Last year I blogged about a decision of the Upper Tribunal in the vacant properties case, Voyias v IC & Camden LBC, where the Upper Tribunal overturned the decision of the First Tier Tribunal (FTT) in favour of Mr Voyias and remitted the case to a differently constituted FTT (see my post here). The FTT’s decision on the remitted case has just been handed down – see the decision here. The issue which the FTT had to decide upon remission was whether was whether the Camden LBC (the Council) had correctly concluded that it was entitled to refuse to disclose to Mr Voyias information identifying vacant properties in its area on the ground that the requested information was exempt from disclosure under s. 31(1)((a) FOIA (the prevention and detection of crime exemption). The particular issues the FTT had to decide were: (a) whether the requested information engaged the exemption provided for under s. 31(1)(a) and (b) whether the public interest balance weighed in favour of the exemption being maintained. In a decision which was very robustly in favour of the Council, the FTT held that the requested information had been lawfully withheld. This decision is in stark contrast with the decision reached by the original FTT which upheld Mr Voyias’ appeal in respect of the Council’s refusal.

In deciding that the requested information was lawfully withheld, the FTT was plainly mindful of the guidance given by the Upper Tribunal that, when determining whether the public interest balance weighed in favour of maintaining the s. 31(1)(a) exemption, regard should be had, not merely to the direct adverse consequences of the disclosure but also to any indirect consequences which arose as ‘realistic possibilities’. Ultimately, the FTT concluded that ‘the small weight that the public interest in disclosure bears does not come close to equalling the public interest in preventing the categories of crime we have identified in this decision’ (§55). Thus, a very strong decision in favour of the Council. No doubt the former Housing Minister, Grant Schapps MP, who scathingly described the original FTT decision as a ‘squatters’ charter’, will be substantially relieved by the new decision.

11KBW’s Ben Hooper was for the Council and Chris Knight was for the Commissioner.

Anya Proops

The Information Commissioner’s Office (“ICO”) has published its response to the recommendations that Lord Justice Leveson made to the ICO and the Ministry of Justice (“MoJ”) in his Inquiry Report on the Culture, Practices and Ethics of the Press.  See here for the full response.

The ICO begins its response by reminding us of the leading role that the ICO played in revealing the press involvement in the unlawful trade in personal data in 2003 (Operation Motorman) which ultimately led to the Leveson Inquiry.

The ICO also emphasises that the Leveson Inquiry focused on events that took place between 2003 and 2007 and so Leveson’s Report does not take into account the significant strides that the ICO has made in recent years, in particular in its Regulatory Action Division and Enforcement Department and through its power to impose civil monetary penalties.

Nonetheless, the ICO is broadly welcoming of the vast majority of Leveson’s recommendations.  See Rachel Kamm’s post of 29 November 2012 for details of those recommendations.

In response to Leveson, the ICO will be:

• Revising its Data Protection Regulatory Action Policy so that it specifically addresses how the ICO will use its regulatory powers to ensure that the press complies with the legal requirements of the data protection regime (by March 2013);
• Developing a new Code of Practice on appropriate principles and standards to be observed by the press in the processing of personal data (hopefully within 6 months) – watch out for consultation on this;
• Developing guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights (by May 2013) – watch out for a new dedicated media data rights advice on the ICO’s website;
• Providing regular reports to Parliament (through its statutory Annual Report) on the effectiveness of the new measures and on the culture, practices and ethics of the press in relation to the processing of personal data;
• Continuing to work with other prosecuting authorities in relation to alleged media crime (the ICO has already adopted the CPS Guidelines for Prosecutors);
• Allocating specific responsibility for managing relations with the press and key stakeholders to the Government and Society team in its Strategic Liaison Dept and looking to establishing a media reference panel along similar lines to its existing Technology Reference Panel to ensure that a ready source of expertise is available to the ICO on key media issues;
• Establishing an Intelligence Hub to make sure that the ICO identifies existing and emerging large-scale issues more quickly, as well as refining its process for handling high profile cases with significant policy or political implications;
• Ensuring that its Management Board comprises people with suitable expertise from a range of backgrounds, including the media.

As to Leveson’s suggestions for amendments to the Data Protection Act 1998 (“DPA”) (see Rachel Kamm’s previous post), the ICO says that he can “see the merit in certain changes but not all of them” and emphasises that it is a matter for Parliament to determine whether the ICO should have a wider role in press regulation – the ICO is not actively seeking such a role.  Thus, while apparently

• broadly in favour of ‘tightening up’ the current exemption from the provisions of the DPA for data processed for journalistic purposes,
• strongly in favour of allowing individuals to claim damages for any breach of the DPA, even if it does not result in pecuniary loss, and
• strongly in favour of bringing in ss 77 and 78 of the Criminal Justice and Immigration Act 2008 (increased sentences for criminal breaches of the DPA and enhanced defence for public interest journalism),

the ICO nevertheless sounds some notes of caution:

• The ICO observes that Leveson’s proposed amendments to s 32 of the DPA would move the ICO much closer to being a general regulator of the press.  Section 32 currently provides an exemption from most of the requirements of the DPA for data processing undertaken ‘with a view to the publication’ of journalistic material, provided that the data controller reasonably believes would be in the public interest, ‘having regard … to the special importance of the public interest in freedom of expression’ and the data controller reasonably believes that compliance with the relevant part of the DPA would be ‘incompatible’ with the journalistic purpose.  Leveson proposes amending the exemption so that the processing must be ‘necessary’ for publication, so that no special weight is given to freedom of expression and so that the decision on whether the exemption applies is to be taken objectively rather than on the basis of the data controller’s reasonable belief.  The latter proposed change is most significant in terms of the role of the ICO.

• The ICO points out that the new draft European Data Protection Regulation will require a number of changes to UK data protection law and therefore suggests that the Government may wish to consider how far it is sensible and practicable to introduce legislative changes ahead of the adoption of the new European Regulation.

• The ICO says that Leveson’s recommendation that the press should never be exempt from the subject access rights in the DPA raises legitimate concerns about the ‘chilling effect’ that this might have on investigative journalism and says this area will need very careful consideration.

• The ICO questions whether it is necessary to include specific provisions in the DPA requiring the IC to have special regard to the legal obligation to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime, pointing out that he is already subject to that duty by virtue of s 6 of the Human Rights Act 1998.

• Similarly, the ICO suggests that there is no need to enshrine in statute a duty to consult with the CPS and other enforcement agencies, but that is already something done as a matter of course.  The ICO became a signatory to the Prosecutor’s Convention in July 2012 (an agreement between all the main government related prosecuting bodies to collaborate on cases that overlap jurisdictional areas).

• The ICO points out that Leveson’s proposal to widen the ICO’s powers of prosecution to include any crimes that are likely to involve breaches of data protection principles, e.g. phone hacking, computer hacking, etc would substantially increase the ICO’s role as an investigatory and prosecuting authority which would bring with it significant resource implications.

• While agreeing that the opportunity should be taken to consider the structure of the ICO and whether it would be better to have an Information Commission (i.e. a Board of Commissioners leading the organisation) rather than a single Information Commissioner, the ICO indicates that such a change would risk losing certain virtues of the current arrangements, which include the ability for the organisation to take decisions quickly where necessary and the higher degree of accountability that comes from having a single figurehead.

 Holly Stout

The First-Tier Tribunal’s decision of 13 December 2012 in Montague v (1) Information Commissioner (2) Liverpool John Moores University EA/2012/0109 will be of interest to academic institutions, and any other public bodies whose employees have research interests not necessarily connected with their job. Anya Proops of 11KBW appeared for the University.

The Appellant Mr Montague asked Liverpool John Moores University for copies of emails sent by a senior lecturer at the University from his University email account, linked to his work with the Global Warming Policy Foundation (“GWPF”). The lecturer in question had worked at the University from November 1993 to July 2010 as a social anthropologist. In November 2009, he had become Director of the GWPF. The GWPF is a controversial organisation founded under the aegis of Lord Lawson, which promotes scepticism about man-made climate change.

The question at issue was whether the University “held” the information for the purposes of the Freedom of Information Act 2000 (“FOIA”), even if it was in fact contained in a university email account to which it had access.

Information is “held” by an authority for the purposes of FOIA if it is held by the authority “otherwise than on behalf of another person”, or is held by another person “on behalf of the authority”: see s.3(2) FOIA. That means mere physical possession of information is not enough to establish that information is “held”; it must also, to a sufficient extent, be meaningfully connected to the authority: see for example University of Newcastle v IC and BUAV [2011] UKUT 185 (AAC).

Both the University and the ICO considered that the University did not “hold” the information in this case, and the Tribunal agreed. The crucial point was that there was no connection between the lecturer’s private research for the GWPF, and the work he did within the University. The lecturer pursued the subject of global warming in his own free time, and exclusively in his own private interest. It had no bearing on his role as an academic employed in the University’s School of Sport and Exercise Science. The research was not funded by the University, and the University neither had any interest in the research nor sought to benefit from it. Since the emails were sent in a purely private and personal capacity, the University did not “hold” them.

This outcome is plainly in accordance with FOIA, and was perhaps inevitable on the facts. It should be of comfort to academic institutions whose lecturers pursue private interests. Of course, the situation would have been very different if the research had been connected in any way with the lecturer’s post. The decision can usefully be compared and contrasted with the ICO’s recent decision concerning emails sent by the Secretary of State for Education (Michael Gove) from his private email account. There, the information was in fact “held” by the Department for Education for the purposes of FOIA, even though the Department was not in physical possession of the information, because the ICO considered it concerned the business of the Department, rather than purely party political matters. The thread running through the two contrasting decisions is the same: what matters is not whether the authority actually has possession of the information, but whether the information has a substantial connection to its business.

Julian Milford

Lord Justice Leveson has today published his eagerly awaited report into the culture, practices and ethics of the press.  The key proposal which will shape the future of press regulation is the recommendation to create an independent self-regulatory body, governed by an independent board. Of particular interest to information lawyers is the discussion of the extent to which the current legal, policy and regulatory framework has failed in relation to data protection. In this respect, the Report considers the lessons that can be learned from the practices of the press in relation to data handling and processing, makes bold recommendations in relation to legislative reform and further considers a bolstering of the Information Commissioner’s role and function.  The principal parts of the report dealing with the Data Protection Act 1998 (“DPA”) and ICO are Volume III, Part H and Volume IV, Appendix 4, Part 4.

Data protection: a key element of privacy rights

A key part of the Leveson Inquiry has been to consider the extent to which the press has unjustifiably interfered with the privacy of individuals in a manner which cannot be justified in the public interest. In this context, invasion of privacy does not mean simply through the publication of articles which intrude into the details of individuals’ private lives, but rights of individuals to keep personal information private, and rights restricting how personal information is processed by journalists. The Inquiry’s Terms of Reference expressly required Lord Justice Leveson to consider the extent to which the current policy and regulatory framework has failed in relation to data protection. The Inquiry provided a fresh and independent perspective for considering the DPA and the role of the ICO.

Historic difficulties in investigating and regulating data protection breaches by the press

Operation Motorman was an investigation by the ICO into the conduct of a private investigator, Steve Whittamore, which revealed that a significant amount of personal data was being sought by journalists working for most of the major newspaper groups. The data was being obtained by Mr Whittamore in breach of s.55 DPA (for example, through payments to public officials for details from a DVLA database, or through the blagging of friends and family telephone numbers from BT) and subsequently supplied to journalists. Mr Whittamore was prosecuted, but no journalist was interviewed by the ICO or subjected to enforcement action or prosecution. The Report highlights that the investigation produced a ‘treasure trove’ of evidence of serious and systemic illegality and poor practice in the acquisition and use of personal information which could have spread across the press as a whole. It also questions why the ICO failed to interview journalists or prosecute journalists for breach of the DPA, and notes that two reports laid before Parliament by the ICO had set out the evidence of a flourishing and unlawful trade in confidential personal information.

The Report highlights that one of the difficulties encountered by the ICO in pursuing breaches of data protection legislation against the press arose from deficiencies in the legal framework, which “puts unnecessary and inappropriate barriers in the way of regulatory law enforcement and the protection of victims’ rights”. Perhaps for this reason, amendments to the legal framework form a key part of the recommendations on data protection reform.

Recommendations to amend data protection legislation

Section 32 of the DPA restricts the circumstances in which the ICO can exercise most of its powers in relation to the press. Section 32 operates by disapplying a number of investigative and enforcement powers in circumstances where the data processing falls within section 32, namely where (i) the processing is undertaken with a view to the publication by any person of any journalistic material; (ii) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest; and (iii) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.

The Report recommends that section 32 should be amended so as to make it available only where: (a) the processing of data is necessary for publication, rather than simply being in fact undertaken with a view to publication; (b) the data controller reasonably believes that the relevant publication would be or is in the public interest, with no special weighting of the balance between the public interest in freedom of expression and in privacy; and (c) objectively, that the likely interference with privacy resulting from the processing of the data is outweighed by the public interest in publication. These amendments would render it more difficult for those organisations processing data for the purposes of publication to bring themselves within the scope of s.32. The proposed amendments seek to re-set the balance between the public interest in freedom of expression and the public interest in personal information privacy.

Further, the report recommends that the extent to which s.32 disapplies provisions of the DPA should be reduced and  that the processing of data by the press should be subject to the following obligations (which previously attracted exemption):

•  the requirement of the first data protection principle to process personal data fairly (except in relation to the provision of information to the data subject under paragraph 2(1)(a) of Part II Schedule 1 to the DPA) and in accordance with statute law;
•  the second data protection principle (personal data to be obtained only for specific purposes and not processed incompatibly with those purposes);
• the fourth data protection principle (personal data to be accurate and kept up to date);
•  the sixth data protection principle (personal data to be processed in accordance with the rights of individuals under the Act);
•  the eighth data protection principle (restrictions on exporting personal data); and
• the right of subject access (subject to further investigation and clarification of protection of journalists’ sources).

Recommendations for procedural amendments

The Report recommends:

• The repeal of certain procedural provisions of the DPA with special application to journalism (namely section 32(4) and (5) and sections 44 to 46). The purpose of this is to give the ICO, and the Courts, greater powers to consider breaches of data protection without procedural hurdles in place, for example repealing section 32(4) would allow Courts to consdier preventing the Courts considering the complaint whilst the ICO determines whether the data controller has been processing the date for the purposes of journalism;
• In conjunction with the repeal of those procedural provisions, consideration should be given to the desirability of including in the DPA a provision to the effect that, in considering the exercise of any powers in relation to the media or other publishers, the ICO should have special regard to the obligation in law to balance the public interest in freedom of expression alongside the public interest in upholding the data protection regime;
• Specific provision should be made to the effect that, in considering the exercise of any of its powers in relation to the media or other publishers, the ICO must have regard to the application to a data controller of any relevant system of regulation or standards enforcement which is contained in or recognised by statute; and
• To further strengthen individuals’ rights, the right to compensation for distress conferred by section 13 of the DPA is not restricted to cases of pecuniary loss, but should include compensation for pure distress.

ICO’s powers of prosecution

In his evidence to the Inquiry, the former Information Commissioner Richard Thomas described the ICO as “primarily not a prosecuting authority. That was almost on the side”. The main formal power in the event of non-compliance was the ‘enforcement notice’, which could specify and require compliance action subject to the back-up sanctions of court enforcement, although this was not frequently used. Prosecution powers were limited to section 55 of the DPA and did not extend, for example, to other offences such as phone hacking (although this might also technically involve a section 55 DPA breach).

The Report recommends that:

• The necessary steps should be taken to bring into force the amendments made to section 55 of the DPA by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent of the maximum specified period; and by section 78 of the 2008 Act (enhanced defence for public interest journalism);
• The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.
• A new duty should be introduced (whether formal or informal) for the ICO to consult with the Crown Prosecution Service in relation to the exercise of its powers to undertake criminal proceedings;
• The ICO should immediately adopt the Guidelines for Prosecutors on assessing the public interest in cases affecting the media, issued by the Director of Public Prosecutions in September 2012; and
• The ICO should take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to ensuring that it is well placed to fulfil any necessary role in this respect in the future, and in particular in the aftermath of Operations Weeting, Tuleta and Elveden.

Recommendation to issue guidance

The Report includes a number of recommendations directed at the ICO in relation to its provision of guidance and advice. In particular, it recommends that the ICO should issue good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. Further, it should issue guidance to the public on their individual rights in relation to the press and their personal data and also advice for data subjects who are concerned that their data may have been processed by the press unlawfully or otherwise than in accordance with good practice. In full:

• The ICO should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime.
• In discharge of its functions and duties to promote good practice in areas of public concern, the ICO should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on appropriate principles and standards to be observed by the press in the processing of personal data. This should be prepared and implemented within six months from the date of this Report.
• The ICO should take steps to prepare and issue guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights.
• In particular, the ICO should take immediate steps to publish advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice.
• The ICO, in the Annual Report to Parliament which it is required to make by virtue of section 52(1) of the DPA, should include regular updates on the effectiveness of the foregoing measures, and on the culture, practices and ethics of the press in relation to the processing of personal data.

Strengthening the ICO

The Report recommends that the opportunity should be taken to consider amending the DPA formally to reconstitute the ICO as an Information Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public administration, law and business, and active consideration should be given in that context to the desirability of including on the Board a Commissioner from the media sector.

The Report recommended to the ICO that:

• It should take the opportunity to review the availability to it of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it; and
• It should take the opportunity to review its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions (including the relationship between the culture, practices and ethics of the press in relation to personal information on the one hand, and the application of the data protection regime to the press on the other) can be satisfactorily considered and addressed in the round.

Rachel Kamm

(11KBW’s Heather Emmerson was instructed by the Treasury Solicitor as part of the team of Counsel to the Leveson Inquiry.)

This week, the Court of Appeal heard the cases of R (T) v Chief Constable of the Greater Manchester Police and others and R (JB) v the Secretary of State for the Home Department.  These are the latest in a series of cases challenging whether the criminal records checks regime is compatible with the Convention.  Unlike previous cases, which have concerned the disclosure of “soft information” held on local police computer systems, these cases raise in stark terms the compatibility of s.113B(3)(a) of the Police Act 1997 with Article 8.  This requires the disclosure of all convictions, cautions, warnings and reprimands on an Enhanced Criminal Records Certificate (“ECRC”).  In T’s case, his ECRC disclosed a warning he had been given for stealing a bicycle when he was 11.  In JB’s case, her ECRC disclosed a caution for shoplifting given eight years before the check.

Was there an interference?

The first issue to be considered by the Court is whether there is any interference with Article 8.  Following R (L) v Commissioner of Police for the Metropolis [2010] 1 AC 410 M.M. v United Kingdom (Application no. 24029/07), it is clear that a person’s Article 8 rights will be engaged by disclosure of their past convictions in two situations:  if the disclosure has a direct effect on their employment opportunities; or if their convictions are sufficiently long ago that they have become part of their private life.

Neither T nor JB lost employment opportunities as a direct result of the ECRC.  T risked losing a place on his degree course, but was eventually permitted to finish.  JB was told that one agency would not put her forward for work as a carer.  However, she may be able to work with other agencies.

The question is whether the disclosure of this information on an ECRC will necessarily interfere with the right to respect for private life, even if it does not affect the subject’s employment opportunities.  In favour of this proposition, it was argued that because a caution or warning is given in private, as it recedes into the past, it becomes part of the subject’s private life.  Similarly, as a conviction recedes into the past, it could also become part of the subject’s private life.  Against it, it was argued that the conviction and warning were too recent to have become part of the Claimants’ private lives.

Was any interference justified?

The question of whether any interference was justified turns on both principled arguments and the effect of a number of key decisions in this area.

As to the principles, the Claimants, Liberty and the EHRC argued that it was disproportionate to require blanket and indiscriminate disclosure of all convictions, cautions, warnings and reprimands, no matter how old and how relevant to the purpose for which the ECRC was obtained.  Counsel for the Secretary of State argued that designing the criminal record checks regime involves striking a balance between important and conflicting interests. This is a matter for Parliament.  Parliament has resolved to leave it up to employers to decide whether an offence is minor or irrelevant.  This solution allows for an automated, rule-based process for undertaking the ECRC.  Therefore, he argued, this is a reasonable solution.

In addition to this analysis of the principles, arguments on justification focused on the effect of three key authorities:

1. R (L) v Commissioner of Police for the Metropolis [2010] 1 AC 410.  The Court of Appeal was asked to consider whether the majority of the Supreme Court in L had decided that the Act was compatible with Article 8 insofar as it required disclosure of all convictions and cautions.  There was also debate as to whether L is incompatible with the later Supreme Court decision that the notification obligations on sex offenders were incompatible with Article 8 (R (F) v Justice Secretary [2011] 1 AC 331).
2. Chief Constable of Humberside Police and others v Information Commissioner [2010] 1 WLR 1136:  A week before the decision in L, the Court of Appeal had held that the retention of information regarding criminal convictions was justified.  The question for the Court of Appeal now is whether this decision is distinguishable on the grounds that it concerned retention, rather than disclosure, of information.
3. M.M. v United Kingdom (Application no. 24029/07):  Only two weeks ago, the Strasbourg Court held that the arrangements in Northern Ireland for the indefinite retention of data relating to a person’s criminal caution infringe Article 8 of the ECHR (read Charles Bourne’s blog post on this case here).  The disclosure of this data in criminal record checks was also found to infringe Article 8, as the statutory scheme did not provide sufficient safeguards to protect the data from disclosure in breach of Article 8.  Therefore, the interference with the Applicant’s Article 8 rights was ‘not in accordance with the law’.  Before the Court of Appeal, it was argued by the Government that MM: was wrongly decided; was distinguishable on its facts; does not embody any clear constant jurisprudence of the Strasbourg Court and cannot in any event be followed because of the effect of the Supreme Court’s decision in L.

Is the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (SI 1975/1023) ultra vires?

This additional issue was only raised in T.  Applicants for jobs covered by the Order have to answer truthfully any questions from prospective employers about their spent convictions and cautions.  Applicants for jobs falling outside the scope of the Order are permitted to answer untruthfully.  The question is whether the Order is ultra vires because it is incompatible with Article 8 to (in effect) require prospective employees for certain positions to disclose all of their convictions and cautions.  There was argument as to whether striking down the Order would improperly impose a positive obligation on the State to permit employees to give untruthful answers.  The Court is also asked to consider whether the compatibility of the Order is really a distinct issue from the compatibility of s.113B(3)(a) of the Police Act.

Judgment is awaited.

Jason Coppel represented the Home Secretary in both cases and the Justice Secretary in T.  Tim Pitt-Payne QC represented Liberty, intervening in T.

Hannah Slarks

The Information Commissioner has published a new code of practice on “Anonymisation: managing data protection risk“.

Under the Data Protection Act 1998, the definition of personal data does not include information relating to an individual if that individual cannot be identified from that information together with all other information which is in the possession of, or is likely to come into the possession of, the data controller. It follows that where an organisation holds data relating to individuals which is anonymised, or where it is deciding whether or not to anonymise its data, it will need to consider carefully whether the anonymisation method means that the information falls outside the scope of the DPA or not.  The 100+ page code includes guidance and practical examples to assist organisations in assessing their options in relation to anonymisation. This guidance will not only be useful in relation to DPA obligations, but also where an organisation is considering anonymising data in order to respond to a Freedom of Information request. Note that whilst the code gives advice on good practice, it is not mandatory to comply with its recommendations where they go beyond the obligations under the DPA; it  is issued under section 51 of the DPA, but it is not legally enforceable.

In addition to the new Code of Practice, the ICO has announced that “a consortium led by the University of Manchester, with the University of Southampton, Office for National Statistics and the government’s new Open Data Institute (ODI), will run a new UK Anonymisation Network (UKAN). The Network will receive £15,000 worth of funding from the ICO over the next two years to enable sharing of good practice related to anonymisation, across the public and private sector. The network will include a website, case studies, clinics and seminars“.

Rachel Kamm

Last week I blogged about an important High Court judgment concerning the legality of the Government’s Child Sex Offender Disclosure Scheme: X(South Yorkshire) v Secretary of State for the Home Department. In that judgment, the court held that, in order to be lawful, the scheme would need to build in a requirement that, in general, registered sex offenders be given an opportunity to make representations prior to the disclosure of their data to third parties. It is worth noting that the approach adopted in X chimes very closely with the approach adopted in a case concerning enhanced CRB checks which was decided on 18 October 2012: R (on the Application of J) V Chief Constable Of Devon & Cornwall [2012] EWHC 2996 (Admin).

The case of J involved a nurse who objected to the fact that information had been recorded in her enhanced criminal record certificate (EHRC) without her knowledge. The information concerned allegations which had been made against J in connection with incidents in which she had apparently been heavy handling elderly patients. J claimed that the information, which was contained within the ‘certain other information’ section of the certificate, was partial and did not give a complete picture of the circumstances surrounding the incidents in question. She claimed that inclusion of the information in the EHRC, which had been provided to J’s prospective employers, was disproportionate and constituted an unlawful interference with her right to privacy under Article 8. The court agreed. The court went on to make clear that the decision-making process relating to the EHRC had in any event been fatally flawed as a result of the fact that J had not been given an opportunity to make representations about the information prior to its inclusion in the certificate.

What we see emerging from both X and J is a re-affirmation of the importance of the principle of natural justice in the context of the disclosures of information about individuals which are designed in principle to protect vulnerable third parties against the risk of harm.

Anya Proops

The High Court has today handed down an important judgment on the legality of the Government’s Child Sex Offender Disclosure Scheme (CSOD): X(South Yorkshire) v Secretary of State for the Home Department [2012] EWHC 2954 (Admin). CSOD is a non statutory scheme which police forces nationally have been free to adopt since 2010. It enables members of the public to ask the police to provide details of a person who has some form of contact with children with a view to ascertaining whether that person had convictions for sexual offences against children or whether there is other relevant information about him or her which ought to be made available.

X is a registered child sex offender. In February 2011, South Yorkshire Police contacted X and informed him that it had adopted CSOD and that its adoption might affect him. X went on to mount a judicial review challenge to the guidance under which CSOD had been constituted (the guidance). The challenge was brought on two separate grounds. First, it was argued that the guidance did not adequately recognise the imperative for police forces to consult with individual sex offenders prior to disclosing information about them under CSOD. Second, it was argued that because, in its opening paragraphs, the guidance provided that there was a presumption in favour of disclosure, the guidance did not properly reflect the need for a balancing exercise to be conducted prior to any decision to disclose being taken.

On the first of these issues, the High Court, presided over by the QB President and Hickenbottom J, accepted that the guidance did not sufficiently reflect the need to consult with individual sex offenders prior to effecting disclosure. In particular, the court held that:

In the light of the considerations we have set out, it follows, in our judgment, that the CSOD Guidance ought to have set out a requirement that the decision maker consider, in the case of any person about whom disclosure might be made, whether that person be asked if he wishes to make representations.  In the generality of cases without that person being afforded such an opportunity, the decision maker might not have all the information necessary to conduct the balancing exercise which he is required to perform justly and fairly.  Whilst each case will turn on its own facts, it is difficult to foresee cases where it would be inappropriate to seek representations, unless there was an emergency or seeking the representations might itself put the child at risk´(§41)

On the second issue, the court held that, notwithstanding the allusion to a ‘presumption’ in favour of disclosure in its opening paragraphs, the guidance did properly incorporate a requirement that the police undertake a balancing exercise which took into account both the rights of the sex offender not to have the information disclosed and the need to protect individual children from harm. The court held that the regime embodied in the guidance properly complied with the approach which was approved
in R v Chief Constable of North Wales ex p Thorpe [1999] QB 396.

The judgment is interesting and important not least because it suggests that the current legal regime governing the disclosure of information relating to sex offenders is still far removed from a ‘Megan’s law’ US-style approach to disclosure. Thus, in contrast with Megan’s law, where the general public are allowed access to details of convicted sex offenders living in a particular area, sex offenders in this country retain a right to privacy in respect of information relating to their offences, albeit that that right may lawfully be interfered with on a case by case basis. 11KBW’s Jason Coppel appeared on behalf of the Home Secretary.

Anya Proops