Category: Information law

Subject access – important new high court judgment

Posted on | by Anya Proops KC

It is a strange feature of the DPA subject access regime that, despite having extremely far reaching legal effects, to date it only rarely been the subject of judicial analysis. This is in no small part because the costs of bringing disputes over the application of the legislation before the courts are generally prohibitive. As readers of this blog will know, there have been some fairly recent county court judgments which have considered the application of the regime (see in particular the posts on the judgments in Elliott and Abadir here and here). However, jurisprudence emanating from the High Court has been decidedly thin on the ground. Today however the High Court has handed down an important judgment on the application of the regime: In the Matter of the Southern Pacific Personal Loans Limited [2013] EWHC 2485 (Admin). Readers will want to note in particular that part of the judgment where the court considered the relevance of the applicant’s purpose or motive in making a subject access request (SAR) – as discussed below.

The background to the case is somewhat unusual. In summary, a company which is a member of the Lehman Brothers group of companies, Southern Pacific Loans Limited (C), had gone into voluntary liquidation. Prior to the liquidation proceedings, C had been in the business of offering loans to customers, secured by means of a second mortgage on the customer’s property. C had used a third party company (A) to process data relating to certain of the loans and indeed A continues today to hold data relating to tens of thousands of redeemed loans (“the data”). C had received and was continuing to receive numerous subject access requests in respect of the data. The requests had principally been made by claims handling companies which were using the SARs as a device to obtain data relevant to claims which might potentially be brought by C’s customers. In effect therefore the data was being sought in order to advance the customers’ position in the context of prospective litigation rather than for the purposes of ensuring that the customers’ privacy was being properly protected in the context of the processing of their data by C. The costs to C of dealing with the requests was very substantial, averaging at least £40,000 per month (or £455 per request). The liquidators were concerned that a continuation of such costs would potentially have a material impact on the distribution of funds to creditors of C in the liquidation. In a sense this raised the question of whether the right of data subject’s under the DPA could trump those of creditors in a liquidation. The liquidators, seeking to protect the position of the creditors, made an application to the court for declaratory relief which would have the effect of: (a) enabling further subject access requests to be refused and, further, (b) enabling the liquidators to dispose of the data, which were no longer required by C for business purposes.

The following important points emerge from the ratio of the judgment of David Richard J:

  • liquidators cannot be regarded themselves as ‘data controllers’ in respect of data processed by a company in liquidation. This is because liquidators do not act as ‘principals’ in respect of the data but rather as ‘agents’ acting on behalf of the company in liquidation. This is the case irrespective of whether liquidators are acting in the context of voluntary of compulsory liquidations. Thus, liquidators are not personally responsible for ensuring compliance with s. 7 DPA (paras. 17-35)

 

  • so far as the disposal of data is concerned, regard should be had to the fifth data protection principle which obliges data controllers to ensure that data is not processed longer than is necessary for the purposes for which it was processed. Looked at from a DPA perspective, this meant data should be ‘disposed of as soon as possible’ (para. 39). The question was therefore whether there were any legal requirements which, in the present case, acted as impediments on the disposal of the data. There were two impediments potentially in play in the present case:

 

  • first, data could not be disposed of if retention of that data was required in order to enable C to fulfil its statutory subject access obligations in respect of extant SARs (s. 8(6) DPA)

 

  • second, data could not be disposed of if retention of that data was necessary in order for the liquidators to be able to discharge properly their statutory duties as liquidators. In the present case, that meant that particular data could not be disposed of if retention of the data was required in order to deal with claims which may be lodged against C.

Importantly, however: ‘The liquidators are not under a duty to retain data so that it can remain available to be mined by former customers or claims handling companies with a view to making claims against third parties’ (para. 40). The liquidators were at liberty to dispose of all the data, subject to the two qualifications outlined above (para. 41).

The court also made a number of obiter comments which are particularly worthy of note

  • data subjects are not entitled to use the SAR to demand disclosure of documents. Their entitlements extend merely to data rather than to documents (para. 43). (This is of course an important consideration as and when applicants are using the SAR regime to obtain advantages in litigation against the data controller or a third party)

 

  •  properly understood, the Court of Appeal’s judgment in Durant v Financial Services Authority is not authority for the proposition that requests under s. 7 DPA may be refused by the data controller if they are being made for the purposes of furthering the data subject’s position in litigation, as opposed to protecting their privacy. The question of whether SARs could lawfully be refused in these circumstances was a question for another day. However, following Durant, the question of the applicant’s purpose was a factor which was relevant to the exercise of the court’s discretion in the context of an application for enforcement made by the applicant under s. 7(9) DPA (para. 46). This last point will come as some relief to the data controller who is facing a heavily litigation-preoccupied data subject.

The court expressly declined to consider the question of the impact of s. 8(2) DPA (the ‘disproportionate effort’ provision). Thus, it did not examine the question previously considered in Ezsias v Welsh Ministers as to whether data controllers can lawfully limit their searches for personal data by reference to what is reasonable and proportionate in all the circumstances (paras. 47-49).

11KBW’s Robin Hopkins acted for the Information Commissioner.

Anya Proops

What does ‘surveillance’ mean?

Posted on | by Robin Hopkins

A five-member panel of the Investigatory Powers Tribunal last week issued its decision in Re: a Complaint of Surveillance (case no: IPT/A1/2013). The decision was on a preliminary point arising from this sort of factual scenario: suppose you voluntarily participate in an interview with policing/investigatory authorities but, unbeknownst to you, the investigators use a device to record that interview? Would this act of recording constitute ‘surveillance’ for the purposes of the Regulation of Investigatory Powers Act 2000 (RIPA), such that it requires authorisation (assuming it to be ‘directed’) was required? Would it engage your rights under Article 8 ECHR?

There are arguments both ways. As the IPT observed, “the wording in Part II [of RIPA] presents some difficulties for the reasonable reader”. The official guidance publications answer the above questions differently: the Office of the Surveillance Commissioners answers ‘yes’, but the Home Office answers ‘no’.

The IPT has agreed with the Home Office’s interpretation.

By s. 48(2) RIPA, Parliament has chosen not to define ‘surveillance’ as such, but to deem that surveillance shall be construed so as to include certain activities. Those deeming examples extend or amplify the ordinary meaning of ‘surveillance’, the essence of which is that person who is subject to surveillance is intended to remain unaware of those means and does not engage with the person secretly gathering the intelligence. In the IPT’s view, “the notion of a ‘covert interview’ requiring RIPA authorisation is one that is difficult to grasp. An interview is by its very nature an overt intelligence gathering operation in which the interviewee actively participates, even if only to the extent of refusing to answer questions”. Such interviews cannot constitute ‘surveillance’ and Article 8 rights are not engaged here.

It follows that the recording of the interview is not observing or listening to “in the course of surveillance” within the meaning of s. 48(2)(b) of RIPA, and no authorisation is required. The making of the recording only involves the recording process itself. It does not involve a separate act of “observing or listening to” the person being interviewed.

The IPT expressly rejected the contention that, regardless of the purpose, nature or circumstances of the intelligence-gathering activities in question, every act of “observing or listening to persons”, their conversations or communications is automatically treated as surveillance.

Robin Hopkins (@hopkinsrobin)

One hundred years of solicitude

Posted on | by Robin Hopkins

In 2004, a man known as TD was arrested for an alleged sexual assault. He was interviewed twice. No further action was taken. The biometric data was in due course destroyed, as will be the case with others in such positions, thanks to provisions of the Protection of Freedoms Act 2012. But 40 pages of information about his arrest and the allegation are to be retained by the Metropolitan Police in the form of crime reports and a record shall be retained on the Police National Computer until 2104, when the claimant would be 128 years old. The Metropolitan Police’s policy (of August 2012) concerned Serious Specified Offences provides for retention of such information – without review – for a century. It contends that such long-term policing solicitude as regards these types of allegations is supported by research conducted by University College London in 2009.

TD sought judicial review of this retention to decision (i.e. the refusal to delete this information). Last week, in R (TD) v Commissioner of Police for the Metropolis and Secretary of State for the Home Department [2013] EWHC 2231 (Admin), Moses LJ and Burnett J dismissed his application.

The Court surveyed the relevant line of domestic and Strasbourg authorities which have abounded in recent years: R(L), R (C) and (J), S v UK, Catt, MM v UK (the majority of which are covered in Panopticon’s archive).

The Police said its policy will need to be reviewed, but that it was too early to say that the records about TD are of no use.

Moses LJ said this (paragraph 14):

“It is necessary to be cautious as to how far the considerations of the use to which the records may be put take the Commissioner.  Every record of an allegation of crime may be of use for the indefinite future, as the research to which the Commissioner refers demonstrates.  This was the very argument on which the United Kingdom Government relied in Strasbourg in S, relying on the “inestimable value” of the data [91].  But S shows that the fact that material is of potential use, and, certainly, of greater use than in Catt, is not dispositive.  Weighed against that there remains the discomfort or worse that any citizen must feel when the state retains personal information about him, particularly when it relates to an allegation, however unfounded, of a sexual nature.  In S, it was recognised that the mere storage and retention of the data amounted to an interference within the meaning of Article 8 (para 67).”

He concluded, however (and Burnett J agreed) that (paragraph 16):

“In my view, now that only nine years have elapsed and in the knowledge that access to the information is restricted to those who seek to investigate a crime it seems to me, like Richards LJ in J, that the Commissioner has demonstrated that the use to which the records of the allegation may be put justifies their retention, at least for the time being.”

The important qualifier was that the Police’s policy should provide for a review of the retention decision, but again, it was considered too early to order any such review in this case.

This will not be the last in this line of cases. The jurisprudential debate about balancing policing utility with the privacy rights of suspects – particularly concerning the question ‘how long is too long?’  – continues.

Robin Hopkins (@hopkinsrobin)

(Scottish) Data protection litigation – South Lanarkshire and more

Posted on | by Robin Hopkins

I have observed (Panopticon passim) that the Data Protection Act 1998 features surprisingly sparingly in litigation. That appears to be somewhat less true of Scotland: for instance, Common Services Agency [2011] 1 Info LR 184, the leading case on anonymisation and barnardisation, came before the House of Lords from Scottish litigation. Here are two more recent examples, one from today, the other from last month.

South Lanarkshire

The Supreme Court has today given judgment in an appeal from the Inner House of the Scottish Court of Session about a FOI(S)A request for the number of individuals employed by South Lanarkshire Council on specific points in the pay structure, for the purposes of analysing compliance with Equal Pay legislation. The Council relied on the personal data exemption (contending that individuals could be identified from the requested information), but the Scottish Information Commissioner ordered disclosure. The Council’s appeal was dismissed by the Court of Session ([2012] CSIH 30) and, today, by the Supreme Court (South Lanarkshire Council v Scottish IC [2013] UKSC 55).

There were two issues for the Supreme Court. First, what does ‘necessary’ mean when it comes to condition 6(1) of schedule 2 to the DPA (the condition most often relied upon in support of disclosing personal data to the public), which provides that:

The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Giving the Court’s judgment, Baroness Hale said that it was obvious that condition 6 requires three questions to be answered: (i) is the data controller or the third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?, (ii) is the processing involved necessary for the purposes of those interests?, and (iii) is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject? In her view, “it is not obvious why any further exegesis of those questions is required” (paragraph 18).

Further exegesis was, however, required because of the Council’s submissions as to how strictly the term “necessary” should be construed. Baroness Hale’s answer was entirely unsurprising (see paragraphs 25-28). “Necessary” has to be considered in relation to the processing to which it relates. If the processing involves no interference with Article 8 ECHR rights, then it might be thought that all that has to be asked is whether the requester is pursuing a legitimate interest in seeking the information (which was not at issue in this case) and whether he needs that information in order to pursue it. If the processing does engage Article 8 ECHR rights, then “it is well established in community law that, at least in the context of justification rather than derogation, “necessary” means “reasonably” rather than absolutely or strictly necessary”. None of this will come as a surprise – as, for example, Jon Baines has observed in his Information Rights and Wrongs post. Indeed, as Baroness Hale observed, it is unclear that the stricter standard of necessity for which the Council argued would have been any more favourable to it.

The second issue before the Supreme Court was a natural justice challenge. The Scottish IC had asked the applicant a number of questions during his investigation, and had also received letters supporting the request from a number of MPs. This information had not been shared with the Council.

Baroness Hale observed that it was common ground that the Commissioner has a duty to act fairly (see for example Glasgow City Council v Scottish Information Commissioner [2009] CSIH 73, 2010 SC 125). The Commissioner is entitled to make his own enquiries and formulate cases on behalf of applicants, but “he must, of course, give them notice of any new material which his inquiries have elicited and which is adverse to their interests” (paragraph 31). Her Ladyship further observed (paragraphs 31-32) that:

“31. I would add that the Commissioner is fulfilling more than an administrative function. He is adjudicating upon competing claims. And in Scotland, unlike England and Wales, there is no appeal to a tribunal which can decide questions of both fact and law. The Commissioner is the sole finder of facts, with a right of appeal to the Inner House on a point of law only. These factors clearly enhance his duty to be fair. If wrong findings of fact are made as a result of an unfair process, the Inner House will not be able to correct them.

32. However, it does not follow that every communication passing between the Commissioner and the applicant, or between the Commissioner and third parties such as Members of the Scottish Parliament, has to be copied to the public authority…”

In this case, there was no breach of natural justice, and the Council’s appeal failed on both grounds.

Lyons

Another of the more notable recent data protection cases is also Scottish. Additionally, it touches upon another of my observations (see here, for example) about the potential synergies and overlaps between the DPA and defamation. The case is Lyons v Chief Constable of Strathclyde Police [2013] CSIH 46 A681/10, and will be reported in the upcoming edition of the 11KBW/Justis Information Law Reports. In rough outline, the case concerned Mr Lyons’ complaints about two disclosures about him made by the police authority to regulatory/licensing bodies. The police had said that he was recorded on the Scottish Intelligence Database as having been involved in serious organised crime. Mr Lyons denied such involvement, and sued for defamation and damages under section 13 of the DPA.

His defamation claim failed because the police’s communications were made in circumstances which attracted qualified privilege, and were not tainted by malice.

The DPA claim failed too. The accuracy requirement of the fourth data protection principle had not been breached, because even if “Mr Lyons is involved in crime” were inaccurate, “Mr Lyons is recorded on the database as being involved in crime” could not be said to be inaccurate. The police’s reporting of that information arguably lent it some credence, but there was no indication on the facts of unequivocal endorsement of these statements such as to constitute the processing of inaccurate personal data by the police. Here the Court considered the Kordowski DPA/defamation case.

There was also an argument that disclosure of this information had been unfair, though (surprisingly) the case does not appear to have been pleaded as such. The essence of the unfairness argument was that, in Mr Lyons’ view, the police should have contextualised its disclosures by explaining to the recipients the source of the intelligence as to his alleged criminal involvement. The Court of Session dismissed this argument: the police could not sensibly disclose the identities of informants, given the DPA rights of the informants themselves, while Mr Lyons would not be entitled to learn through a subject access request who the informants were (see the exemptions under sections 29 and 31 of the DPA).

Here are a few interesting DPA points to emerge from the Court’s discussion. One is if a data controller endorses the veracity of inaccurate information obtained from someone else, that is not of itself a breach of the DPA (see paragraph 21). Some might query this, at least if applied inflexibly.

A second interesting point is that some might argue as follows: “to present decontextualised allegations in a manner which suggests you consider them credible could surely constitute unfairness. Perhaps you were not required to name your sources, but in the interests of fairness you could at least have made clear that you were passing on information obtained from others whom you considered to be credible”. Roughly that sort of argument seems to have been advanced here; no doubt the facts did not ultimately support it, but stepping back from the facts of this case, the (admittedly woolly and under-litigated) notion of fairness would arguably demand such an approach in many cases.

A third and final point of interest: the complainant relied on what he said were breaches by the police of a number of common law principles emerging from judicial review jurisprudence and the like. The Court was not impressed by their relevance to alleged DPA breaches, at least in the context of this case: see paragraphs 26-27, where the Court suggested that for there to be a DPA breach, there must be a particular DPA requirement which has been breached (though admittedly it did observe earlier in its judgment that ‘lawful’ in the context of the first data protection principle has no special meaning). Some might argue that fairness and lawfulness are designed to be broad enough to encompass principles outside of the black letters of DPA law. Indeed, Article 8 ECHR is increasingly the focus of arguments as to the lawfulness of processing: see for example the ICO’s enforcement notice concerning the use of ANPR cameras in the policing context, issued last week.

In other words, the DPA is not designed to be an entirely self-contained legal world, but rather to protect personal information by reference to all considerations having a bearing on what is being done with that individual’s information, whether or not they are listed by name in the DPA. This is not necessarily a point of disagreement with the Lyons outcome, but a broader observation about what kind of a creature the DPA is, or is intended to be.

Robin Hopkins (@hopkinsrobin)

May we have our emails back?

Posted on | by Daniel Stilitz KC

In Fairstar Heavy Transport NV v (1) Philip Jeffrey Adkins (2) Claranet Ltd [2013] EWCA Civ 886 the Court of Appeal has considered what right a company has to obtain work-related emails held by its former CEO on his personal computer.

The facts were unusual, which may be why the question proved more difficult to answer than might have been expected.  The CEO had been engaged by the claimant through his own company, and so was a consultant rather than an employee.  Following the termination of his employment, he refused (for reasons which are not clear) to comply with the company’s request for copies of all the work-related emails held on his own computer.  The company accordingly applied for an order for inspection of the content of the relevant emails.  Significantly, there was no claim by the company that the contents of the emails were confidential or amounted to trade secrets.

At first instance, the matter proceeded by way of an agreed issue, namely: did the company have “an enforceable proprietary claim to the content of the emails”.  That being the issue before him, Edwards-Stuart J at first instance concluded that the content of the emails to which the company claimed a proprietary right was “information”; that according to the authorities there can be no property in mere information; and that the company therefore did not have the proprietary right on which it  based its claim.

Mummery LJ (giving the only substantive judgment in the Court of Appeal) decided that the parties had asked the court to answer the wrong question.  For Mummery LJ, the key point was that Mr Adkins had, in his CEO role, been an agent of Fairstar.  He cited the long line of authority illustrating the rule that a principal or employer is entitled to delivery up of original documents retained or removed by an agent or employee relating to transactions undertaken on the principal’s behalf.  Although emails are electronic documents, they are documents nonetheless, and the same rule should apply to them.

The appeal was therefore allowed, with Mummery LJ deprecating the arid debate below as to the whether an email contained only “information” and as to whether “information” can ever be “property”.  He specifically declined, however, to endorse the proposition that there can never be property in information: “Some kinds of information, such as non-patentable know-how, are more akin to property in their specificity and exclusivity than, say, personal information about private life”.

The point would probably have been much more straightforward Mr Adkins been an employee, since most contracts of employment and IT policies state expressly that all work-related emails belong to the employer.

The question remains open, however, as to whether non-confidential “information”, which does not amount to intellectual property, can ever be proprietary in nature.  Mummery LJ seemed to think that, depending on its nature and quality, it might.

Daniel Stilitz QC

Construction industry disputes

Posted on | by James Goudie KC

The balance of public interest was “very strongly” in favour of maintaining the confidentiality of documents in order to “protect the course of justice” both in Jackson v Info Commissioner, EA 2012/0263, FTT Decision on 19 July 2013, and in “many other such disputes” said Judge Hughes.  The value of the disclosure of the material was limited.  The adverse impact of disclosure on dispute resolution was substantial.  Judge Hughes concluded: “If there were to be change in the arrangements underpinning construction dispute resolution then this should be explored through a careful process of public debate and consultation leading to an amendment of the statutory framework.”

Cambridgeshire County Council (“the Council”) had entered into a major construction contract with BAM Nuttall for the construction of a guided busway extending 16 miles from Huntingdon to Trumpington.  There have been disputes between the parties to the contract over delays and cost-overruns which have attracted public concern.  In July 2011 the Council launched proceedings in the Technology and Construction Court (“the TCC”) against BAM Nuttall.  The proceedings continue.

Dr Jackson submitted an information request to the Council.  The Council responded.  Further, the Council advised that an application to the TCC had been made.  The Council resisted the request relying on Regulations 12(5)(b) and (f) and 13(1) of the Environmental Information Regulations.

Dr Jackson complained to the Information Commissioner.  The Commissioner upheld the Council’s position, relying on Regulation 12(5), adverse effect on the course of justice.

The FTT was satisfied that this exemption was engaged.  There was a substantial dispute between the Council and BAM Nuttall which was before the Court.  It had been preceded by adjudications held within a scheme which provided for confidentiality and where the statutory framework underpinning the scheme recognised the value of confidentiality.  The ability of parties to communicate on a without prejudice basis underlined the point that parties do deal in a candid way within the adjudication process.  The FTT was satisfied on the evidence that in this specific case there would be an adverse effect on the current litigation if there was disclosure.

Moreover, there was a further more general adverse effect that a decision would call into question the effectiveness of the ADR arrangements for construction disputes, which very often involve a public sector purchaser.  The lack of confidentiality of the ADR stages of such disputes would make the resolution harder to achieve and impact adversely on subsequent litigation, and so on the course of justice.