As noted by Panopticon earlier today, the CJEU has been busy pronouncing on subject access request principles. The drift has, in general, been pro-data subject. In the UK, however, subject access case law has not necessarily been one-way pro-disclosure traffic, as is evident from the robust and careful judgment handed down this week by Mrs Justice Farbey in X v Transcription Agency and Master James.
The context was that X, who had litigated against a government department with mixed success, had an unhappy time before the Master on a costs assessment, having his assessed costs reduced by 70% on account of his conduct of the litigation. X made a complaint about the Master, and also had the idea of making subject access requests to the Master herself (Master James) and to the Transcription Agency, targeting in particular communications from the former to the latter in the course of transcription corrections and signoff, etc. This was ultimately not a very good idea.
The SARs were refused on the grounds of the judicial exemption (para 14 from Schedule 2 to the DPA 2018) and the third party personal data exemption (para 16), though the latter ultimately fell away. X challenged those refusals before the High Court, seeking declarations and compliance orders but not compensation. His claim was dismissed on all fronts. Here are some of the notable points.
Purposive approach to SAR rights
See [73]: the SAR right “has a specific and limited purpose, which is to enable a person to check whether a data controller’s processing of his or her “personal data” unlawfully infringes privacy rights and, if so, to take such steps as the DPA 2018 provides… It is impermissible to deploy the machinery of the Act as a proxy for the wider purpose of obtaining documents with a view to litigation or further investigation (Durant, para 31). The scheme for access to personal data is not a vehicle for a party to proceedings to root out information about a judge”.
These are interesting observations. Case law has generally tended to shy away from permissible and impermissible purposes and motives for SARs, except where they are abusive.
Exemptions: legal principles
How should a court approach reliance on an exemption? In the first place, the principles are (see [49]) that the controller bears the burden of proof to the civil standard. To discharge that burden for a prejudice-based exemption, the controller needs ‘significant and weighty grounds and evidence’ to show that there ‘may very well be’ prejudice from disclosure (they don’t necessarily need to show prejudice is more likely to arise than not): Roberts, Lord, Zaw Lin.
Exemptions: evidential principles
X was insistent that Master James’ declining to provide witness evidence meant she couldn’t discharge her burden. Answer: no. It was a matter of common sense that the material X sought concerned the Master’s judicial work; she couldn’t be compelled to give witness evidence, nor to prove a negative (i.e. to prove that she did not hold disclosable material). See [138]: “Nor does any principle of law require a party to discharge a burden of proof by reference to some fixed form of evidence such as a witness statement. Judges (and juries) on conventional principles may consider circumstantial evidence and may draw inferences from primary facts. These are not second-rate tools but may fairly and justly form the foundations of factual findings..”.
The judicial exemption in particular
What about the principle that exemptions should be construed restrictively? Yes, but this exemption seeks to safeguard the independence of the judiciary, which is of fundamental constitutional importance. See [72]: “… There is an intrinsic and enduring connection between the independence of the judiciary and immunity from suit at common law. Judicial independence means that the parties to litigation submit to the authority of the court, not the other way round. The court does not submit to the wishes or stratagems of the parties…”.
While not everything judges do with data will necessarily fall within the judicial purposes exemption, the protection afforded by that exemption doesn’t end when judgment is handed down, nor by virtue of someone making a complaint about the judge. Farbey J was clearly satisfied that the exemption applied in this case.
Post-Brexit CJEU case law
The defendants understandably relied on the CJEU’s post-Brexit judgment in X v Autoriteit Persoonsgegevens. X resisted that reliance. See [89]: “Mr Boyle submitted that I should not follow the broad approach in X v Autoriteit Persoonsgegevens on the basis that it is a post-Brexit case. However, the CJEU’s analysis of the importance, nature and scope of judicial independence is compelling. Irrespective of whether it is binding post-Brexit, I have been provided with no sound reason to take a different view”.
Closed procedures
The DPA 1998 made specific provision (section 15(2)) for a closed procedure whereby the judge could view withheld material and hear the defendant on it, in the absence of the claimant. That provision is repealed, and the DPA 2018 contains nothing like it. Given open justice imperatives, could a similar closed procedure be applied in the absence of an express legislative footing?
Farbey J noted the understandable discomfort that has been expressed with closed procedures (see eg Zaw Lin at [15]). She was not, however, persuaded that she had no power to order a closed procedure. See [105]: “Mr Boyle’s submissions are founded on the proposition that, by failing to re-enact the power of a court to inspect data in the absence of a party, Parliament intended to remove the power. He cited no authority for the proposition that the omission of a power in a new Act that existed under an old Act should impel a court to interpret the new Act as marking a change of Parliamentary intention irrespective of the consequences. The court’s function is to ascertain the legislative intention. In carrying out this function, the court may have regard to previous legislative provisions. I was, however, directed to no rule of law to suggest that previous legislation must animate the meaning of new legislation to the cost of any other principle”.
The conclusion was that section 167 DPA 2018 contained an implied power to hold a closed procedure; this was necessary to ensure effective remedies in cases of withheld information, and it would be absurd to construe the overall legislative scheme as precluding a closed procedure power. So such procedures – similar to how things work in FOIA cases (see eg Browning, BUAV) – can be used under the DPA 2018 also.
Other points
Even if the judicial purposes exemption hadn’t worked for the Transcription Agency, Farbey J would have concluded that it was a processor in any event, and thus not subject to SAR duties.
And while there was a minor delay in responding to X’s SAR, this was trivial and Farbey J was not prepared to grant him declaratory relief for something he could simply work out for himself (see [110]) – no doubt not wanting to give partial victory (with ensuing costs arguments) in a comprehensively dismissed claim.
Robin Hopkins