WordPress + Bootstrap

The High Court has recently handed down a judgment in a really interesting case concerning the legality of disclosures of census data by the UK Statistics Board. Every decade since 1801, householders in England and Wales have been required to complete a national census form. Failure to complete the form amounts to a criminal offence. The most recent census was conducted by the newly established UK Statistics Board (“the Board”) in 2011. The Board was established by the Statistics and Registration Act 2007 (“SRA”). Under s. 39(1) SRA, the Board’s employees are subject to a general duty not to disclose personal data acquired pursuant to the census. However, s. 39(4) creates a number of specific exemptions in respect of that general duty. Not least, under s. 39(4)(f), the Board has a specific power to disclose census data amounting to personal data (including sensitive personal data) where the disclosure is made ‘for the purposes of a criminal investigation or criminal proceedings (whether or not in the United Kingdom)’.

In R (Ali & SJ) v Minister for the Cabinet Office & Statistics Board (2012) [2012] EWHC 1943 (Admin), the claimants challenged the legality of s. 39(4)(f) on the basis that it infringed the right to privacy under Article 8(2) and, further, was incompatible with the requirements of the Data Protection Act 1998, as enacted under Directive 95/46. The nub of the claimants’ concern was that the power afforded under s. 39(4)(f) allowed for relatively indiscriminate disclosures of personal data, including sensitive personal data, to foreign authorities.

The claimants challenged in particular the following features of the regime embodied in s. 39(4)(f):

(1) s. 39(4)(f) did not impose any disclosure criteria which meant that disclosures could be effected under s. 39(4)(f) irrespective of the circumstances of the particular case, including the seriousness of the alleged offence;

(2) there was no requirement on the part of the Board to notify data subjects of any proposed disclosure under s. 39(4)(f) with the result that they had no opportunity to object to the disclosure and

(3) s. 39(4)(f) did not operate so as to require the imposition of restrictions on the use of the disclosed personal data by any recipient third party authorities.

The Board’s position was that there was no illegality in the regime afforded under s. 39(4)(f). This was particularly because, as a public authority, the Board was in any event required under s. 6 of the Human Rights Act 1998 to act compatibly with Article 8 as and when it was deciding whether or not to disclose the requested data. The Board also relied on the policy which it applied to the exercise of the power afforded under s. 39(4)(f). Under the policy, the Board will not disclose data voluntarily, will refuse requests if it considers that is the lawful result and will contest any legal challenge to its decisions. In effect, the Board argued that the safeguards necessary to protect the rights of data subjects were imported into the s. 39(4)(f) disclosure regime by both the HRA 1998 and the Board’s policy on the application of s. 39(4)(f).

The Court preferred the Board’s case and accordingly the claims were dismissed. In reaching the conclusion that the Board’s policy offered sufficient safeguards to protect the rights of data subjects, the Court took into account not least that the Board had, to date, applied its policy so as to refuse every request made by police forces or defendants in criminal proceedings and, indeed, had only disclosed data under s. 39(4)(f) in response to court orders. In common with many judgments in this area, the Court was of the view that the s. 39(4)(f) regime was lawful irrespective of whether it was considered through the prism of Article 8 or through the prism of the DPA. In effect, the two legal regimes, perfectly dovetailed with one another. The judgment offers a very clear analysis of the principles applicable under Article 8 and the DPA in respect of the proposed disclosure of personal data. Its analysis of the issues of notification of the data subject and the use of court orders requiring disclosure is particularly worthy of note (see further para. 73 et seq).

Anya Proops

Information lawyers are regularly asked to advise on the question of whether the sharing of information about an individual with that individual’s employer is lawful in all the circumstances. Another issue which commonly arises for information lawyers is whether the employer’s use of that information is itself lawful. Typically, answering this latter question requires an understanding of how information law and employment law intersect. The judgment handed down by the Court of Appeal last week in the case of Leach v Office of Communications [2012] EWCA Civ 959 perfectly illustrates this point.

In Leach, the met police disclosed to Mr Leach’s employer, Ofcom, information relating to certain child abuse offences he had allegedly committed in Cambodia and which led to his arrest in that country. The information initially provided by the police suggested that Mr Leach posed a continuing risk to children and that there was a resulting risk of negative media exposure for Ofcom. Thereafter, the met police agreed to make formal ‘limited disclosure’ to Ofcom pursuant to the Multi-Agency Public Protection Arrangements created under the Criminal Justice and Courts Services Act 2000. The information provided by the police was described as ‘the tip of the iceberg’. Thereafter, Mr Leach was summarily dismissed by Ofcom on the ground that, in view of the information received from the police, his continued employment with Ofcom represented an unacceptable reputational risk for the organisation. Mr Leach complained that his dismissal was both wrongful and unfair under s. 98 of the Employment Rights Act 1996. The nub of his complaint was that it was wrongful and otherwise unfair for Ofcom to have relied on the information provided by the police as a basis for dismissing him, particularly as Ofcom had not conducted its own independent investigation of the child abuse allegations.

The Court of Appeal held that Mr Leach’s summary dismissal had not been unfair or wrongful. In reaching this conclusion, the Court took into account that the information disclosed to Ofcom had been disclosed under an official disclosure regime and that, subject to certain safeguards, an employer must be entitled to treat that information as reliable. The Court also held that Mr Leach’s dismissal did not breach his fair trial rights under Article 6 ECHR and did not otherwise amount to an unlawful interference with his right to privacy. Mummery LJ gave the leading judgment. The following extracts from his the judgment are particularly noteworthy:

‘… this case shows the need for an employer, to whom a third party discloses information or makes allegations, to assess for itself, as far as practicable, the reliability of what it has been told. The employer should check the integrity of the informant body and the safeguards within its internal processes concerning the accuracy of the information supplied. The employer should consider the likely effect of disclosure and whether there was cogent evidence of a pressing need for disclosure to the employer’ (§6)

 

‘ … The Respondent did not react in knee jerk fashion to the limited and confidential disclosure of a police assessment that the Claimant posed a continuing risk or threat to children. The  Respondent sought clarification, confirmation and some further disclosure before holding an internal disciplinary hearing during which the Claimant was able to put his case and at the end of which the Respondent notified the Claimant of his summary dismissal’ (§10)

Anya Proops

In September last year, Robin Hopkins blogged about an important FTT decision on the application of the prevention of crime exemption (s. 31 FOIA) to information amounting to a list of vacant properties held by Camden London Borough Council: Voyias v IC & Camden LBC (EA/2011/0007) (see his post here). In summary, the FTT held that s. 31 was engaged in respect of the list because there was a real and significant risk that disclosure of the addresses contained in the list would be exploited both by organised squatters who may commit crimes when entering the void properties and by professional criminals looking to strip the properties for commercial gain. However, the FTT nonetheless went on to conclude that the public interest balance lay in favour of disclosure. This was particularly because disclosure of the addresses would: lend colour to the important empty homes debate; would increase local involvement and would otherwise incentivise owners to put their properties back into use, which was a priority for Government and Camden. The FTT’s decision was highly controversial and was roundly criticised by the Housing Minister Graham Schapps who issued a statement asserting that this was a ‘bizarre decision that flies in the face of common sense’ and that ‘rather than trying to prevent the anti-social and unfair practice of squatting, this judge is instead insisting that Camden Council publish a ‘squatter’s road map’ – which in other areas has led to the numbers of squats doubling’.

Camden appealed the FTT’s decision to the Upper Tribunal (UT). The appeal was allowed. Judge Jacobs, who heard the appeal in the UT, held that the FTT had erred in its approach to the case particularly because it had adopted an unduly limitative approach when considering the ramifications of the criminality which it had found would be likely to occur in response to the disclosure. In particular, he held that the FTT had erred in this respect because, when applying the public interest test, it had failed to take into account all of the direct and indirect consequences of the criminality which would result from the disclosure; including not least the financial costs to both the private and public purses attendant on remedying resulting criminal damage and, further, the social costs associated with the kind of criminality in issue (see §10). He went on to order that the case should be remitted to a differently constituted FTT so that it could consider the application of the public interest test afresh.

Additional points emerging from the judgment which are worthy of note include the following:

• The UT rejected the argument that, when applying the public interest test, consideration should be given to the effects of disclosure which were ‘objectively foreseeable’ or ‘reasonably foreseeable’. Instead, the issue was simply whether the consequences of disclosure could ‘reasonably be anticipated as realistic possibilities’ (§11). With respect, it is unclear how this test materially differs from the ‘reasonably foreseeable’ test.
• The UT was of the view that, at the remitted hearing, the FTT should consider whether disclosure of the list would actually change the behaviour of criminals so as to make it even more likely that criminality would occur as a result of the disclosure (§§13-14).
• The UT noted that the FTT had, in the course of its judgment, relied on the earlier FTT decision in Cabinet Office v IC & Lamb (EA/2008/0024), in which the FTT had found that the fact that there were other accountability mechanisms available beyond the mechanism provided for under FOIA did not materially diminish the public interests in disclosure. The UT went on to find that the FTT in Voyias had erred in relying on the Lamb decision, particularly because that decision was not intended to express any kind of general rule but was instead confined to the particular facts of the case. (§§15-19).
• So far as the role played by earlier FTT decisions is concerned, the UT confirmed more generally that: the FTT is not bound by its earlier decisions; such decisions merely have ‘persuasive authority’ and, further, FTTs which rely too heavily on earlier decisions at the expense of a focus on the facts of the particular case before them risk falling into error (§20).
• The UT also criticised the FTT for seeking to use the ‘slip rule’ provided for under r. 40 of the FTT Rules as a vehicle for changing the substance of its decision. In essence, the UT held that r. 40 could not be relied upon so as to enable the FTT to express a changed view which was in substance different to the view which the FTT had originally formed of the case when it drafted its decision (§§21-25).

11KBW’s Ben Hooper and Chris Knight both appeared in the appeal to the Upper Tribunal.

Anya Proops

It seems to be a busy month in terms of information law cases involving the police. Earlier this month, Robin Hopkins blogged about the recent Catt case where the Administrative Court held that the retention of data about a protestor did not breach the protestor’s Article 8 right to privacy (see his post here). I then blogged on a recent Tribunal case where the Tribunal found that the Devon & Cornwall Constabulary had not breached its obligations under FOIA when it refused to disclose the location of its automatic number-plate recognition cameras (see my post on the Mathieson case here). Then on 22 June 2012, a further judgment was handed down by the Administrative Court in which the court considered the impact on Article 8 on the retention of photographic information retained by the Met Police: R (RMC & FJ) v Commissioner Of Police Of The Metropolis & Ors [2012] EWHC 1681 (Admin).

The judgment addressed two cases. In the RMC case, R had been arrested on suspicion of causing ABH to a police community support officer who had stopped her riding her bicycle on the footpath. In the FJ case,  F was arrested at the age of 12 on the suspected rape of his second cousin. Both R and F were fingerprinted and photographed by the police and DNA samples were taken. Neither R nor F were prosecuted. The police considered the requests under the ACPO Exceptional Case Procedure in the Retention Guidelines and decided that the fingerprints and photographs should be retained. The Commissioner’s case before the court was that police policy was to apply the Guidance on the Management of Police Information (MoPI), following the MoPI Code of Practice. R and F obtained permission to apply for judicial review in relation to the retention of the custody photographs. F also obtained permission in respect of certain of his data stored on the police national computer (PNC).

The court held that the retention of the custody photographs amounted to an unlawful interference with R’s and F’s Article 8 rights. Importantly, the court held that the individual’s reasonable expectations were not the only considerations when it came to whether there had been an interference with their Article 8 rights. Following S v United Kingdom, the mere retention of photographic data by the police, irrespective of the individual’s reasonable expectations was sufficient to amount to an interference with Article 8 rights (R (Wood) v Commissioner of Police of the Metropolis [2009] EWCA Civ 414 considered). However, the court went on to find that in any event the retention of the photographs relating to R and F interfered with their right to privacy under Article 8 in view of their reasonable expectations that the photographs would not be retained.

The court went on to find that that the Commissioner’s policy on retention of the custody photographs amounted to an unlawful interference with R’s and F’s Article 8 rights. This was because it failed to strike a fair balance between the competing public and private interests and did not in all the circumstances meet the requirements of proportionality imposed under Article 8(2). In reaching this conclusion, the court took into account in particular that the policy did not draw an adequate distinction between the convicted and those who were either not charged or were charged but acquitted and, further, that photographs were retained for a minimum of six years and in practice were likely to be retained for a much longer and indeed potentially indefinite period. In respect of F, the court also noted that the policy failed to take into account that F was a minor at the time of arrest. The court went on to order that the Commissioner should have a further reasonable period within which to revise the policy so as to render it compliant with Article 8.

Notably, the court reached rather different conclusions on the question of whether the information stored on the PNC with respect to F breached his Article 8 rights. In particular, it held that, whilst the retention of the rape allegation on F’s PNC records engaged Article 8 rights, the inference with those rights was plainly proportionate and justified in all the circumstances. This was particularly because a PNC record which did not include the basic history of F’s involvement with the police, including the rape allegation, would be an incomplete and potentially misleading record.

Anya Proops

I posted recently about an important recent case on the subject of accessing personal data about facebook users (see my post on the Nicola Brookes case here). In my post, I said that it was understood that this may have been the first case in which an individual has been able to secure a court order requiring facebook to disclose personal data about its users. The wonders of the internet are such that I received today an email from the Cayman Islands’ Deputy Information Commissioner, Jan Liebaers, alerting me to the fact that there had in fact been an earlier judgment of the High Court making a similar order: Applause Store Productions Ltd and another v Raphael [2008] EWHC 1781 (QB). The Applause Store case was actually a libel case. The background to the case was that a fake facebook page had been set up which contained material which was defamatory of one of the claimants (MH). An issue arose in the case as to who had been responsible for setting up the fake page. It would appear from paragraph 10 of the judgment that the claimants’ solicitors, Olswang, obtained a Norwich Pharmacal order against Facebook Inc for disclosure of the registration data provided by the user responsible for creating the false material, including e-mail addresses, and the IP addresses of all computers used to access Facebook by the owner of those email addresses. Facebook Inc went on to provide Olswang with evidence, which was not contested at the hearing, showing that the profile was created on a computer using an IP address which was accepted to have been the Defendant’s and that the relevant group page was created on a computer using that same IP address on the afternoon of 20^th June 2007. The remainder of the judgment concerned the question of whether the court should find that the Defendant was the individual who set up the fake facebook page and, hence, that he was responsible for defaming MH. On this issue, the judge held that the Defendant’s case was utterly implausible and that he was liable in respect of the defamation. My thanks to Jan Liebaers for the alert about this important case. Taken together the Brookes case and the Applause Store case reveal a clear appetite on the part of the judiciary to issue orders requiring facebook to provide evidence where this is necessary in order to further the interests of justice.

Anya Proops