Niebel v Information Commissioner is the first Tribunal decision about penalties under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”).  Mr.Niebel successfully appealed against a penalty of £300,000.

The First-tier Tribunal stated that the material before them showed that Mr. Niebel and his company, Tetrus, had sent hundreds of thousands of unsolicited text messages seeking out potential claims for the mis-selling of PPI or for accidents.  There was no dispute that he had breached the requirements under PECR regulation 22, relating to the sending of text messages for direct marketing.  Until 26th May 2011 there was no power to impose penalties for such a breach, but with effect from that date the monetary penalty provisions in the Data Protection Act 1998 (sections 55A-E of the Act) had been extended to cover breaches of PECR.

In the present case, the monetary penalty notice was imposed on 26th November 2011, requiring payment of £300,000.  The Tribunal emphasised the importance of a clear statement in the notice identifying the contravention for which a penalty was imposed.  At the very least this should indicate the regulation contravened, the content of the contravention, and its scale, including roughly how many individual acts there were and how many people were affected.

In this case the Tribunal considered that the notice had failed clearly to identify the contravention.  The notice seemed to be confined to 411 cases, involving a total of 732 texts, in which the recipient had complained to the ICO.  However, some parts of the penalty notice referred to contravention on a much wider scale.

A further difficulty was that the ICO subsequently discovered that most of the 732 texts referred to had been sent before 26th May 2011 (the date when the power to issue penalties came into effect); and the ICO accepted that these earlier texts could not properly be taken into account.  The ICO therefore relied at the Tribunal hearing on 286 texts, not 732:  the number of affected individuals was not stated, but the Tribunal indicated (if the ratio of texts to complaints was consistent) that this would be about 160.

The appeal was brought on one short point.  It was argued that the contravention was not of a kind likely to cause substantial damage or substantial distress, since it was now described as relating to just 286 texts; therefore one of the statutory preconditions for a monetary penalty was not satisfied.

The Tribunal proceeded on the basis that the likelihood of damage and distress should be assessed by reference to the 286 texts now relied upon by the ICO as constituting the contravention, rather than by reference to other evidence showing very large numbers of unsolicited text messages.  On this basis, the requirement that the contravention was not likely to cause substantial damage or substantial distress was not satisfied.  As far as damage was concerned, recipients might incur charges for replying “stop”, and there might be a small charge if texts were received abroad, but none of this was likely to cause substantial damage.  As to distress, the Tribunal considered that the effect of the contravention was likely to be widespread irritation rather than substantial distress.  The Tribunal allowed the appeal and cancelled the penalty notice.

The decision leaves open one very important question.  Would the sending of hundreds of thousands of unwanted marketing messages be likely to give rise to substantial damage or substantial distress?  Could one say that, in aggregate, the small costs imposed on a very large number of individuals amounted to substantial damage? Or that the irritation caused to such a large number constituted substantial distress? This issue will no doubt be of great importance in future appeals about monetary penalties under PECR.

Two of my colleagues appeared in this case:  James Cornwell for the ICO, and Robin Hopkins for the Appellant.  Neither of them, of course, bears any responsibility for the content of this blog post.

Timothy Pitt-Payne

As I mentioned in my post last week, the case of T v Secretary of State for the Home Department, which concerns the legality of the current CRB regime, is shortly to be considered by the Supreme Court. The issue in T is whether the blanket requirement that criminal convictions and cautions must be disclosed in the context of an enhanced criminal record check (“ECRC”) undertaken for the purposes of certain types of employment (particularly employment with children or vulnerable adults), even though they are spent, is Article 8 compliant.

But what of cases where an accused has been through the criminal justice system only then to be acquitted of the alleged offenses? Should the data slate in respect of that individual be wiped clean, with the result that the allegations can never surface in the context of an ECRC? Answering that question brings into play the important maxim that, within the criminal justice system, one must be deemed innocent until proven guilty. However, balanced against that maxim, is the recognition that there will be cases where an accused was in fact guilty of the crimes alleged against them, albeit that the Crown was unable to prove that guilt beyond all reasonable doubt. Such individuals may well pose a substantial threat to society, despite their acquittal in the criminal courts. So how should the relevant disclosure bodies balance these competing considerations in the context of the ECRC scheme?

Earlier this year I blogged about two cases where the courts had considered this difficult question in respect of allegations of criminal conduct which had been made, but not proven, as against teachers. In the first case, R (L) v Chief Constable of Cumbria Constabulary [2013] EWHC 869 (Admin), the allegations against the teacher never reached the stage of a criminal prosecution. In the second case, RK v (1) Chief Constable of South Yorkshire (2) Disclosure and Banning Service [2013] EWHC 1555 (Admin), the teacher was acquitted following a criminal trial (see my post here). In both cases, the court held that the inclusion in the relevant ECRCs of information relating to the allegations was unlawful as constituting an unjustified interference with the teacher’s Article 8 rights. A key feature of both of these judgments is that, in the court’s view, the police had acted unlawfully by effectively suggesting that the allegations had been well-founded, despite the lack of any criminal conviction. In a sense, these judgments are unsurprising. After all it cannot be right for the police to suggest that an individual is guilty of an offence when they have not been convicted of any offence following a criminal prosecution.

But does that mean that it will always be unlawful to disclose information about criminal allegations where those allegations have not culminated in a conviction? The recent judgment of the High Court in the case of R(AR) v Chief Constable of Greater Manchester Police & Secretary of State for the Home Department (Case No: CO/13845/2012) indicates that the answer to that question is no.

In AR, an individual who had previously worked as a taxi driver had been accused of raping a particular passenger. He had been acquitted following a criminal trial taking place in January 2011. In March 2012, the Criminal Records Bureau issued an ECRC in connection with an application made by AR for a licence as a private-hire driver. The ECRC made reference to the allegation of rape as against AR. It also confirmed that he had been acquitted following a trial before the Crown Court. AR sought a judicial review in connection with that certificate on the basis that it breached his Article 8 right to privacy. The High Court held that the certificate was unimpeachable. In reaching this conclusion, it is clear that the court was of the view that: (a) the certificate was itself a fairly balanced document and, further, (b) this was a case where the Chief Constable had properly recognised that, whilst the allegations against AR had not been proved to the criminal standard, there was sufficient evidence to suggest that they may yet be well founded and (c) it was reasonable and proportionate to include the allegations in the ECRC given the risk posed to vulnerable passengers if AR had in fact committed the crimes alleged against him.

The court also rejected arguments to the effect that the police’s retention of the data was unlawful under Article 8 and, further, that the police had acted unlawfully by not consulting AR prior to including the information in the ECRC. So far as data retention was concerned, the court held that the police had legitimate reasons for retaining the data both because it may be relevant if further allegations were made against AR and also because other matters could arise involving the complainant. On the procedural challenge relating to the lack of consultation, the court held that this was not well founded both because AR had had an opportunity to put his case in the context of an earlier comparable ECRC and because the police had in any event anticipated all the substantive arguments AR might have wanted to make.

Importantly therefore, an acquittal is not the get out of jail free card it might at first appear to be, certainly in terms of the accused’s data rights.

Jason Coppel QC, who is also acting in the T case, appeared for the Secretary of State.

Anya Proops

It has been a relatively quiet summer on the information law front. However, this has very much been the calm before the storm. Important up-coming hearings include not least:

–       Kennedy in the Supreme Court (application of the Article 10 right to freedom of expression in the context of FOIA; previously discussed on Panopticon here, here and here): hearing listed for 29-31 October;

–       T v Secretary of State for the Home Department in the Supreme Court (whether CRB disclosure regime is compatible with Article 8; Court of Appeal judgment previously discussed on Panopticon here): hearing listed for 9-10 December;

–       Edem v Information Commissioner & FSA in the Court of Appeal (appeal against Upper Tribunal FOIA decision that information comprising an individual’s name taken together with information as to their role within an organisation constitutes ‘personal data’, such that it may fall within the scope of s. 40 FOIA): hearing listed for 14 November;

 –       Central London Community Healthcare NHS Trust v Information Commissioner in the Upper Tribunal (appeal against the first ever tribunal decision on the imposition of a monetary penalty notice by the Information Commissioner under the DPA; see previous post on this case here): hearing listed for 16 and 17 October;

–       East Sussex County Council v Information Commissioner & Anor in the First-Tier Tribunal: hearing listed for 12-13 November 2013. The case in question is the fourth case to come before the tribunal concerning the imposition of charges by local authorities under the EIR for the provision of property search information – see further the tribunal decisions in East Riding of Yorkshire Council v IC, Kirklees Council v IC and Leeds City Council v IC. In the Leeds case, the Tribunal held that the relatively substantial charges which the Council had sought to impose were impermissible under the EIR. In reaching this conclusion, the Tribunal held that, under r. 8 EIR, a public authority was entitled to impose charges only in respect of the costs of transmitting the information to the applicant and was not entitled to charge for other costs such as the costs of searching for, retrieving and redacting the information. The Tribunal held that this conclusion was in keeping with the conclusions which had been reached by the ECJ in Commission v Germany (Case C-217/97) (the decision is discussed in more detail here). In East Sussex, both the Council and the Commissioner will be inviting the Tribunal to refer to the CJEU the question of the scope of a public authority’s power to charge applicants for environmental information, having regard to the relevant provisions in the Directive.

And in other news…

–       This week the First Tier Tribunal heard the first ever appeal against the imposition of a monetary penalty notice under the Privacy and Electronic Communications Regulations 2003. The appeal was brought by Tetrus Telecoms and concerned the sending of unsolicited text messages. You can read the relevant MPN here. A second set of appeals is due to be heard later on this year, this time concerning Nationwide Energy Services and We Claim U Gain Limited. It concerns the sending of unsolicited telephone calls (see the relevant MPN here). It will be interesting to see whether the Tribunal calibrates its approach depending on the type of communication in issue.

11KBW heavily dominates in all of the above cases. No doubt they will all be subject to further comment on Panopticon in due course.

Anya Proops

We are thrilled to report that 11KBW has been chosen by the Legal 500 as the leading chambers in the field of data protection. Comments include in the directory: the ‘set of choice’ for data protection matters; ‘high-quality, value-for-money’ service is ‘a standout feature’ of the ‘knowledgeable and responsive’ team, which is also noted for its ‘excellence in the area of information rights cases’. 11KBW’s Timothy Pitt-Payne QC and Anya Proops are listed respectively as the pre-eminent Silk and Leading Junior in this area. Ben Hooper is also listed as a Leading Junior. Other members of Chambers singled out for praise for their data protection work include Jonathan Swift QC, Akhlaq Choudhury, Karen Steyn and Robin Hopkins – see the listing here. 11KBW has also this week won both the Chambers & Partners Human Rights & Public Law set of the year and the Legal 500 Employment set of the year – see here and here. Many thanks to all those of our readers who have supported us over the years and helped us to reach these heady heights.