It’s fair to say that the Supreme Court’s Brexit judgment has taken some attention from other legal developments of the day, but Holyoake v (1) Candy (2) CPC Group Limited [2017] EWHC 52 is another significant judgment on the scope of the subject access right under s.7 DPA, and not just because it involves all 4 of Panopticon’s editors.

In the context of underlying multi-million pound proceedings in the Chancery Division between the parties, who are high-end property developers, Mr Holyoake made SARs against Mr Candy and CPC, which he asserted had been inadequately answered. Mr Holyoake claimed that the defendants had carried out inadequate searches, and that Mr Candy had invalidly relied on the LPP exemption. Continue reading →

The Upper Tribunal has just issued judgment in Central London Community Healthcare NHS Trust v Information Commissioner [2013] UKUT 0551. This significant decision is the first time the Upper Tribunal has considered an appeal against a monetary penalty notice (“MPN”), issued by the Commissioner under section 55A Data Protection Act 1998 (“DPA”).

The Commissioner is empowered to issue an MPN under section 55A DPA, where he is satisfied that there has been a serious contravention of the data protection principles by a data controller, the contravention was of a kind likely to cause substantial damage or distress, and other relevant conditions are met. The amount of an MPN may be up to £500,000. In this case, the Trust had repeatedly faxed sensitive medical details of patients to a member of the public by mistake, believing that it was faxing them to a hospice. The Trust had “self-reported” its own contravention to the Commissioner, who had issued an MPN of £90,000.

The Trust appealed against the MPN under section 49 DPA, first to the First-Tier Tribunal, which rejected the appeal, and then to the Upper Tribunal. The grounds of appeal were fourfold: (1) the Commissioner failed to recognise he had a discretion as to whether to issue a MPN, and failed to consider how it should be exercised; (2) the Tribunal should have concluded that the Commissioner was barred from serving an MPN, because the Trust had self-reported its breach; (3) the Commissioner had acted unlawfully in offering the Trust a discount of £18,000 for early payment of the MPN, but refusing to allow the Trust to benefit from the discount if it decided to appeal; and (4) the quantum of the award was unsustainably high.

The Upper Tribunal rejected all four grounds of appeal. Along the way, it made some useful general observations about the way in which the MPN regime works. In particular, it stated as follows:

(1)    The fact that a public authority has self-reported a breach does not prevent the Commissioner from issuing an MPN. Among other matters, the logical implication of that argument would be that a data controller responsible for a deliberate and very serious breach of the DPA could avoid an MPN simply by self-reporting. That could not be correct.

(2)    As a matter of principle, the Commissioner has discretion whether to issue an MPN where the statutory conditions for its issue are met, as well as discretion as to the amount. On appeal, the First-Tier Tribunal (“FTT”) must conduct a full merits review of the Commissioner’s exercise of his discretion. The nature of the FTT’s jurisdiction on an appeal under section 49 DPA was akin to the nature of its jurisdiction in an appeal against a decision notice of the Commissioner under section 58 Freedom of Information Act 2000 (“FOIA”). In other words, the FTT’s function under section 49 DPA was to decide whether the Commissioner’s decision to issue an MPN and the amount of the penalty was right.

(3)    It was permissible for the Commissioner to operate a scheme which gave a discount for early payment, if and only if the public authority did not appeal. There was a strong public policy argument justifying such a scheme – the early payment and early resolution of the issue. The proper analogy was with discount schemes operated for fixed penalty notices e.g. for minor motoring contraventions.

(4)    The Upper Tribunal did in principle have the power to increase a penalty under section 55A DPA, although that issue did not arise on the facts of this case.

The decision is an important validation of the way in which the Commissioner presently approaches the issuance of MPNs, and usefully clarifies the nature of appeals against MPNs.

Timothy Pitt-Payne QC of 11KBW acted for the Trust; Anya Proops of 11KBW acted for the Commissioner.

Julian Milford 

Anyone interested in issues of privacy and data protection cannot have avoided the recent allegations in The Guardian (and now, everywhere else) about blanket surveillance by GCHQ of emails and phone calls between UK residents, when they have been routed in and out of the UK through servers held abroad; and about the use by UK authorities of surveillance information on UK residents collected by the US, without going through the usual domestic legal checks on collection of such information. Liberty has now announced that it is taking legal action against the British Intelligence Services. It will argue that their actions have breached both the provisions of the Regulation of Investigatory Powers Act 2000, and the right to respect for private life, home and correspondence under Article 8 of the European Convention on Human Rights. Liberty’s press release of today (25 June 2013) can be seen at https://www.liberty-human-rights.org.uk/media/press/2013/liberty-issues-claim-against-british-intelligence-servic.php.

Last week, the Supreme Court gave judgment in Bank Mellat v Her Majesty’s Treasury (no.1) [2013] UKSC 38. The Bank Mellat case involved financial restrictions imposed by HMT on the Bank under the Counter-Terrorism Act 2008 (“the 2008 Act”), on the basis that it enabled funding for Iran’s nuclear weapons programme. The High Court and Court of Appeal had both adopted a closed material procedure (“CMP”) – i.e. a procedure in which the court sits in private, and hears evidence and/or submissions without one party either being present or seeing the material – in order to consider sensitive material adduced by HMT which could not be disclosed to the Bank. They had specific statutory authority to do so under the 2008 Act. The Supreme Court did not have such authority. The  relevant questions were whether it was possible for the Supreme Court to adopt a CMP on appeal, in the absence of specific statutory provision; and if so, whether it was appropriate to do so in that particular case. The Supreme Court was faced with the difficulty of reconciling two strong but opposing interests. On the one hand, it was important that the Court should be able to see and consider any relevant material before the High Court and Court of Appeal. On the other, the Supreme Court itself in Al Rawi v Security Service [2012] 1 AC 531 had uncompromisingly set its face against any derogation from the open justice principle. The Supreme Court was divided; but the majority considered that the Court had implied authority to adopt a CMP under its powers conferred by the Constitutional Reform Act 2005, where the lower courts had themselves used a CMP. Nevertheless, the Court was uncomfortable about doing so, and expressed that discomfort in strong terms.

Bank Mellat (no.1) was not, of course, a freedom of information case. But it has important things to say for freedom of information cases. Freedom of information appeals are the classic example of cases which may require a CMP. Submissions must be made about, and evidence given on, the disputed information in the appeal. But that may involve disclosing the content of the information itself. If the party requesting the information was present, this would wholly undermine the purpose of the appeal. So the general points made about CMPs in Bank Mellat (no.1) are of obvious significance for FOIA appeals.

At [68]-[74] of the judgment in Bank Mellat (no.1), Lord Neuberger (giving the majority’s view) made the following general points about the use of closed material by or before appeal courts:

(1)    Where a judge gives an open and closed judgment, it is highly desirable that in the open judgment the judge (i) identifies every conclusion in the open judgment reached in whole or in part in the light of points made or evidence referred to in the closed judgment; and (ii) says that this is what they have done.

(2)    A judge who has relied on closed material in a closed judgment should say in the open judgment as much as can properly be said about the closed material relied on. Any party excluded from the closed hearing should know as much as possible about the court’s reasoning, and the evidence and the arguments it has received.

(3)    On an appeal against an open and closed judgment, an appellate court should only be asked to conduct a closed hearing if it is strictly necessary for fairly determining the appeal. That puts an important onus on legal representatives asking an appeal court to look at closed material. An advocate who wants a closed hearing should carefully consider whether the request should, or even can properly, be made, and advise their clients accordingly. (This would of course be relevant for appeals to the Upper Tribunal from FOIA decisions in the First-Tier Tribunal.)

(4)    If the appellate court decides that it should look at closed material, careful consideration should be given by the advocates and the court to whether it would nevertheless be possible to avoid a closed hearing, on the basis that the court can be addressed on confidential material in open court e.g. by elliptical references. This, again, is particularly relevant to the Upper Tribunal on FOIA appeals.

(5)    If the court decides that a CMP is necessary, the parties should try and agree a way of avoiding, or minimising the extent of, a closed hearing.

(6)    If there is a closed hearing, the lawyers representing the party relying on closed material should give the excluded party as much information as possible about closed documents relied on.

(7)    Appellate courts should be robust about acceding to applications to go into closed session or even to look at closed material.

The general tenor of the judgments is to deprecate any use of CMPs. As Lord Neuberger put it: “any judge, indeed anybody concerned about the dispensation of justice, must regard the prospect of a closed material procedure, whenever it is mooted and however understandable the reasons it is proposed, with distaste and concern.”

Julian Milford

The First-Tier Tribunal’s decision of 13 December 2012 in Montague v (1) Information Commissioner (2) Liverpool John Moores University EA/2012/0109 will be of interest to academic institutions, and any other public bodies whose employees have research interests not necessarily connected with their job. Anya Proops of 11KBW appeared for the University.

The Appellant Mr Montague asked Liverpool John Moores University for copies of emails sent by a senior lecturer at the University from his University email account, linked to his work with the Global Warming Policy Foundation (“GWPF”). The lecturer in question had worked at the University from November 1993 to July 2010 as a social anthropologist. In November 2009, he had become Director of the GWPF. The GWPF is a controversial organisation founded under the aegis of Lord Lawson, which promotes scepticism about man-made climate change.

The question at issue was whether the University “held” the information for the purposes of the Freedom of Information Act 2000 (“FOIA”), even if it was in fact contained in a university email account to which it had access.

Information is “held” by an authority for the purposes of FOIA if it is held by the authority “otherwise than on behalf of another person”, or is held by another person “on behalf of the authority”: see s.3(2) FOIA. That means mere physical possession of information is not enough to establish that information is “held”; it must also, to a sufficient extent, be meaningfully connected to the authority: see for example University of Newcastle v IC and BUAV [2011] UKUT 185 (AAC).

Both the University and the ICO considered that the University did not “hold” the information in this case, and the Tribunal agreed. The crucial point was that there was no connection between the lecturer’s private research for the GWPF, and the work he did within the University. The lecturer pursued the subject of global warming in his own free time, and exclusively in his own private interest. It had no bearing on his role as an academic employed in the University’s School of Sport and Exercise Science. The research was not funded by the University, and the University neither had any interest in the research nor sought to benefit from it. Since the emails were sent in a purely private and personal capacity, the University did not “hold” them.

This outcome is plainly in accordance with FOIA, and was perhaps inevitable on the facts. It should be of comfort to academic institutions whose lecturers pursue private interests. Of course, the situation would have been very different if the research had been connected in any way with the lecturer’s post. The decision can usefully be compared and contrasted with the ICO’s recent decision concerning emails sent by the Secretary of State for Education (Michael Gove) from his private email account. There, the information was in fact “held” by the Department for Education for the purposes of FOIA, even though the Department was not in physical possession of the information, because the ICO considered it concerned the business of the Department, rather than purely party political matters. The thread running through the two contrasting decisions is the same: what matters is not whether the authority actually has possession of the information, but whether the information has a substantial connection to its business.

Julian Milford