Category: Information law

What does ‘surveillance’ mean?

Posted on | by Robin Hopkins

A five-member panel of the Investigatory Powers Tribunal last week issued its decision in Re: a Complaint of Surveillance (case no: IPT/A1/2013). The decision was on a preliminary point arising from this sort of factual scenario: suppose you voluntarily participate in an interview with policing/investigatory authorities but, unbeknownst to you, the investigators use a device to record that interview? Would this act of recording constitute ‘surveillance’ for the purposes of the Regulation of Investigatory Powers Act 2000 (RIPA), such that it requires authorisation (assuming it to be ‘directed’) was required? Would it engage your rights under Article 8 ECHR?

There are arguments both ways. As the IPT observed, “the wording in Part II [of RIPA] presents some difficulties for the reasonable reader”. The official guidance publications answer the above questions differently: the Office of the Surveillance Commissioners answers ‘yes’, but the Home Office answers ‘no’.

The IPT has agreed with the Home Office’s interpretation.

By s. 48(2) RIPA, Parliament has chosen not to define ‘surveillance’ as such, but to deem that surveillance shall be construed so as to include certain activities. Those deeming examples extend or amplify the ordinary meaning of ‘surveillance’, the essence of which is that person who is subject to surveillance is intended to remain unaware of those means and does not engage with the person secretly gathering the intelligence. In the IPT’s view, “the notion of a ‘covert interview’ requiring RIPA authorisation is one that is difficult to grasp. An interview is by its very nature an overt intelligence gathering operation in which the interviewee actively participates, even if only to the extent of refusing to answer questions”. Such interviews cannot constitute ‘surveillance’ and Article 8 rights are not engaged here.

It follows that the recording of the interview is not observing or listening to “in the course of surveillance” within the meaning of s. 48(2)(b) of RIPA, and no authorisation is required. The making of the recording only involves the recording process itself. It does not involve a separate act of “observing or listening to” the person being interviewed.

The IPT expressly rejected the contention that, regardless of the purpose, nature or circumstances of the intelligence-gathering activities in question, every act of “observing or listening to persons”, their conversations or communications is automatically treated as surveillance.

Robin Hopkins (@hopkinsrobin)

One hundred years of solicitude

Posted on | by Robin Hopkins

In 2004, a man known as TD was arrested for an alleged sexual assault. He was interviewed twice. No further action was taken. The biometric data was in due course destroyed, as will be the case with others in such positions, thanks to provisions of the Protection of Freedoms Act 2012. But 40 pages of information about his arrest and the allegation are to be retained by the Metropolitan Police in the form of crime reports and a record shall be retained on the Police National Computer until 2104, when the claimant would be 128 years old. The Metropolitan Police’s policy (of August 2012) concerned Serious Specified Offences provides for retention of such information – without review – for a century. It contends that such long-term policing solicitude as regards these types of allegations is supported by research conducted by University College London in 2009.

TD sought judicial review of this retention to decision (i.e. the refusal to delete this information). Last week, in R (TD) v Commissioner of Police for the Metropolis and Secretary of State for the Home Department [2013] EWHC 2231 (Admin), Moses LJ and Burnett J dismissed his application.

The Court surveyed the relevant line of domestic and Strasbourg authorities which have abounded in recent years: R(L), R (C) and (J), S v UK, Catt, MM v UK (the majority of which are covered in Panopticon’s archive).

The Police said its policy will need to be reviewed, but that it was too early to say that the records about TD are of no use.

Moses LJ said this (paragraph 14):

“It is necessary to be cautious as to how far the considerations of the use to which the records may be put take the Commissioner.  Every record of an allegation of crime may be of use for the indefinite future, as the research to which the Commissioner refers demonstrates.  This was the very argument on which the United Kingdom Government relied in Strasbourg in S, relying on the “inestimable value” of the data [91].  But S shows that the fact that material is of potential use, and, certainly, of greater use than in Catt, is not dispositive.  Weighed against that there remains the discomfort or worse that any citizen must feel when the state retains personal information about him, particularly when it relates to an allegation, however unfounded, of a sexual nature.  In S, it was recognised that the mere storage and retention of the data amounted to an interference within the meaning of Article 8 (para 67).”

He concluded, however (and Burnett J agreed) that (paragraph 16):

“In my view, now that only nine years have elapsed and in the knowledge that access to the information is restricted to those who seek to investigate a crime it seems to me, like Richards LJ in J, that the Commissioner has demonstrated that the use to which the records of the allegation may be put justifies their retention, at least for the time being.”

The important qualifier was that the Police’s policy should provide for a review of the retention decision, but again, it was considered too early to order any such review in this case.

This will not be the last in this line of cases. The jurisprudential debate about balancing policing utility with the privacy rights of suspects – particularly concerning the question ‘how long is too long?’  – continues.

Robin Hopkins (@hopkinsrobin)

(Scottish) Data protection litigation – South Lanarkshire and more

Posted on | by Robin Hopkins

I have observed (Panopticon passim) that the Data Protection Act 1998 features surprisingly sparingly in litigation. That appears to be somewhat less true of Scotland: for instance, Common Services Agency [2011] 1 Info LR 184, the leading case on anonymisation and barnardisation, came before the House of Lords from Scottish litigation. Here are two more recent examples, one from today, the other from last month.

South Lanarkshire

The Supreme Court has today given judgment in an appeal from the Inner House of the Scottish Court of Session about a FOI(S)A request for the number of individuals employed by South Lanarkshire Council on specific points in the pay structure, for the purposes of analysing compliance with Equal Pay legislation. The Council relied on the personal data exemption (contending that individuals could be identified from the requested information), but the Scottish Information Commissioner ordered disclosure. The Council’s appeal was dismissed by the Court of Session ([2012] CSIH 30) and, today, by the Supreme Court (South Lanarkshire Council v Scottish IC [2013] UKSC 55).

There were two issues for the Supreme Court. First, what does ‘necessary’ mean when it comes to condition 6(1) of schedule 2 to the DPA (the condition most often relied upon in support of disclosing personal data to the public), which provides that:

The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Giving the Court’s judgment, Baroness Hale said that it was obvious that condition 6 requires three questions to be answered: (i) is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?, (ii) is the processing involved necessary for the purposes of those interests?, and (iii) is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? In her view, “it is not obvious why any further exegesis of those questions is required” (paragraph 18).

Further exegesis was, however, required because of the Council’s submissions as to how strictly the term “necessary” should be construed. Baroness Hale’s answer was entirely unsurprising (see paragraphs 25-28). “Necessary” has to be considered in relation to the processing to which it relates. If the processing involves no interference with Article 8 ECHR rights, then it might be thought that all that has to be asked is whether the requester is pursuing a legitimate interest in seeking the information (which was not at issue in this case) and whether he needs that information in order to pursue it. If the processing does engage Article 8 ECHR rights, then “it is well established in community law that, at least in the context of justification rather than derogation, “necessary” means “reasonably” rather than absolutely or strictly necessary”. None of this will come as a surprise – as, for example, Jon Baines has observed in his Information Rights and Wrongs post. Indeed, as Baroness Hale observed, it is unclear that the stricter standard of necessity for which the Council argued would have been any more favourable to it.

The second issue before the Supreme Court was a natural justice challenge. The Scottish IC had asked the applicant a number of questions during his investigation, and had also received letters supporting the request from a number of MPs. This information had not been shared with the Council.

Baroness Hale observed that it was common ground that the Commissioner has a duty to act fairly (see for example Glasgow City Council v Scottish Information Commissioner [2009] CSIH 73, 2010 SC 125). The Commissioner is entitled to make his own enquiries and formulate cases on behalf of applicants, but “he must, of course, give them notice of any new material which his inquiries have elicited and which is adverse to their interests” (paragraph 31). Her Ladyship further observed (paragraphs 31-32) that:

“31. I would add that the Commissioner is fulfilling more than an administrative function. He is adjudicating upon competing claims. And in Scotland, unlike England and Wales, there is no appeal to a tribunal which can decide questions of both fact and law. The Commissioner is the sole finder of facts, with a right of appeal to the Inner House on a point of law only. These factors clearly enhance his duty to be fair. If wrong findings of fact are made as a result of an unfair process, the Inner House will not be able to correct them.

32. However, it does not follow that every communication passing between the Commissioner and the applicant, or between the Commissioner and third parties such as Members of the Scottish Parliament, has to be copied to the public authority…”

In this case, there was no breach of natural justice, and the Council’s appeal failed on both grounds.

Lyons

Another of the more notable recent data protection cases is also Scottish. Additionally, it touches upon another of my observations (see here, for example) about the potential synergies and overlaps between the DPA and defamation. The case is Lyons v Chief Constable of Strathclyde Police [2013] CSIH 46 A681/10, and will be reported in the upcoming edition of the 11KBW/Justis Information Law Reports. In rough outline, the case concerned Mr Lyons’ complaints about two disclosures about him made by the police authority to regulatory/licensing bodies. The police had said that he was recorded on the Scottish Intelligence Database as having been involved in serious organised crime. Mr Lyons denied such involvement, and sued for defamation and damages under section 13 of the DPA.

His defamation claim failed because the police’s communications were made in circumstances which attracted qualified privilege, and were not tainted by malice.

The DPA claim failed too. The accuracy requirement of the fourth data protection principle had not been breached, because even if “Mr Lyons is involved in crime” were inaccurate, “Mr Lyons is recorded on the database as being involved in crime” could not be said to be inaccurate. The police’s reporting of that information arguably lent it some credence, but there was no indication on the facts of unequivocal endorsement of these statements such as to constitute the processing of inaccurate personal data by the police. Here the Court considered the Kordowski DPA/defamation case.

There was also an argument that disclosure of this information had been unfair, though (surprisingly) the case does not appear to have been pleaded as such. The essence of the unfairness argument was that, in Mr Lyons’ view, the police should have contextualised its disclosures by explaining to the recipients the source of the intelligence as to his alleged criminal involvement. The Court of Session dismissed this argument: the police could not sensibly disclose the identities of informants, given the DPA rights of the informants themselves, while Mr Lyons would not be entitled to learn through a subject access request who the informants were (see the exemptions under sections 29 and 31 of the DPA).

Here are a few interesting DPA points to emerge from the Court’s discussion. One is if a data controller endorses the veracity of inaccurate information obtained from someone else, that is not of itself a breach of the DPA (see paragraph 21). Some might query this, at least if applied inflexibly.

A second interesting point is that some might argue as follows: “to present decontextualised allegations in a manner which suggests you consider them credible could surely constitute unfairness. Perhaps you were not required to name your sources, but in the interests of fairness you could at least have made clear that you were passing on information obtained from others whom you considered to be credible”. Roughly that sort of argument seems to have been advanced here; no doubt the facts did not ultimately support it, but stepping back from the facts of this case, the (admittedly woolly and under-litigated) notion of fairness would arguably demand such an approach in many cases.

A third and final point of interest: the complainant relied on what he said were breaches by the police of a number of common law principles emerging from judicial review jurisprudence and the like. The Court was not impressed by their relevance to alleged DPA breaches, at least in the context of this case: see paragraphs 26-27, where the Court suggested that for there to be a DPA breach, there must be a particular DPA requirement which has been breached (though admittedly it did observe earlier in its judgment that ‘lawful’ in the context of the first data protection principle has no special meaning). Some might argue that fairness and lawfulness are designed to be broad enough to encompass principles outside of the black letters of DPA law. Indeed, Article 8 ECHR is increasingly the focus of arguments as to the lawfulness of processing: see for example the ICO’s enforcement notice concerning the use of ANPR cameras in the policing context, issued last week.

In other words, the DPA is not designed to be an entirely self-contained legal world, but rather to protect personal information by reference to all considerations having a bearing on what is being done with that individual’s information, whether or not they are listed by name in the DPA. This is not necessarily a point of disagreement with the Lyons outcome, but a broader observation about what kind of a creature the DPA is, or is intended to be.

Robin Hopkins (@hopkinsrobin)

May we have our emails back?

Posted on | by Daniel Stilitz KC

In Fairstar Heavy Transport NV v (1) Philip Jeffrey Adkins (2) Claranet Ltd [2013] EWCA Civ 886 the Court of Appeal has considered what right a company has to obtain work-related emails held by its former CEO on his personal computer.

The facts were unusual, which may be why the question proved more difficult to answer than might have been expected.  The CEO had been engaged by the claimant through his own company, and so was a consultant rather than an employee.  Following the termination of his employment, he refused (for reasons which are not clear) to comply with the company’s request for copies of all the work-related emails held on his own computer.  The company accordingly applied for an order for inspection of the content of the relevant emails.  Significantly, there was no claim by the company that the contents of the emails were confidential or amounted to trade secrets.

At first instance, the matter proceeded by way of an agreed issue, namely: did the company have “an enforceable proprietary claim to the content of the emails”.  That being the issue before him, Edwards-Stuart J at first instance concluded that the content of the emails to which the company claimed a proprietary right was “information”; that according to the authorities there can be no property in mere information; and that the company therefore did not have the proprietary right on which it  based its claim.

Mummery LJ (giving the only substantive judgment in the Court of Appeal) decided that the parties had asked the court to answer the wrong question.  For Mummery LJ, the key point was that Mr Adkins had, in his CEO role, been an agent of Fairstar.  He cited the long line of authority illustrating the rule that a principal or employer is entitled to delivery up of original documents retained or removed by an agent or employee relating to transactions undertaken on the principal’s behalf.  Although emails are electronic documents, they are documents nonetheless, and the same rule should apply to them.

The appeal was therefore allowed, with Mummery LJ deprecating the arid debate below as to the whether an email contained only “information” and as to whether “information” can ever be “property”.  He specifically declined, however, to endorse the proposition that there can never be property in information: “Some kinds of information, such as non-patentable know-how, are more akin to property in their specificity and exclusivity than, say, personal information about private life”.

The point would probably have been much more straightforward Mr Adkins been an employee, since most contracts of employment and IT policies state expressly that all work-related emails belong to the employer.

The question remains open, however, as to whether non-confidential “information”, which does not amount to intellectual property, can ever be proprietary in nature.  Mummery LJ seemed to think that, depending on its nature and quality, it might.

Daniel Stilitz QC

Construction industry disputes

Posted on | by James Goudie KC

The balance of public interest was “very strongly” in favour of maintaining the confidentiality of documents in order to “protect the course of justice” both in Jackson v Info Commissioner, EA 2012/0263, FTT Decision on 19 July 2013, and in “many other such disputes” said Judge Hughes.  The value of the disclosure of the material was limited.  The adverse impact of disclosure on dispute resolution was substantial.  Judge Hughes concluded: “If there were to be change in the arrangements underpinning construction dispute resolution then this should be explored through a careful process of public debate and consultation leading to an amendment of the statutory framework.”

Cambridgeshire County Council (“the Council”) had entered into a major construction contract with BAM Nuttall for the construction of a guided busway extending 16 miles from Huntingdon to Trumpington.  There have been disputes between the parties to the contract over delays and cost-overruns which have attracted public concern.  In July 2011 the Council launched proceedings in the Technology and Construction Court (“the TCC”) against BAM Nuttall.  The proceedings continue.

Dr Jackson submitted an information request to the Council.  The Council responded.  Further, the Council advised that an application to the TCC had been made.  The Council resisted the request relying on Regulations 12(5)(b) and (f) and 13(1) of the Environmental Information Regulations.

Dr Jackson complained to the Information Commissioner.  The Commissioner upheld the Council’s position, relying on Regulation 12(5), adverse effect on the course of justice.

The FTT was satisfied that this exemption was engaged.  There was a substantial dispute between the Council and BAM Nuttall which was before the Court.  It had been preceded by adjudications held within a scheme which provided for confidentiality and where the statutory framework underpinning the scheme recognised the value of confidentiality.  The ability of parties to communicate on a without prejudice basis underlined the point that parties do deal in a candid way within the adjudication process.  The FTT was satisfied on the evidence that in this specific case there would be an adverse effect on the current litigation if there was disclosure.

Moreover, there was a further more general adverse effect that a decision would call into question the effectiveness of the ADR arrangements for construction disputes, which very often involve a public sector purchaser.  The lack of confidentiality of the ADR stages of such disputes would make the resolution harder to achieve and impact adversely on subsequent litigation, and so on the course of justice.

A Mixed Week for Prince Charles

Posted on | by Christopher Knight

Prince Charles has had an interesting week. In an announcement eagerly awaited by the massed ranks of the world’s media, with live coverage continuing interminably on all news channels, a small piece of paper was placed on a gilded easel which informed the impatient public that on 25 July 2013 Lord Judge CJ was delivered of permission to appeal against the Divisional Court’s judgment in support of the veto over release of the Prince of Wales’ correspondence with Ministers. The Court of Appeal will accordingly hear the appeal in R (Evans) v HM Attorney General (see Panopticon posts ad nauseam) in due course.

Oh, and apparently there was something about a baby this week. This has no direct implications for information law and so will be of no interest to readers of this blog.

Christopher Knight