Author: Anya Proops KC

SUBJECT ACCESS REQUESTS – MIXED MOTIVES AND PROPORTIONATE SEARCHES

Posted on | by Anya Proops KC

There are two questions which are frequently posed by data controllers in receipt of wide-ranging subject access requests. First, if the request is made in circumstances where the requester is pursuing litigation against the data controller, the data controller will often query whether the request can be refused on the ground that it is being pursued for improper collateral purposes. Second, if responding to the request comprehensively would be disproportionately resource intensive, the data controller will typically ask whether it is entitled to limit its search to one which is reasonable and proportionate in the circumstances. As the recent case of Elliot v Lloyds TSB Bank PLC & Anor (Case No: 0LS51908) illustrates, answering such questions is rarely straightforward.

The background to Elliott was that Mr Elliott was pursuing a grievance against Lloyds in connection with certain commercial matters. With a view to furthering his grievance, Mr Elliott submitted a request to Lloyds for pre-action disclosure. That request was refused on the ground that it did not comply with CPR 31.16. Thereafter, Mr Elliott submitted wide-ranging subject access requests to Lloyds. A considerable amount of information was disclosed by Lloyds in response to the requests. However, Mr Elliott was not satisfied with the material disclosed to him. He considered that further searches ought to be undertaken. Accordingly, he brought a claim against Lloyds in the County Court under s. 7(9) DPA (s. 7(9) affords the court a wide discretion to order a data controller to comply with a subject access request if it is satisfied that the data controller has not dealt with the request in accordance with the legislation). Lloyds sought to resist the claim on two grounds: first, the claim was an abuse of process as it was being pursued for the collateral purposes of furthering Mr Elliott’s interests in prospective commercial litigation against Lloyds; second, the claim should fail on the basis that the further searches for data which Mr Elliott was insisting should be conducted would be disproportionate in all the circumstances. Thus, both Mr Elliott’s motive and the issue of the proportionality of Lloyd’s searches were at stake in the litigation.

The Motive Issue

Mr Elliott’s case on the motive issue was that he was pursuing the claim for a legitimate purpose, namely that he wanted to find out whether Lloyds had been misusing his personal data (e.g. by improperly disclosing it to a third party). Lloyd’s position on the motive issue was as follows: either Mr Elliot was pursuing the claim purely in order to further his interests in the prospective commercial litigation or this was the dominant motivation for the claim; either way the s. 7(9) claim was being pursued for an improper collateral purpose and, as such, amounted to an abuse of process.

Following Durant v Financial Services Authority [2003] 1746, the judge (HHJ Behrens) readily accepted that, if the claim was being pursued purely for the collateral purpose of furthering Mr Elliott’s position in other prospective litigation, that would amount to an abuse of process which would justify the claim being struck out. However, he went on to query what the position would be if Mr Elliott in fact had mixed motives (i.e. he wanted the data in order to further the prospective commercial litigation but also wanted to discover whether his data had in fact been misused by Lloyds). Having considered the judgment of the High Court in Iesini v Westrip Holdings [2011] 1 BCLC 498, the judge took the view that, in a case involving mixed motives, the test which should be applied was a ‘but for’ test. Thus, if the claim would not have been brought but for the claimant’s collateral purpose in furthering his interests in the other litigation, the claim would have been brought for an improper purpose and would be liable to be struck out as an abuse of process. On the other hand, if the s. 7(9) claim would have been brought irrespective of the other prospective litigation, then it was not an abuse of process. Notably, the judge rejected an alternative test proposed by Lloyds, namely that the s. 7(9) claim would be an abuse of process if the ‘dominant purpose’ of the claim was an improper collateral purpose. The judge concluded that the dominant purpose test could not be reconciled with the approach approved by the court in Iesini.

With respect to Mr Elliott, the judge concluded that: he had mixed motives in bringing the s. 7(9) claim; however, he would still have brought the claim in the absence of the prospective commercial litigation and, as such, his claim under the DPA was not an abuse of process.

Proportionate Search

On the proportionate search issue, Mr Elliott argued that a data controller was not entitled to limit the scope of its search for personal data by reference to concepts such as reasonableness and proportionality. Insofar as the concept of proportionality was relevant at all under the DPA, it was relevant not to the search process per se but rather to the process of supplying the data to the applicant once it had been located (see further s. 8(2)(a) DPA which disapplies the general duty to provide the applicant with ‘a copy of the information in permanent form’ in circumstances where the supply of such a copy ‘is not possible or would involve disproportionate effort’). In support of these arguments, Mr Elliott relied on guidance published by the Information Commissioner.

Lloyds argued that this was not the correct approach and that, following Ezsias v Welsh Ministers [2007] All ER (D) 65, it was not obliged under the DPA to conduct a search requiring unreasonable or disproportionate effort. Lloyds further contended that, to the extent that the Commissioner’s guidance took a different view of the principles approved in Ezsias, the guidance was wrong and ought not to be followed. Lloyds argued that it would be disproportionate to conduct the further searches demanded by Mr Elliott. The judge accepted Lloyds’ case on the disproportionate effort issue. He agreed that the further searches sought by Mr Elliott were disproportionate and, hence, were not required under the DPA.

The court’s judgment on the proportionality issue is likely to offer considerable relief to data controllers, many of whom struggle under the burdens imposed by wide-ranging subject access requests. It remains to be seen whether the Commissioner will, in response to this judgment, seek to review his guidance. As for the judgment on the motive issue, it is worth noting that the court heard evidence directly from Mr Elliott on this issue and, further, that it found him to be ‘an honest witness’.

Finally, it is worth noting that, despite having won on the disproportionate search issue, Lloyds was still required to pay a substantial part of Mr Elliott’s costs. This was in no small part because Lloyds had disclosed a substantial amount of new data following the lodging of Mr Eliott’s claim. 11KBW’s James Cornwell acted for Lloyds.

Anya Proops

INTERNET SURVEILLANCE – A SNOOPER’S CHARTER?

Posted on | by Anya Proops KC

In 2004, the former Information Commissioner, Richard Thomas, commenting on the then Labour Government’s proposed ID card scheme, warned us to take care that we do not ‘sleepwalk into a surveillance society’. That warning appears to have particular resonance this week following announcements by the Coalition Government of plans to extend current surveillance legislation so as to allow for the instantaneous tracking of internet usage by individuals within the UK. The plans would reportedly allow GCHQ to access all internet traffic (including information about webmails, web-browsing, internet calls and social networking activities) in real-time and on demand. Whilst the detail of the plans remains decidedly obscure, some media reports suggest that they are directed not only at capturing new technological modes of communication but also at loosening current restrictions on accessing tracking information so that, for example, warrants would not have to be sought in individual cases. The Government, which appears to be facing a huge backlash over the proposals, has indicated that current laws need to be updated so as to capture modern modes of communication which are not (or not adequately) caught by the existing regime, e.g. Skype calls and Facebook messaging. It has also suggested that rights of access under the new legislation would be limited to tracking information (e.g. who sent an email to whom, when and from where) and would not embrace any automatic right of access to the substantive content of the communication. However, critics have been swift to point out the potential threat to civil liberties posed by the plans, not to mention the inevitable risk of function creep. They highlight the dangers of a system which potentially draws, not only criminals and those posing a danger to our society into the snooping net, but potentially all innocent law abiding citizens as well. In an effort to defuse the current controversy, the Deputy Prime Minister has now promised  that open Parliamentary hearings would be held to examine draft clauses of any new bill based on the plans. However, it remains to be seen how the Government will seek to reconcile any draft bill with both the restrictions on the processing of personal data embodied in the existing 1995 Data Protection Directive the right to privacy afforded under Article 8 ECHR. It is of course inevitable that, as technology advances, so too will State surveillance systems need to evolve. However, the critical question is whether those systems can effectively be crafted so as to ensure that the surveillance society is kept within proper bounds.

APPLICATION OF S. 40 TO PUBLIC SECTOR RECRUITMENT PROCESS – BOLTON V IC & EAST RIDING YORKSHIRE COUNCIL

Posted on | by Anya Proops KC

The First-Tier Tribunal has recently considered the application of the personal data exemption to a local authority recruitment process. In Bolton v IC & East Riding Yorkshire Council  (EA/2011/0216), the applicant requested disclosure of information concerning the appointment to the authority of a new CEO, Mr Pearson. The tribunal construed the request as amounting to a request for disclosure of information relating to the recruitment process as a whole, rather than a request merely for disclosure of information relating to Mr Pearson. On this wide construction, the information in issue included: the content of the confidential application forms submitted by all the candidates; a presentation prepared by Mr Pearson as part of the recruitment process and information contained in a number of other documents relating to the authority’s decision-making process. The central issue in the case was whether this information was exempt from disclosure under s. 40(2) read together with s. 40(3)(a)(i) FOIA (exemption for personal data where disclosure would breach the first data protection principle).

So far as the information in the application forms was concerned, the tribunal took the view that this had properly been withheld under s. 40. In reaching this conclusion, the tribunal took into account a number of factors including the following:

  • the applicants would not have expected the forms to be disclosed unless this was required as part of the recruitment process

 

  • the application forms contained information relating, not to the performance of the public role applied for, but rather to the candidate’s personal professional history (it was part of their ‘life story’ and was ‘deeply personal’)

 

  • disclosure would damage the career prospects of most of the individual applicants as it would result in their current employer knowing that they were looking for alternative employment (this point did not apply to Mr Pearson who was already employed by the authority at the time of the recruitment process)

 

  • the provision of biographical information by applicants in the context of recruitment into an official role could not be compared with the disclosure to the public of biographical information relating to candidates for election to political office

 

  • whilst the interests of data subject are not paramount where the data in question relates to their public lives, the application process leading to appointment did not bring into play the discharge of public functions by the individual applicants as compared with their conduct once appointed.

 

The tribunal refused to accept that there were specific factors applicable to Mr Pearson’s form rendering that form more susceptible to disclosure. In reaching this conclusion, the tribunal appears to have taken into account in particular that the recruitment process itself appeared to have been conducted in a proper open and transparent manner. The tribunal went on to conclude that Mr Pearson’s presentation was also exempt from disclosure.

However, the tribunal also went on to hold that other information falling within the scope of the request has been improperly withheld, particularly as that information did not in fact amount to personal data. In this respect, the tribunal criticised the authority for having been too broad brush in its assessment of whether the withheld information amounted to personal data: tge fact that certain documents contained some personal data was no justification for withholding the remaining information in the document; the authority ought to have dealt with such mixed information by redacting the personal data and disclosing the impersonal data. Thus, for example, it held that the authority should have disclosed a blank version of the application form so as to increase transparency around the application process. The tribunal also held that the authority ought to have disclosed the identity of those officers in senior roles who were involved in the recruitment process.

The fact that the tribunal found in Bolton that the substantive content of the application forms was lawfully withheld under s. 40 is likely to prove reassuring both for public authorities conducting recruitment exercises and for potential recruits. However, the decision should not be construed as implying that such information will always be treated as exempt under s. 40. It may well be that the tribunal would have reached a different conclusion had there been evidence of nepotism or discrimination tainting the recruitment process.

PROVING COMMERCIAL PREJUDICE – CRANFIELD UNIVERSITY v INFORMATION COMMISSIONER

Posted on | by Anya Proops KC

The notion that s. 43 can operate to prevent the disclosure of commercially sensitive pricing information is not a new one (see further e.g. Department of Health v IC (EA/2008/0018)). Of course, that does not mean that all pricing information will fall within the ambit of the s. 43 exemption. Certainly, where the information has effectively become historic at the time of the request, it may well be that any attempt to rely on s. 43 will be doomed to failure. However, just how far does a public authority need to go to prove to the tribunal that pricing information was current and commercially sensitive at the time of the request? This was one of the questions which arose in the recent case of Cranfield University v IC (EA/2011/0146). In Cranfield, a request was made to Cranfield University for disclosure of information, including certain pricing information, which was integral to a contract which the University had entered into with the MOD. The University presented detailed evidence to the tribunal to support its case that disclosure of the pricing information would prejudice its commercial interests, particularly by enabling competitors to steal a march in the context of any retendering exercise.

Far from demonstrating a deferential approach to the University’s evidence, the tribunal showed itself willing to interrogate all the assertions and assumptions made by the University during the course of its evidence. Not least, the tribunal accepted that the pricing information embodied commercial assumptions which had been made by the University but rejected the argument that this rendered the information particularly commercially unique or original (§26). It also relied on the fact that the MOD had previously expressed concerns about the pricing mechanism used by the University to challenge the University’s assumption that the mechanism would come into play in the context of any retendering exercise (§27). Perhaps most notably, the tribunal rejected the argument that the information would be of use to competitors on the basis that the University had itself represented to the MOD that it provided a high quality cost-effective service which could not be matched by other educational institutions (§§33-34). The latter conclusion will no doubt send shivers down the back of many public authorities which provide commercial services to third parties, particularly as it will presumably be a rare authority which will not want to proudly proclaim that the services which it offers are highly competitive and offer value for money. (Compare the Visser case, discussed in Robin’s post, where the tribunal found the authority’s evidence as to commercial prejudice to be rather more compelling). Note, the tribunal were rather more forgiving when it came to the University’s case that some of the information should be withheld on an application of the personal data exemption contained in s. 40.

KENNEDY IN THE COURT OF APPEAL – THE WRITTEN JUDGMENT

Posted on | by Anya Proops KC

The question whether the right to receive information under Article 10 ECHR affords members of the public a specific right of access to information held by public authorities is an important one for information law practitioners. This is a question which was explored in some detail by the Supreme Court in the case of Sugar v BBC. In Sugar, Lord Brown, who gave the principal judgment on the Article 10 issue, concluded that, the fact that: ‘every public authority has in one sense “the sensorial power of an information monopoly” in respect of its own documents’ does not mean that the Article 10 right to receive information was interfered with whenever a public authority refused access to information, particularly where the authority was acting consistently with domestic legislation governing access to information (§94). Thus, the fact that the BBC was not obliged under FOIA to disclose to Mr Sugar a particular report on its coverage of Middle Eastern affairs did not amount to an interference with Mr Sugar’s Article 10 rights (see further Julian Milford’s detailed post on the Sugar judgment).

The conclusions reached in Sugar have very recently been considered by the Court of Appeal in Kennedy v Charity Commission [2012] EWCA Civ 317 (see Robin Hopkins’ earlier post on the convoluted history of the Kennedy litigation). In Kennedy, a request had been made to the Charity Commission for disclosure of information relating to a charity set up by George Galloway. The Charity Commission refused to disclose the information on the ground that it was exempt under s. 32(2) FOIA (information held for the purposes of an inquiry). The effect of s. 32(2), when read together with ss. 62 and 63 FOIA, is that any information which is exempt under s. 32(2) remains exempt for 30 years. As the Court of Appeal observed, this ‘30 year rule’ applies irrespective of the content of the information, the harmlessness of the disclosure, the public interest in disclosure and the willingness of those who deployed the information in the course of the inquiry for it to be disclosed (§7). Mr Kennedy, a journalist, argued that this result unlawfully interfered with his right to receive information under Article 10. He went on to argue that the provisions of FOIA should be read down so as to enable the s. 32 exemption to be disapplied once the relevant inquiry has concluded. The tribunal (which decided Mr Kennedy’s appeal on the Article 10 issue before the Supreme Court’s judgment in Sugar was handed down) accepted Mr Kennedy’s argument. The Court of Appeal concluded that it was bound by the judgment in Sugar and, hence, Mr Kennedy’s case failed.

The Court of Appeal analysed the Sugar judgment in this way: 

  • Only three members of the Supreme Court panel addressed the Article 10 issue: Lord Brown; Lord Mance and Lord Wilson. Lord Brown gave the principal judgment.

 

  • Having analysed the relevant Strasbourg jurisprudence, Lord Brown concluded that the Article 10 right to receive information did not embrace a general right to access information held by the State. He went on to comment that, even had Article 10 embraced such a general right, there would have been no unlawful interference with that right on the facts of the Sugar case. This was because it was open to the State to legislate for a blanket exclusion for information held for the purposes of journalism, as was the case under FOIA. Lord Mance agreed with Lord Brown (§§42-45).

 

  • Lord Wilson may have analysed the issues under Article 10 somewhat differently. However, as he made clear in his judgment, he agreed with the essence of Lord Brown’s judgment (§46 & 50).

 

  • Their Lordships’ analysis of the Article 10 issue did not amount to obiter commentary. Instead, it formed part of the ratio of the judgment in Sugar (§§48-52).

 

  • The judgment in Sugar was determinative of the Kennedy appeal. This was notwithstanding that Kennedy was factually distinguishable from Sugar, particularly as Mr Kennedy was a journalist and Mr Sugar was not. Lord Brown had specifically considered whether it would have made any difference to the application of Article 10 if Mr Sugar had been a journalist or some other variety of ‘social watchdog’. He concluded that it would have made no difference (see §§53-55).

 

  • Even if Lord Brown’s judgment did not amount to the ratio of Sugar, the Court of Appeal would still have followed that judgment on the basis that it was a ‘very recent authoritative pronouncement by the Supreme Court’ (§59). 

Thus, Sugar was fatal to Mr Kennedy’s appeal before the Court of Appeal. However, importantly, the Court of Appeal gave Mr Kennedy permission to appeal to the Supreme Court. In granting permission, the Court of Appeal took into account that Mr Kennedy’s case was factually distinguishable from Mr Sugar’s case, particularly because Mr Kennedy was a journalist, whereas Mr Sugar was not, and also, in contrast with the BBC, the Charity Commission was not itself discharging journalistic functions. In taking these factually distinguishing features into account, the Court of Appeal appears to have been of the view that the Article 10 question may call for a different answer to the one arrived at in Sugar where the applicant is himself a journalist and the applicant’s request for disclosure does not bring into play the public authority’s own right to freedom of expression under Article 10. The Court also alluded to the seemingly draconian effects of the 30 year rule, as applied under s. 32(2) (see §62). For further analysis of the arguments in play in the Kennedy litigation, see Tim Pitt-Payne QC’s discussion of the Article 10 arguments in his paper which is posted here.

DISCLOSURE OF NHS RISK REGISTERS – THE ‘CHILLING EFFECT’ ARGUMENT HEATS UP

Posted on | by Anya Proops KC

The First-Tier Tribunal has today handed down two important decisions in appeals concerning requests for disclosure of information relating to the Government’s controversial policy to radically overhaul the NHS: Department of Health v IC & John Healey MP (EA/2011/0287) and Department of Health v IC & Cecil (EA/2011/0286). Healey concerned a request for disclosure of a ‘transition risk register’ (TRR), essentially a set of risk assessments relating to the transition from the NHS as it was in 2010 to the NHS as it is proposed it should be once the reforms set out in the July 2010 White Paper have been implemented. Cecil concerned a request for disclosure of the ‘strategic risk register’ (SRR). The SRR contains the risk assessments for the NHS as a whole on a strategic and ongoing basis. In both cases, the DOH refused disclosure on the ground that disclosure of the registers would have a ‘chilling effect’ on the development of government policy and, accordingly, were exempt from disclosure under s. 35(1)(a) FOI (a.k.a. ‘the safe space’ exemption). The IC found that, whilst s. 35(1)(a) was engaged in respect of the registers, the public interest balance tipped in favour of their disclosure. Interestingly, the Tribunal dismissed the DOH’s appeal in respect of the TPRR but allowed it in respect of the SRR. The written reasons, which have yet to be promulgated, are no doubt going to make for interesting reading; so watch this space.