Data subjects will very often wish to challenge the compliance of public authorities with the Data Protection Act 1998. How should they do it? If it were a private body which was the data controller, the only route would be way of Part 7 or Part 8 claim under the DPA – a claim under section 7(9) if it concerns a subject access request. But could the same complaint against a public authority data controller be brought by way of judicial review under Part 54? The obvious problem with that approach is the standard principle of the judicial review that permission to apply for judicial review will not be granted where the claimant has an adequate alternative remedy. Readers of this blog will recall the application of that principle in the context of challenges to the ICO over right to be forgotten enforcement decisions.
But if there were any doubt about whether the DPA might be some sort of exception to that rule, the Court of Appeal has just ruled in R (Hussain) v Secretary of State for the Home Department [2016] EWCA Civ 1111 that the ordinary rule does indeed apply: “The remedy under section 7(9) is the remedy specifically designed for a complaint of a failure of disclosure on the part of a data controller in respect of a data subject access request made under section 7. There can be no question but that it is a suitable remedy for individuals to vindicate their rights under section 7” at [30] per Sales LJ. As one might expect, it was not a blanket rule. Rather, “Only in rare and exceptional cases would it be right to do so. The usual position should obviously be that such a claim for judicial review should be refused on the basis that there is a suitable alternative remedy available, in the shape of the remedy under section 7(9) which Parliament has specifically created in relation to subject access requests under section 7“: at [32]. Claimants are warned, at [37], to think long and hard about including such claims.
Sales LJ also noted that a DPA claim seeking to get disclosure in support of another limb of the same judicial review was unnecessary. Disclosure should be given under the duty of candour (although of course the scope may well be somewhat different), and if the claim is about the non-provision of information of which a failure to comply with the DPA is a part, that can be made without seeking relief under section 7(9).
Court of Appeal decisions on alternative remedy do not come along often: cases are usually disposed of at the permission stage and there is no report of the reasons. Hussain will therefore be of real practical use to public authority data controllers facing DPA claims in a judicial review. There is no alternative to a nice, traditional, piece of ordinary civil litigation.
Andrew Sharland appeared for the Secretary of State.
Christopher Knight