Last week I blogged about an important High Court judgment concerning the legality of the Government’s Child Sex Offender Disclosure Scheme: X(South Yorkshire) v Secretary of State for the Home Department. In that judgment, the court held that, in order to be lawful, the scheme would need to build in a requirement that, in general, registered sex offenders be given an opportunity to make representations prior to the disclosure of their data to third parties. It is worth noting that the approach adopted in X chimes very closely with the approach adopted in a case concerning enhanced CRB checks which was decided on 18 October 2012: R (on the Application of J) V Chief Constable Of Devon & Cornwall [2012] EWHC 2996 (Admin).

The case of J involved a nurse who objected to the fact that information had been recorded in her enhanced criminal record certificate (EHRC) without her knowledge. The information concerned allegations which had been made against J in connection with incidents in which she had apparently been heavy handling elderly patients. J claimed that the information, which was contained within the ‘certain other information’ section of the certificate, was partial and did not give a complete picture of the circumstances surrounding the incidents in question. She claimed that inclusion of the information in the EHRC, which had been provided to J’s prospective employers, was disproportionate and constituted an unlawful interference with her right to privacy under Article 8. The court agreed. The court went on to make clear that the decision-making process relating to the EHRC had in any event been fatally flawed as a result of the fact that J had not been given an opportunity to make representations about the information prior to its inclusion in the certificate.

What we see emerging from both X and J is a re-affirmation of the importance of the principle of natural justice in the context of the disclosures of information about individuals which are designed in principle to protect vulnerable third parties against the risk of harm.

Anya Proops

The High Court has today handed down an important judgment on the legality of the Government’s Child Sex Offender Disclosure Scheme (CSOD): X(South Yorkshire) v Secretary of State for the Home Department [2012] EWHC 2954 (Admin). CSOD is a non statutory scheme which police forces nationally have been free to adopt since 2010. It enables members of the public to ask the police to provide details of a person who has some form of contact with children with a view to ascertaining whether that person had convictions for sexual offences against children or whether there is other relevant information about him or her which ought to be made available.

X is a registered child sex offender. In February 2011, South Yorkshire Police contacted X and informed him that it had adopted CSOD and that its adoption might affect him. X went on to mount a judicial review challenge to the guidance under which CSOD had been constituted (the guidance). The challenge was brought on two separate grounds. First, it was argued that the guidance did not adequately recognise the imperative for police forces to consult with individual sex offenders prior to disclosing information about them under CSOD. Second, it was argued that because, in its opening paragraphs, the guidance provided that there was a presumption in favour of disclosure, the guidance did not properly reflect the need for a balancing exercise to be conducted prior to any decision to disclose being taken.

On the first of these issues, the High Court, presided over by the QB President and Hickenbottom J, accepted that the guidance did not sufficiently reflect the need to consult with individual sex offenders prior to effecting disclosure. In particular, the court held that:

In the light of the considerations we have set out, it follows, in our judgment, that the CSOD Guidance ought to have set out a requirement that the decision maker consider, in the case of any person about whom disclosure might be made, whether that person be asked if he wishes to make representations.  In the generality of cases without that person being afforded such an opportunity, the decision maker might not have all the information necessary to conduct the balancing exercise which he is required to perform justly and fairly.  Whilst each case will turn on its own facts, it is difficult to foresee cases where it would be inappropriate to seek representations, unless there was an emergency or seeking the representations might itself put the child at risk´(§41)

On the second issue, the court held that, notwithstanding the allusion to a ‘presumption’ in favour of disclosure in its opening paragraphs, the guidance did properly incorporate a requirement that the police undertake a balancing exercise which took into account both the rights of the sex offender not to have the information disclosed and the need to protect individual children from harm. The court held that the regime embodied in the guidance properly complied with the approach which was approved
in R v Chief Constable of North Wales ex p Thorpe [1999] QB 396.

The judgment is interesting and important not least because it suggests that the current legal regime governing the disclosure of information relating to sex offenders is still far removed from a ‘Megan’s law’ US-style approach to disclosure. Thus, in contrast with Megan’s law, where the general public are allowed access to details of convicted sex offenders living in a particular area, sex offenders in this country retain a right to privacy in respect of information relating to their offences, albeit that that right may lawfully be interfered with on a case by case basis. 11KBW’s Jason Coppel appeared on behalf of the Home Secretary.

Anya Proops

The question of whether the convention on collective cabinet responsibility operates, in effect, as a trump card in the FOIA context has been considered in a number of tribunal cases (see further for example the Lamb case concerning a request for disclosure of the Iraq war cabinet minutes and the Cabinet Office case concerning cabinet discussions over the Westland takeover (“the Westland case”)). Last week, in Cabinet Office v IC, the First-Tier Tribunal handed down a decision in which it reconfirmed the principle that the convention, whilst undoubtedly an important consideration in the FOIA context, does not create any absolute bar against disclosure.

The facts of the Cabinet office case were as follows. In 1988, Rowntree Mackintosh, the well-known UK confectionary group, was acquired by Nestlé. The takeover was hugely controversial at the time. The decision to approve the takeover and not to refer it to the Monopolies Commission was taken by Lord Young, then Secretary of State for Trade and Industry. In 2008, a request was made by a Mr Aitcheson (A) for disclosure of all documents held by the Cabinet Office (CO) relating to the takeover dated between April and August 2008. That request was largely refused by the CO on an application of ss. 35(1)(a) and (1)(b) (respectively the government policy exemption and the ministerial communications exemption). In September 2010, the tribunal handed down its decision in the Westland case. In that case, the tribunal decided that the convention on collective cabinet responsibility did not operate so as to prevent disclosure of the minutes of the meeting of the cabinet in 1986, in which Michael Heseltine resigned due to his disagreement with colleagues over whether the government should intervene in the investment by an American company in the British helicopter manufacturer Westland plc. That decision was not vetoed by the Government (cf. the Lamb decision which was vetoed by the government). In light of the decision in the Westland case, A resubmitted his request to the CO for disclosure of information relating to the Rowntree takeover. The request was again refused. On this occasion the CO took the position that there were five documents which were exempt from disclosure under ss. 35(1)(a) and (b). It also refused to confirm or deny whether it held information revealing cabinet discussions of the takeover on an application of s. 35(3)).

The Commissioner concluded that, whilst the five documents fell within the ambit of the exemptions provided for under s. 35, the public interest balance fell in favour of disclosure. He also concluded that, whilst the CO had been entitled to conclude that s. 35(3) was engaged, the public interest balance weighed in favour of the CO being compelled to confirm or deny whether it held information revealing cabinet discussions of the takeover. The CO appealed against the Commissioner’s decision. It did so particularly on the basis that the decision failed to give due weight to the very strong public interest in upholding the convention on collective cabinet responsibility.

The CO’s appeal was unsuccessful. The Tribunal (chaired by Judge Angel) agreed with the Commissioner that both under s. 35(1) and under s. 35(3)  the public interest balance weighed in favour of disclosure. In reaching this conclusion, the Tribunal relied in particular on the following considerations:

–       the age of the information – the decision in question was now more than 20 years old

–       the move to a ’20 year rule’ – at the time of the request, the government had already made a policy decision to amend existing legislation so as to reduce the 30 year rule for historical records to be transferred to the National Archive to 20 years and the age of the requested information should be considered in that context

–       key characters had left the political stage – Lord Young was no longer in government at the time of the request and whilst he continued act as an adviser to the government he did so in relation to policy issues which were unrelated to takeover issues; he was not even performing that advisory role by the time of the internal review

–       ‘chilling effect’ unlikely – the CO’s arguments that disclosure would have a chilling effect on Cabinet discussions could not be accepted. This was particularly given the age of the information in issue. (The Tribunal was no doubt influenced on this issue by the fact that the disclosure in the Westland case had not apparently had any notably chilling effect on subsequent cabinet discussions)

–       diminished need for a ‘safe space’ – the CO’s  arguments that it needed to preserve a ‘safe space’ for cabinet discussions were in any event weakened by the fact that the regime governing takeovers had fundamentally changed by the time of the request. Thus, there was no live policy debate within government which required protection

–       strong public interests in disclosure – there were particularly strong public interests in favour of disclosure. Relevant here was not only the particularly controversial nature of the Rowntree takeover but also the fact that Lord Young had been exercising a ‘quasi-judicial’ role in respect of the takeover. Given his quasi-judicial role, there was a particularly strong public interest in revealing information which showed whether or not his decision had been compromised by improper political or other pressure.

It remains to be seen whether the government will now exercise its powers of veto to prevent the information being disclosed. 11KBW’s James Cornwell acted for the CO. Robin Hopkins acted for the Commissioner.

Anya Proops

Today, the Commissioner served – for the first time – a monetary penalty notice on a charity. The charity in question, Norwood Ravenswood Ltd, is a social care charity. One of its social workers had attempted to deliver to the home of prospective adopters certain background reports containing highly confidential sensitive personal data on four young children. Finding the couple out, and unable to fit the package through the letterbox, the social worker left the package in a concealed area at the side of the house. When the prospective adopters returned home, the package had disappeared. It was never recovered.

At the time of the incident, the charity had no specific guidance on sending personal data to prospective adopters. Further, and in breach of the charity’s data protection policy, the social worker in question had not received any data protection training.

The Commissioner found that there had been a “serious contravention” of the seventh data protection principle (i.e. that appropriate technical and organisational measures shall be taken … against accidental loss … of … personal data). Perhaps unsurprisingly, the contravention was also found to be “of a kind likely to cause … substantial distress” (for the purposes of the second limb of the test, in s. 55A(1)(b) of the DPA). In addition, the Commissioner concluded that the charity knew or ought to have known that there was a risk that the contravention would occur, and that such a contravention would be of a kind likely to cause substantial distress, but failed to take reasonable steps to prevent the contravention within the meaning of s. 55A(3) of the DPA.

Although the Commissioner was not aware of any previous similar security breach, and the charity had voluntarily reported the incident to the Commissioner and had fully cooperated thereafter, the Commissioner nevertheless set the penalty at £70,000. Interestingly, the Commissioner does not appear to have taken the data controller’s charitable status to be a factor of any significance in this regard, on the basis that it had “substantial reserves”. Although the penalty is at the lower end of the spectrum of penalties awarded to date this year, it remains a substantial sum.

Overall, today’s decision serves as a useful reminder both of the potential consequences of inadequate data protection procedures and of the fact that even charitable bodies may face heavy penalties if serious contraventions occur.

There is still no monetary penalty case law to offer guidance. But, as regular readers of this blog may recall, the first appeal against a monetary penalty notice (brought by London Community Healthcare NHS Trust) is in the pipeline. It will be heard in December this year (with Tim Pitt-Payne QC and Anya Proops of 11KBW acting for the opposing parties).

One final thought, or, rather, question. The vast majority of the monetary penalty notices concern public authorities. Are public authorities really committing many more “serious contraventions” than private persons, or are they simply more likely to be reporting such contraventions to the Commissioner?

Ben Hooper