again the public. Public rather than private interests are what count for condition 6(1) purposes.

Finally, the NCND provisions of section 40(5) do not appear in the list of absolute exemptions at section 2(3)(f) of FOIA. Does this mean the public interest test must be applied, even where – as the Tribunal had found – disclosure would breach the first data protection principle? The Tribunal agreed with the IC and the HPC that the answer is ‘no’. It followed Heath v IC (EA/2009/0020) in finding that the word ‘provision’ at section 2(1) FOIA is sufficiently ambiguous (as to whether it means a section of FOIA as a whole, or rather subsections) to admit of a purposive interpretation. In these circumstances, this allowed for data protection principles to be given primacy; no public interest question under section 2(2) of FOIA arose.

Robin Hopkins

Tags: , ,
Posted in INFORMATION LAW | Comments Off on Section 40 FOIA, NCND and the public interest

« Older Entries
Newer Entries »