Disclosure of judge’s handwritten notes – the ICO speaks

Posted on | by Anya Proops KC

Some of you may have read in last week’s Guardian of an ICO ruling which resulted in the Ministry of Justice handing over a judge’s handwritten notes under data protection legislation (if not, see the article here). If you did read the article, it may be that you are now scratching your head trying to work out why and how the notes came to be disclosed. Well you need scratch no longer – here is the ICO decision letter (for which thanks to Mrs Percival). The following appears from the decision letter:

  • Mr & Mrs Percival made various subject access requests to MoJ over the period 2014-2015 (it appears from the Guardian article that the requests relate to employment tribunal litigation which Mr Percival pursued in the employment tribunal; the requests are not detailed in the ICO’s letter but appear to have extended to any hand-written notes taken by relevant judges and lay-members which were held by MoJ on the court file);
  • Mr & Mrs Percival were unhappy with the response they received from MoJ and so asked the ICO to conduct an assessment under s. 42 DPA;
  • MoJ’s position in response to the assessment process seems to have been that: (a) the notes did not form part of a “relevant filing system” and therefore did not fall within the scope of the DPA; (b) it was not a relevant data controller in respect of the notes and (c) in any event the notes should not be disclosed;
  • on the ‘relevant filing system’ issue, the ICO concluded that ‘in the majority of cases, handwritten judicial notes, recorded in a judge’s notebook and retained by the judge are unlikely to form part of a structured filing system and therefore, will not fall within the definition of ‘data’. However, it went on to decide that, as soon as the notes were placed on the court file they became part of a relevant filing system. This conclusion was reached on the assumption ‘court files will be structured according to the specific case, which will include reference to the data subject’. Later on in the letter, the ICO noted that the ICO ‘recognises the distinction between informal (handwritten) notes which will not be data for the purposes of the DPA and where the notes are added to the court file, and thus become part of the formal or official record (and thus fall within the definition of data disclosed above)’.
  • on the question of whether MoJ had become a data controller in respect of the notes, the ICO took the view that it had assumed that role at the point when the notes were added to the court file. The ICO went on to conclude that: ‘access to all of the information contained within the court file, including the handwritten notes should be provided to [the Percivals], subject to s7(4) [the mixed data exemption] and s8(2) [on the proportionality of supply of the data] or unless an exemption applies’. In reaching this conclusion, the ICO rejected MoJ’s case that the judgment of R v Parole Board (CO/1523/2013) was a barrier to disclosure;
  • on the question of why the ICO thought compliance under s. 7 DPA was important for data protection purposes, it appears that the ICO took the view that compliance was important in view of the following obligations to which MoJ, as the relevant data controller, was subject: (1) the obligation to keep data no longer than necessary (s. 4(4) DPA read together with the fifth data protection principle); (2) the obligation as to data security (s. 4(4) read together with the seventh data protection principle) and (3) the obligation to process data in accordance with the data subjects rights under the DPA, such rights of course include the right of subject access (s. 4(4) read together with the sixth data protection principle);
  • the ICO went on to recommend that MoJ should review the contents of the court file so as to ensure that the Percivals were provided with all data to which they were entitled. The ICO declined to take enforcement action under s. 40 DPA.

It appears from the Guardian article that MoJ took the assessment on the chin and, despite the fact that the ICO opted not to take enforcement action, disclosed the notes it held to the Percivals.

A number of thoughts on this case:

  • First, one is rather left wondering why the ICO was so ready to conclude that a judges hand-written notes do not amount to “personal data” where they are retained by the judge, as opposed to being placed on the court file. The ICO appears to have taken the view that such notes do not amount to “personal data” because they are notes “informally” taken by the judge. However, as any litigator will know, judicial notes have a powerful degree of formality in the sense that they can and typically do either substantially inform the formal judicial determination process or otherwise amount to a formal record of the proceedings. Further and in any event, the test of whether data forms part of a relevant filing system is not whether the data in question is “informal” in nature, it is whether the data forms part of a dataset which is ‘structured by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible’ (s. 1(1) DPA (as for the application of this test see Durant v Financial Services Authority [2003] EWCA Civ 1746). It is not at all clear why it should automatically be assumed that in every case judges who retain a copy of the notes that they take would not be holding those notes as part of a relevant filing system as defined in s. 1(1). One would have thought that this was an issue which would have to be judged on a case by case basis by reference to the facts of the individual case. (As the ICO acknowledges in its decision letter, judges are data controllers insofar as they processing data in a judicial capacity and so their notes would be caught by the DPA insofar as they are held as part of a relevant filing system).
  • Second, it is certainly true to say that the High Court in the Parole Board  case referred to by the ICO: (a) drew a distinction between notes taken by the judge which amount to a record of the proceedings and notes taken by the judge for his or her own purposes to assist in the judicial determination process and (b) concluded that the latter notes were not “personal data” (per Cranston J, at §23). However, it is not at all clear how the court arrived at the conclusion that notes taken to assist in the judicial determination process did not amount to “personal data” (the judgment certainly does not contain any discrete reasoning on this issue). Query whether the court was perhaps confusing the question of whether the information amounted to personal data with the entirely different question of whether there was a public interest justification for withholding that data under the DPA (see further §23 where the court held that such notes were akin to a draft judgment and ‘must never be disclosed or provided to any person’).
  • Third, query whether this decision is going to result in a slew of requests being made to MoJ, and individual judges. If it does have that result, query whether this will in turn incline judges to express themselves much more carefully or economically in their notes.
  • Fourth, whilst the ICO alluded in its letter to the reasons why it might be important for the Percivals to have access to their data under s. 7, it is in truth not necessary for the data subject to establish that permitting access to the data would serve any particular data protection objective (see further Dawson-Damer v Taylor Wessing [2017] EWCA Civ 74 and Ittihadieh v Cheyne Walk [2017] EWCA Civ 121 on the relevance (or lack thereof) of an applicant’s motive in seeking access to the data). The starting point must be in any individual case that the requested data, if it amounts to personal data, must be disclosed on request, subject to the application of relevant exemptions, including the mixed data exemption contained in s. 7(4), and s. 8(2).
  • Fifth, one can’t help but wonder whether the ICO ought to have taken steps to publish at least the core reasoning set out in its decision letter. This is a decision which is of some importance in its own right. It is moreover very much in the public interest that the public should understand how the ICO is in practice discharging its functions under s. 42, including but not limited to subject access cases. Whilst of course the ICO must take steps to ensure that it is not compromising the data privacy rights of data subjects when publishing information about its s. 42 assessments, it is surely important at the same time that the ICO is, where it can, creating transparency around its assessments, for example by publishing its reasoning on an anonymised basis.

Anya Proops QC