Personal data: it’s all in the name

Posted on | by James Cornwell

A person’s name constitutes his or her personal data – so has held the Upper Tribunal recently in Information Commissioner v Financial Services Authority & Edem [2012] UKUT 464 (AAC).

Section 1(1) of the Data Protection Act 1998 (“the DPA”) defines “personal data” thus:

“‘personal data’ means data which relate to a living individual who can be identified—

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual; …”

Mr Edem made a request under the Freedom of Information Act 2000 (“FOIA”) to the Financial Services Authority (“the FSA”) seeking “a copy of all information that the FSA holds about me and/or my complaint that the FSA had failed to correctly regulate Egg plc”. The FSA declined to provide the information on various grounds. Mr Edem complained to the Information Commissioner. By the time that the Commissioner issued his Decision Notice the only remaining withheld information was the names of three FSA officials. The Commissioner upheld the FSA’s refusal to disclose this information on the basis that it was personal data of the individuals, they would have had no expectation of their names being released in public and any legitimate interest in disclosure was outweighed by the prejudice to their rights and freedoms (i.e. the information was exempt under FOIA, section 40(2) because disclosure would breach the First Data Protection Principle in Schedule 1 to the DPA).

On Mr Edem’s appeal the First-tier Tribunal (Information Rights) (“the FTT”) decided that the names of the officials did not constitute their personal data and ordered disclosure. In reaching that conclusion the FTT purported to apply the well-known analysis of the concept of personal data by Auld LJ in Durant v FSA [2003] EWCA Civ 1746, [2011] 1 Info LR 1 at [26-29]. In Durant at [28] Auld LJ identified two notions “that may be of assistance” in considering whether information relates to an person: biographical significance and focus. The FTT found that the disputed information was “not biographical in any significant sense” as it simply concerned transactions in which the individuals were involved. Further, the FTT held that the information did not have the individuals as its focus, but rather the handling of Mr Edem’s complaint.

In the Upper Tribunal Judge Jacobs rejected that analysis and allowed the Commissioner’s and FSA’s appeals against the FTT’s decision.

The Judge identified two relevant elements to the definition of personal data in section 1(1) of the DPA: relation and identification (see at [10]). Durant was a case about relation, not identification (see at [20], [29]). The Judge considered that Auld LJ’s two notions (biographical significance and focus) were not presented as being exhaustive or as defining the concept of personal data (see at [21]) and were limited to “borderline” cases (see at [23]).

Judge Jacobs considered that the ECJ’s decisions in Criminal Proceedings against Bodil Lindqvist (Case C-101/01) [2003] ECR I-6055 and European Commission v Bavarian Lager Co Ltd (Case C-28/08 P) were authority that the names of persons are personal data.

As the names of the officials were held by the FSA, the information was data for the purposes of section 1(1) of the DPA (see at [33]). Although the names were (in this case) not unique, taken together with contextual information such as grades and dates of employment they identified the officials (see at [36]).  As to the relation element of the definition of personal data, the Judge concluded that the FTT had either: (1) misdirected itself because Auld LJ’s two notions were not relevant in this case as the information requested included not just the names but other personal data including the individuals’ role within the FSA and their involvement in Mr Edem’s complaint (see at [38]); or (2) misapplied Auld LJ’s two notions. There were two ways in which such misapplication occurred. First, the FTT adopted an approach to biographical significance that was too narrow and was inconsistent with the ECJ’s decision in Bavarian Lager (see at [40]). Secondly, the holder of information has to know whether or not information is personal data at the time it is recorded and on the test adopted by the FTT information would not be biographical because its significance was not known at the time of recording (see at [41]).

Having concluded that the information was personal data Judge Jacobs set aside the FTT’s decision and re-made the decision, finding (in agreement with the Commissioner’s Decision Notice) that condition 6 of Schedule 2 to the DPA was not satisfied as no legitimate interest in disclosure had been identified.

The Upper Tribunal’s conclusion in relation to the misapplication of Auld LJ’s two notions is plainly correct – the FTT’s approach does seem to have been significantly narrower than that approved by the ECJ in Bavarian Lager. Judge Jacobs’ second point in relation to misapplication is interesting. If biographical significance is interpreted in such a way that it is dependent on subjective or context-dependent judgment, then the task of a data controller would, indeed, be rendered very difficult as information slipped into and out of being personal data.

It should be noted that both in this case and Bavarian Lager there was some additional context in which the names appeared that gave them biographical significance – the case should not be read as saying that a name on its own (devoid of context) is necessarily personal data.

The Judge’s reasoning on the FTT’s misdirection at [38] is potentially more controversial. Whilst Auld LJ clearly intended his “two notions” to be non-exhaustive, it is open to question whether the judgments in Durant can really be read as intending to limit them only to borderline cases. However, that is the stance that the Information Commissioner and the Government have traditionally taken in interpreting Durant and Judge Jacobs has accepted it.

Information “reasonably accessible” despite hefty charge

Posted on | by Charles Bourne

In Davis v ICO and Health and Social Care Information Centre (case no. EA/2012/0175, judgment 24 January 2013) the First-Tier Tribunal applied the absolute exemption under section 21 of FOIA 2000 for information which is reasonably accessible to an applicant other than under section 1. The requested information consisted of health statistics which the public authority was willing to provide to the appellant under its publication scheme for a charge of £1,550. The appellant argued that the charge meant the information could not be considered to be reasonably accessible to a person of ordinary means.

 Section 19 of FOIA requires public authorities to adopt publication schemes, subject to approval by the Information Commissioner, for the dissemination of information with or without charge. Section 20 provides for the ICO to approve model publication schemes which public authorities may adopt without further approval.

 The critical provision in this case was section 21(3) which provides that information is “not to be regarded as reasonably accessible to the applicant merely because it is available from the public authority on request, unless the information is made available in accordance with the authority’s publication scheme and any payment required is specified in, or determined in accordance with, the scheme”.

 The Tribunal interpreted this provision as meaning that if a scheme has the ICO’s approval and if the charge is specified in the scheme or ascertainable from it, the ICO and the Tribunal are required – rather than merely empowered – to regard the information as reasonably accessible.

 There was therefore no scope for the ICO or the Tribunal to judge the accessibility of the information by reference to the charge or any other factor. The ICO’s approval of the model scheme was conclusive. The Tribunal was persuaded that the ICO is indeed the appropriate authority to determine whether access is reasonable, and that it was hard to see why Parliament should enact a detailed system for approval of publication schemes and notification of charges “if compliance simply made the authority`s published information eligible for an assessment as to whether it was reasonably accessible”.

 It seems that the only remedy for an applicant who is deterred by charges is to draw the matter to the ICO’s attention. The ICO is empowered to revoke his approval on notice and, as the Tribunal noted, might take such a step if there was evidence of charges deterring information requests.

 Charles Bourne

Court of Appeal Declares Criminal Records Regime Incompatible with Article 8

Posted on | by Christopher Knight

The Court of Appeal has today handed down an important judgment in R (T & others) v Chief Constable of Greater Manchester & others [2013] EWCA Civ 25. The case concerned the blanket requirement in the Rehabilitation of Offenders Act 1974, section 113B of the Police Act 1997 and articles 3 and 4 of the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 that criminal convictions and cautions must be disclosed in an enhanced criminal record check (“ECRC”) in the context of particular types of employment (such as with children or vulnerable adults), even if those convictions or cautions would otherwise be deemed spent by the 1974 Act. (For a summary of the issues prior to the hearing, see Hannah Slarks’ post here.)

The Cases

The Court heard three conjoined cases. The lead case, T, was an appeal against a judgment of Kenneth Parker J: [2012] EWHC 147 (Admin) (upon which Robin Hopkins blogged here). T had received two cautions in relation to two stolen bicycles when he was 11 years old, which was disclosed as part of his participation in a sports studies degree course because he was required to work with children. T was not in fact prevented from completing his degree following the ECRC. JB was a lady who had been refused employment as a care home worker following the revelation in her ECRC that she had a caution for theft of some false nails eight years previously. Permission to judicially review the legislative scheme had been refused by HHJ Gosnell. A third case was also joined, that of AW, who when 16 had received custodial sentences for manslaughter and robbery arising out of a car-jacking and who wished to join the Army. Permission had been refused in her case by HHJ Gosnell, and unlike JB, permission to appeal had also been refused on the papers by the Court of Appeal.

Interference with Article 8

Lord Dyson MR, Richards and Davis LJJ accepted the written concession of the Secretary of State that there was an interference with the Article 8 rights of the claimants. There are two possible forms of interference. First, it may occur where there is disclosure of personal information which individuals wish to keep to themselves. Cautions are generally given in private and will fade into the past. Secondly, disclosure may lead to an individual’s exclusion from employment. For T, the first of these was clearly engaged, but Court also considered the second to be in play, holding that it was sufficient that disclosure “was liable to affect his ability to obtain employment”, even though it did not in fact do so: at [31]-[32].

Justification

The Court had no difficulty in finding that the criminal records regime pursued a legitimate aim, generally of protecting employers and children or vulnerable adults in their care, and particularly of enabling employers to make an assessment as to whether an individual is suitable for a particular kind of work. However, the Court held that that the disclosure of all convictions and cautions relating to recordable offences was disproportionate to that aim: at [37].

The fact that a bright-line rule had been adopted did not save the regime, where there was no attempt to control disclosure by reference to the information’s relevance to the legitimate aim. Nor did the Court accept an argument based upon resource implications. It was not necessary to consider every case individually; bright-line sub-rules could be used. The Court was particularly struck by a Criminal Records Review carried out an Independent Advisor to the Government, which had recommended the introduction of a filter to remove minor and old convictions where appropriate, which the Government had not rejected. The Independent Advisory Panel for the Disclosure of Criminal Records, set up following the Review, has been considering the issue. In short, the Court considered that there was a range of possible filter mechanisms which could have been adopted and which were, at the least, less disproportionate than the blanket requirement imposed by s.113B of the 1997 Act.

The Court drew further support from the recent decision of the Strasbourg Court in MM v UK (App. No. 24029/07) (on which see Charles Bourne’s post here), although it accepted that the judgment did not go to proportionality in terms but was a finding that the interference was not in accordance with the law. However, the Strasbourg Court had identified the blanket nature of the Northern Irish system in issue as a shortcoming and had directly relied upon the Supreme Court’s decision in R (F) v Secretary of State for Justice [2010] UKSC 17, [2011] 1 AC 331 (blanket notification requirements imposed on sex offenders without possibility of review incompatible with Article 8, a judgment which the Prime Minister described as “appalling“): at [53].

Contrary to the position taken by Kenneth Parker J, the Court of Appeal refused to consider themselves bound to find the regime compatible with Article 8 following the Supreme Court’s judgment in R (L) v Commissioner of Police for the Metropolis [2009] UKSC 3, [2010] 1 AC 410 because it had been concerned with the discretionary disclosure of police information rather than the mandatory disclosure convictions and cautions, and any assumptions made by the Supreme Court as to the compatibility of the disclosure regime had not been part of the ratio of the decision: at [62].

The 1975 Order

Kenneth Parker J had also accepted an argument from the Secretary of State that the 1975 Order could not be impugned on Article 8 grounds because to do so would presuppose that the State had a positive obligation to intervene in private employment relationships to permit individuals to conceal information about their criminal records. The Court of Appeal declined to engage in distinguishing between positive and negative obligations where the State had already “altered the legal landscape” by enacting the 1974 Act and 1975 Order. The real question was one of fair balance, which had not been struck and it would be absurd if the ECRC regime in the 1997 Act was incompatible with Article 8 so that the State could not disclose the record but that the individual, under the 1975 Order, must do so or face civil liability: at [68].

Relief

In the case of both T and JB the Court of Appeal declared the regime implemented by the 1997 Act incompatible with Article 8 ECHR, and in the case of T, that articles 3 and 4 of the 1975 Order were ultra vires because they had been made incompatibly with Article 8. However, in the case of AW permission to appeal was refused because the disclosure of convictions for manslaughter and robbery because such offences could never be spent fell within the area of discretionary judgment open to Parliament.

The Court held that it was necessary for Parliament to decide what filtering mechanism would most effectively balance the Article 8 rights of the individual with the interests of employers and vulnerable individuals. There were a number of potential approaches, and the Court declined to proscribe or provide guidance: at [69], [75]. Although it rejected a request by the Secretaries of State to narrowly limit the declarations it in respect of the 1975 Order, the Court stayed the effect of their judgment pending any application by the Secretaries of State for permission to appeal to the Supreme Court. The Court refused permission itself, and the Government has indicated that it will seek to appeal.

The judgment raises difficult questions for Parliament as to how to proceed, as well – prior to the legislation being amended – as for employers and others who wish to rely upon spent convictions or cautions as a ground for excluding employment etc. in the circumstances spelled out in the 1975 Order (such as, notably, employment involving responsibility for children and vulnerable adults).

Jason Coppel appeared for the Secretaries of State for the Home Department and Justice; Timothy Pitt-Payne QC appeared for Liberty as an intervener.

Christopher Knight

Camden squatters case – back in the first-tier tribunal

Posted on | by Anya Proops KC

Last year I blogged about a decision of the Upper Tribunal in the vacant properties case, Voyias v IC & Camden LBC, where the Upper Tribunal overturned the decision of the First Tier Tribunal (FTT) in favour of Mr Voyias and remitted the case to a differently constituted FTT (see my post here). The FTT’s decision on the remitted case has just been handed down – see the decision here. The issue which the FTT had to decide upon remission was whether was whether the Camden LBC (the Council) had correctly concluded that it was entitled to refuse to disclose to Mr Voyias information identifying vacant properties in its area on the ground that the requested information was exempt from disclosure under s. 31(1)((a) FOIA (the prevention and detection of crime exemption). The particular issues the FTT had to decide were: (a) whether the requested information engaged the exemption provided for under s. 31(1)(a) and (b) whether the public interest balance weighed in favour of the exemption being maintained. In a decision which was very robustly in favour of the Council, the FTT held that the requested information had been lawfully withheld. This decision is in stark contrast with the decision reached by the original FTT which upheld Mr Voyias’ appeal in respect of the Council’s refusal.

In deciding that the requested information was lawfully withheld, the FTT was plainly mindful of the guidance given by the Upper Tribunal that, when determining whether the public interest balance weighed in favour of maintaining the s. 31(1)(a) exemption, regard should be had, not merely to the direct adverse consequences of the disclosure but also to any indirect consequences which arose as ‘realistic possibilities’. Ultimately, the FTT concluded that ‘the small weight that the public interest in disclosure bears does not come close to equalling the public interest in preventing the categories of crime we have identified in this decision’ (§55). Thus, a very strong decision in favour of the Council. No doubt the former Housing Minister, Grant Schapps MP, who scathingly described the original FTT decision as a ‘squatters’ charter’, will be substantially relieved by the new decision.

11KBW’s Ben Hooper was for the Council and Chris Knight was for the Commissioner.

Anya Proops

Central London NHS Trust: key points from the Tribunal’s first MPN case

Posted on | by Robin Hopkins

I reported earlier this week on the outcome of the first case of this type to reach the Tribunal. Here is my analysis of the key points.

Factual background

Central London Community Healthcare NHS Trust v IC (EA/2012/00111) concerned the first monetary penalty notice (MPN) to be appealed to the First-Tier Tribunal. The Trust’s appeal has been dismissed by the Tribunal (Professor Angel, Rosalind Tatam and Paul Taylor). The decision can be accessed here: Central London NHS Trust v IC EA20120111.

The background is that the Trust had, on some 45 occasions, faxed a list of palliative care in-patients to the wrong fax number (namely to that of a member of the public who notified the Trust and said he had destroyed the faxes – but he was never traced and destruction could not be confirmed). This was sensitive personal data: it included names as well as information about patients’ medical diagnoses, treatment and domestic situations.

The MPN

The IC found that the Trust had breached the seventh data protection principle, which requires that:

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

The IC decided that the three preconditions for the exercise of his discretion to issue a MPN under section 55A of the Data Protection Act 1998 had been met here. These conditions are (i) there was a serious contravention of the DPA, (ii) this contravention was of a kind likely to cause substantial damage or substantial distress, and (iii) the contravention was either deliberate, or the data controller knew or ought to have known that there was a serious risk that a contravention would occur and would be of a kind likely to cause substantial damage or distress, but failed to take reasonable steps to prevent it happening.

The IC is empowered to impose MPNs of up to £500,000. In this case, the amount was £90,000.

The Tribunal’s jurisdiction

On the Trust’s appeal, one of the first issues for the Tribunal was the extent of its statutory powers under section 49 of the DPA (which mirrors section 58 of FOIA): the Tribunal agreed with the Trust that, as with appeals under FOIA, the Tribunal had jurisdiction to consider the matter de novo; it was not restricted to a review along public law lines. It also found that it could either allow the appeal, or substitute an alternative MPN (including one imposing a higher penalty than that imposed by the IC), or substitute an enforcement notice instead (paragraphs 36-39).

Alleged indication that no MPN would be issued

The only point of evidence in dispute was the Trust’s contention that the IC’s enforcement team had indicated during the investigation that no MPN would be issued. The Tribunal found that the Commissioner’s enforcement officer “did not give any serious indication or assurance that there would be no fine or MPN in this case which in any way excluded the IC from deciding to issue an MPN” (paragraph 46).

The IC’s decision-making process

The decision to impose a penalty is taken by a Deputy Commissioner, in consultation with an internal working party comprising various senior managers within the ICO and one of the ICO’s enforcement lawyers. Having decided that an MPN should be issued, the ICO determined the amount by reference to an internal, unpublished framework as follows:

(i) Serious = £40,000 to £100,000

(ii) Very serious = more than £100,000 but less than £250,000

(iii) Most serious = more than £250,000 up to the maximum of £500,000.

It decided that this case was in the “serious” category. Its methodology was then to take the midpoint of that band and consider any aggravating or mitigating circumstances.

As required by the DPA, the ICO then issued the Trust with a Notice of Intent to issue a MPN to the value of £90,000. The Trust accepted that a financial penalty was warranted, but disputed the amount, making submissions on mitigating factors. The ICO maintained its position and issued the MPN.

‘Assessments’ and the statutory bar under section 55(3A)

By section 55(3A) of the DPA, the IC may not use anything which came to his attention pursuant to his carrying out an ‘assessment’ under section 51(7) when deciding on whether an MPN can be imposed. The Trust argued that the IC’s investigation of its voluntarily-reported breach constituted an ‘assessment’.

The Tribunal considered the rival submissions on the legislative intent behind the bar imposed by section 55(3A) (though on this point it rejected the Trust’s invitation to take ministerial statements into account, on Pepper v Hart principles) and on the range of powers open to the IC. It preferred those of the IC: section 51(7) is directed at educating and advising data controllers, on the basis of a consensual engagement, with a view to avoiding future breaches of the DPA. The aim of the statutory bar provided for under section 55A(3A) is to prevent the IC from using information he obtains via the educational/advisory process provided for under section 51(7) to impose an MPN on a data controller. This case did not involve such an educational/advisory process. There was no assessment under section 51(7) (paragraphs 87-91).

The IC’s adherence to its own policy

The Trust did not contend that the IC failed to apply the statutory guidance on MPNs. It did, however, argue that it failed to consider or adhere to its own non-statutory policy on the reporting of breaches, which said that “the Commissioner will not normally take regulatory action unless a data controller declines to take any recommended action, he has other reasons to doubt future compliance or there is a need to provide reassurance to the public”.

Again, the Tribunal found for the IC: the statutory guidance was what really mattered, but in any event the IC had not departed from its own policies (paragraphs 102-103).

The IC’s exercising of its discretion

Where the conditions for the issuing of an MPN are met, the ICO still has a discretion as to whether or not to issue one. The Trust argued that the ICO had failed to exercise its discretion lawfully: there was no evidence of it taking into account relevant considerations.

The particular considerations relied upon by the Trust were (i) the ICO failed to take proper account of the overriding policy objective to encourage cooperative working between it and data controllers and failed to give sufficient credit for the Trust’s transparency and its co-operative stance, (ii) the effect of the ICO’s policy to impose high profile fines on data controllers who voluntarily report incidents and cooperate with its investigations is to discourage other controllers from being open and transparent, and (iii) the ICO’s approach to cases of this nature creates an unfair and unsustainable distinction between those data controllers who, when suspected of being in breach of the DPA, are required to submit to assessment notices or are requested to undergo consensual audits and those, like the Trust in this case, who voluntarily submit themselves to regulatory scrutiny. The Trust argued that the ICO had failed to think about these points.

The Tribunal rejected these criticisms as misconceived (paragraph 122). While the ICO’s process could have been more comprehensible, it could not be said to have overlooked relevant matters.

Consideration of mitigating factors

Next, the Trust contended that the ICO had failed properly to consider the mitigating factors on which it made submissions. Again, the Tribunal disagreed. The ICO had not erred in this way. In any event, the Tribunal did not seem to find the mitigating factors to be particularly forceful. It said:

“The fact that there was a voluntary notification cannot be given much weight when the Trust was under, in effect, an obligation to report (both to the ICO and to the NHS regionally). In any case it was reported over a month after the breach was discovered. Co-operation was the least that could be expected for such a serious breach. By the time the Trust informed the patients over three quarters were dead. There is still no absolute guarantee the sensitive information has been destroyed. The Trust’s mitigating features are therefore features to which we find the IC could not give much weight. In any case they are almost all post facto events and nothing about the wrongdoing” (paragraph 128).

The Trust’s criticisms of the IC’s decision on the amount of the MPN

The Trust said that the IC never explained its methodology for calculating the amount of the MPN – the three categories of seriousness, for example, were never mentioned, nor was the means of calculation. Once again, the Tribunal did not agree. It considered that the IC had made the principles behind its approach clear to the Trust prior to issuing the MPN.

Notable the Tribunal observed that “We find it interesting that the contravention is only categorised as “serious” and not “very serious” as it seems to us on the facts of this case the IC could have taken a more penal approach to the amount in question” (paragraph 138) and concluded that “We are satisfied that the ICO has reached a figure within a range of reasonable figures it could have considered” (paragraph 139). It also rejected the submission that the IC failed to take the mitigating factors into account when deciding on the amount of the MPN (paragraph 148).

Discount for early payment

The final issue considered by the Tribunal is of significant importance. MPNs provide for a discount (here: 20%) for early payment. If a data controller appeals an MPN and loses, can it still claim the discount? The Trust argued that, by refusing to keep the discount offer open pending the outcome of the appeal, the IC was penalising it for exercising its legal right to have its cased tested by a Tribunal. The Tribunal disagreed: “The purpose of the scheme would appear to us to encourage early payment and also to ensure there is an early resolution to the matter. There is no provision for a without prejudice payment” (paragraph 153). The IC did not err in refusing to keep the discount offer alive, and the Tribunal refused to restore that offer.

Data controllers who contravene the DPA in a serious or potentially serious way should take note of this last point, and indeed of the Tribunal’s first excursion into the new MPN appeal territory.

First-Tier Tribunal decisions are of course not binding on other First-Tier Tribunals. There will be more appeals against MPNs later this year. Panopticon will report on whether the principles from the Central London NHS Trust case are borne out by future decisions. For now, this decision is the best data controllers have to go on.

Tim Pitt-Payne QC appeared for the Trust. Anya Proops appeared for the IC.

Robin Hopkins

Tribunal dismisses first appeal against Monetary Penalty Notice

Posted on | by Robin Hopkins

One of the most notable features of the information rights landscape in 2012 was the issuing by the Information Commissioner of a number of Monetary Penalty Notices for breaches of (primarily, but not exclusively) the Data Protection Act 1998.

The First-Tier Tribunal has today given its decision in the first appeal against such a notice. Central London Community Healthcare NHS Trust v IC (EA/2012/00111) saw the Trust appeal against a £90,000 MPN for the Trust’s repeated faxing of sensitive patient data to the wrong fax number (see Panopticon’s earlier reports here and here).

A summary of the key points from this landmark decision will follow as soon as possible. For now, Panopticon can confirm that the Trust’s appeal has been dismissed.

Robin Hopkins