The High Court has recently handed down a judgment in a really interesting case concerning the legality of disclosures of census data by the UK Statistics Board. Every decade since 1801, householders in England and Wales have been required to complete a national census form. Failure to complete the form amounts to a criminal offence. The most recent census was conducted by the newly established UK Statistics Board (“the Board”) in 2011. The Board was established by the Statistics and Registration Act 2007 (“SRA”). Under s. 39(1) SRA, the Board’s employees are subject to a general duty not to disclose personal data acquired pursuant to the census. However, s. 39(4) creates a number of specific exemptions in respect of that general duty. Not least, under s. 39(4)(f), the Board has a specific power to disclose census data amounting to personal data (including sensitive personal data) where the disclosure is made ‘for the purposes of a criminal investigation or criminal proceedings (whether or not in the United Kingdom)’.
In R (Ali & SJ) v Minister for the Cabinet Office & Statistics Board (2012) [2012] EWHC 1943 (Admin), the claimants challenged the legality of s. 39(4)(f) on the basis that it infringed the right to privacy under Article 8(2) and, further, was incompatible with the requirements of the Data Protection Act 1998, as enacted under Directive 95/46. The nub of the claimants’ concern was that the power afforded under s. 39(4)(f) allowed for relatively indiscriminate disclosures of personal data, including sensitive personal data, to foreign authorities.
The claimants challenged in particular the following features of the regime embodied in s. 39(4)(f):
(1) s. 39(4)(f) did not impose any disclosure criteria which meant that disclosures could be effected under s. 39(4)(f) irrespective of the circumstances of the particular case, including the seriousness of the alleged offence;
(2) there was no requirement on the part of the Board to notify data subjects of any proposed disclosure under s. 39(4)(f) with the result that they had no opportunity to object to the disclosure and
(3) s. 39(4)(f) did not operate so as to require the imposition of restrictions on the use of the disclosed personal data by any recipient third party authorities.
The Board’s position was that there was no illegality in the regime afforded under s. 39(4)(f). This was particularly because, as a public authority, the Board was in any event required under s. 6 of the Human Rights Act 1998 to act compatibly with Article 8 as and when it was deciding whether or not to disclose the requested data. The Board also relied on the policy which it applied to the exercise of the power afforded under s. 39(4)(f). Under the policy, the Board will not disclose data voluntarily, will refuse requests if it considers that is the lawful result and will contest any legal challenge to its decisions. In effect, the Board argued that the safeguards necessary to protect the rights of data subjects were imported into the s. 39(4)(f) disclosure regime by both the HRA 1998 and the Board’s policy on the application of s. 39(4)(f).
The Court preferred the Board’s case and accordingly the claims were dismissed. In reaching the conclusion that the Board’s policy offered sufficient safeguards to protect the rights of data subjects, the Court took into account not least that the Board had, to date, applied its policy so as to refuse every request made by police forces or defendants in criminal proceedings and, indeed, had only disclosed data under s. 39(4)(f) in response to court orders. In common with many judgments in this area, the Court was of the view that the s. 39(4)(f) regime was lawful irrespective of whether it was considered through the prism of Article 8 or through the prism of the DPA. In effect, the two legal regimes, perfectly dovetailed with one another. The judgment offers a very clear analysis of the principles applicable under Article 8 and the DPA in respect of the proposed disclosure of personal data. Its analysis of the issues of notification of the data subject and the use of court orders requiring disclosure is particularly worthy of note (see further para. 73 et seq).
Anya Proops