It is a common problem encountered by data controllers that a dataset is in principle anonymous, but where the numbers within that dataset are sufficiently small, the individual data subject(s) to which they relate may be identifiable, particularly when taken with other publicly available information. Datasets released often refuse to provide the specific number where it is below five for that reason. In NHS Business Authority v Information Commissioner & Spivack [2021] UKUT 192 (AAC), the Upper Tribunal reviewed and revisited that issue. Continue reading →

Back in late May 2021, it will be recalled that the Court of Appeal found the immigration exemption in para 4 of Schedule 2 to the Data Protection Act 2018 to be unlawful in its failure to comply with Article 23(2) GDPR: see the post here. The judgment made clear that the question of relief would be a matter for further submissions. A hearing was held on the question of relief on 8 October 2021, at the end of which the Court of Appeal announced in open court its decision. The immigration exemption will be declared to be unlawful, but that declaration will be suspended until 31 January 2022. In other words, the Government has until the end of January 2022 to introduce and bring into effect legislation amending the exemption, so as to avoid harm to the public interest. If it fails to do so, the exemption will be disapplied from that date. The Government’s current stated intention is to amend para 4 by means of regulations made under section 16 DPA. The reasons for that ruling will be handed down in due course.

Christopher Knight

Another week, another Upper Tribunal consultation. This time, the Tribunal Procedure Committee is inviting responses – by 16 August 2021 – on proposals to amend the Upper Tribunal Rules to enable judges to certify applications for permission to appeal as ‘totally without merit’, and thus removing the right to renew that application at an oral hearing. The changes would effectively align the UT with the position under the CPR, in relation to both applications for permission to claim judicial review and applications for permission to appeal. Given that it is just – just – possible that readers of this blog working in information rights may have come across litigants who make totally without merit applications, the consultation may be of interest. It is to be found here.

Christopher Knight

The Grand Chamber of the European Court of Human Rights has handed down judgment (over 200 pages of it) in relation to the UK’s bulk interception of communications regime as it stood under section 8(4) of the Regulation of Investigatory Powers Act 2000 in Big Brother Watch & others v UK (App. No.s 58170/13, 62322/14 and 24969/15), and made important findings that the regime was not in accordance with law and thus breached Article 8 ECHR. Continue reading →

The Upper Tribunal (Administrative Appeals Chamber) hears a lot of information rights appeals. What not all users of the UT, or readers of this blog, may have realised is that not all of its decisions – despite it being an appellate jurisdiction – are published online rendering them accessible to those interested in the area. Still fewer are then selected for reporting in the Administrative Appeals Case Reports, although we have our doubts whether anyone really uses the AACR. Is it time for a change of approach? Continue reading →

The first major GDPR penalty notice appeal – Ticketmaster UK Ltd v Information Commissioner (EA/2020/0359/FP) – has been stayed by order of the First-tier Tribunal until 28 days after the handing down of judgment in civil litigation brought against Ticketmaster by some 795 Ticketmaster customers: Collins & Others v Ticketmaster UK Ltd (BL-2019-LIV-000007). Continue reading →