Refusing to respond to subject access requests – legal professional privilege, disproportionate effort and collateral purposes

Posted on | by Holly Stout

The Information Commissioner’s Code of Practice on Data Protection steadfastly maintains that data controllers cannot refuse to respond to a subject access request unless one of the specific exceptions in the Data Protection Act 1998 (“DPA”) applies.  However, there is a growing body of case law on the circumstances in which the courts will refuse to enforce compliance with subject access requests under s 7(9) of the Act, even where one of the specific exceptions under the Act does not apply.  See previous Panopticon posts on this subject here and here.

In a judgment handed down on 6 August 2015, HHJ Behrens (sitting as Judge of the High Court) considered a refusal by Taylor Wessing LLP (“TW”) and two individual defendants to respond to a subject access request made by a family involved in legal proceedings in the Bahamas concerning a discretionary settlement known as the Glenfinnan Settlement.  TW’s client (Grampian) is the sole trustee of that Settlement.

TW resisted the family’s application for an order under s 7(9) requiring compliance with the subject access request on the following bases:

  1. The data in question was covered by legal professional privilege as it is only processed by TW in connection with their capacity as legal advisors;
  2. Some of the information was held in manual files and not in a relevant filing system for the purposes of the DPA;
  3. It was not reasonable or proportionate to expect TW even to carry out a search for the information and to assess what was covered by privilege and what was not;
  4. As a matter of discretion the Court should refuse to make an order under s 7(9) because the application had been made for improper purposes.

The Court’s ruling on each of these issues is worthy of note.  The full judgment is available here.

Legal professional privilege 

Paragraph 10 of Schedule 7 to the DPA provides a specific exception for “information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality as between client and professional legal adviser, could be maintained in legal proceedings”.  The family argued that this exception was restricted to English law professional privilege and did not extend to documents that were covered by Bahamian rules on disclosure or which were subject to equitable rules in English trust law about non-disclosure of information to Trust beneficiaries.  HHJ Behrens did not accept these submissions.  He considered, following Durant v FSA [2003] EWCA 1746 that a purposive approach is to be taken to interpretation of the DPA and that the exception in para 10 of Sch 7 was not to be strictly construed.  Adopting a purposive approach, he held that the exception was to be construed as if it applied to any documents in respect of which there is a right to resist compulsory disclosure in legal proceedings.  Accordingly, it covered all the documents in respect of which the parties would be entitled to resist compulsory disclosure in the Bahamian proceedings, even though these were not covered by the English doctrine of legal professional privilege.  This is a novel interpretation that may receive further attention from the courts in due course.

Relevant filing system 

HHJ Behrens referred to the observations of Auld LJ in Durant in relation to the meaning of ‘relevant filing system’ for the purposes of the DPA.  Auld LJ held (at [48] of Durant) that “Parliament intended to apply the Act to manual records only if they are of sufficient sophistication to provide the same or similar ready accessibility as a computerised filing system.  That requires a filing system so referenced or indexed that it enables the data controller’s employee responsible to identify at the outset of his search with reasonable certainty and speed the file or files in which the specific data relating to the person requesting the information is located and to locate the relevant information about him within the file or files, without having to make a manual search of them. To leave it to the searcher to leaf through files, possibly at great length and costs, and fruitlessly, to see whether it or they contain information relating to the person requesting information and whether that information is data within the Act bears … no resemblance to a computerised search”.  Although HHJ Behrens did not ultimately determine whether TW’s filing system satisfied the definition of ‘relevant filing system’ he indicated that as it appeared that documents within the manual files were not chronologically arranged or filed in any way by reference to individuals, they may well fall outside the scope of the Act.

Disproportionate effort 

Section 8(2) of the DPA provides that a data controller need not supply copies of information “in permanent form” if that would require “disproportionate effort”.  The Information Commissioner in his Code of Practice is keen to minimise reliance on this exception stating, “You cannot refuse to comply with a SAR on the basis that it would involve disproportionate effort, simply because it would be costly and time consuming to find the requested personal data held in archived emails.”  And: “We stress that you should rely on the disproportionate effort exception only in the most exceptional of cases. The right of subject access is central to data protection law and we rarely hear of instances where an organisation could legitimately use disproportionate effort as a reason for denying an individual access to any of their personal data. Even if you can show that supplying a copy of information in permanent form would involve disproportionate effort, you must still comply with the request in some other way.”  However, in this case HHJ Behrens referred to his own earlier judgment in Elliott v Lloyds TSB Bank and Hickinbottom J’s decision in Ezsias v Welsh Ministers before summarising the position in relation to s 8(2) as follows: “A data controller is only required under s 8(2) to supply the individual with such personal data as is found after a reasonable and proportionate search”.  This is arguably a significantly more relaxed approach than that taken by the Information Commissioner.  It remains to be seen whether the Information Commissioner will amend his guidance in the light of this string of decisions.

In this case, HHJ Behrens went on to hold that it would not have been reasonable and proportionate for TW to carry out the search in this case.  In reaching this conclusion, HHJ Behrens interestingly appears to have been influenced by the disproportionality of requiring ‘skilled lawyers’ to review documents for LPP when the applicant need only pay £10 for a subject access request.

Improper purposes 

Section 7(9) of the DPA undoubtedly gives the court a discretion as to whether to order a data controller to comply with a subject access request.  In a number of cases now the courts have ruled that this discretion enables the court to refuse to make such an order even if none of the exceptions under the DPA apply and therefore the data controller is breaching the Act by refusing to respond: see the previous Panopticon posts mentioned in the first paragraph of this blog.  This case is another such.  Although not necessary to his decision, as TW had already ‘won’ on the LPP and disproportionate effort points above, HHJ Behrens gave three reasons why he would not in any event have exercised his discretion under s 7(9) in this case:

  1. The real purpose of the subject access requests was to obtain information for used in connection with the Bahamian proceedings.  HHJ Behrens was satisfied that the claimants would not have brought the applications at all were it not for the Bahamian proceedings.  This was, following Durant, not a proper purpose for a request under the DPA;
  2. It would be unreasonable and disproportionate to order TW to comply with the request: the same points as were relevant to the s 8(2) exception were relevant to the s 7(9) discretion; and
  3. It was not a proper use of the DPA to enable the claimants to obtain documents that they could not have obtained in the Bahamian proceedings.

HHJ Behrens recognised that a number of points in his judgment were novel and indicated that he was therefore minded to grant permission to appeal, if permission were sought.  Permission was sought and duly granted so expect to hear further from the Court of Appeal on these issues in due course.

Jonathan Swift QC appeared for the claimants.

Holly Stout

The Right to be Forgotten and the County Court

Posted on | by Christopher Knight

The right to be forgotten is beginning to generate some litigation, albeit not yet with any blaze of glory. Following on from the attempt to judicially review the ICO for refusing to try and enforce an individual’s complaint that his data rights were being breached (see here), earlier this week a claimant failed to get his right to be forgotten claim to fly before the Nottingham County Court.

The background is that the claimant, Mr Edwards, was convicted in 2007 in connection with his criminal participation in a vast carousel VAT fraud. He was sentenced to six and a half years in prison for the fraud. He was also given a three and a half year sentence for stealing £18,000 from personal injury claimants through a scheme under which he deceitfully pretended to be a solicitor. Additionally, he was subject to a 12 year ban from taking up any company office. Mr Edwards continues to serve his sentence, although he is now out on licence. The length of Mr Edwards’ sentence means that there is no question of Mr Edwards being rehabilitated on an application of the Rehabilitation of Offenders Act. The fact of his conviction, and the circumstances of it, were widely reported by the media. The BBC, the Guardian and the Daily Mail, amongst others, all published stories about these events on their respective websites. Mr Edwards was unhappy about the fact that the stories continued to be available to the public at large, as hosted by the websites of these media organisations. As far as he was concerned, his offences were historic, dating back over a decade. So he brought a right to be forgotten claim against various media organisations, including the BBC, the Guardian and Associated News, relying heavily on the CJEU’s judgment in Google Spain: Edwards v Nottingham Post Media Ltd & Others.

However, after evidence was served by the Defendants in response to the claim, Mr Edwards confirmed that he wished to discontinue his DPA claim against the Defendants. You might have thought that that was the end of the matter but, rather than abandoning his claim altogether, Mr Edwards decided instead to apply to the court to substitute the BBC et al with Google Inc as the defendant. In effect, Mr Edwards wanted to convert his claim from a claim that the data should be deleted at source to a claim that the data should be de-indexed by the intermediary which effectively brought that data to a wide online audience, namely Google.

At a hearing which took place in Nottingham County Court on 29 July, HHJ Godsmark QC refused Mr Edwards’ application to substitute the defendants with Google Inc. He concluded that substitution should not be ordered because the claim against Google had no reasonable prospect of success, with the result that the court would not grant permission for service out of the jurisdiction on Google Inc.

The judge agreed with the submissions on behalf of the media organisations that the claim was hopeless, particularly in the light of the serious nature of Mr Edwards’ offences and the fact that he is continuing to serve his sentence and remains banned from running a company until 2019. The judge held that, in these circumstances, Mr Edwards could have no reasonable expectation of privacy in respect of the data in question and there was no reasonable prospect of him succeeding in his case that his Article 8 right to privacy outweighed the Article 10 justification for the continued publication of the stories. The public interest, the judge concluded, strongly favoured continued publication and indexing by Google.

In response to a query from Mr Edwards about when that balance might alter, the judge is reported to have commented that he could not imagine a court entertaining such an application during the period of the sentence, the license or indeed for a considerable time thereafter.

The claim was marked as ‘totally without merit’. The media organisations were awarded 100% of their costs.

Mr Edwards’ case was not, perhaps, the most promising context in which to rely on Google Spain. However, it is interesting to see that the right to be forgotten is penetrating the litigation consciousness (especially in chokey, where a lengthy CJEU judgment helps while away the time) and harder cases are doubtless around the corner. The balance between the right to a private life, historic information and free expression will not always be so straightforward to weigh.

Anya Proops appeared for the media organisations, defending the claim. For the BBC’s story see here.

Christopher Knight

Facebook, drag artists and data protection dilemmas: ‘if you stand on our pitch, you must play by our rules’

Posted on | by Robin Hopkins

Facebook is one of the main battlegrounds between privacy and other social goods such as safety and security.

On the one hand, it faces a safeguarding challenge. Interactions through Facebook have the potential to cause harm: defamation, data protection breaches, stalking, harassment, abuse and the like. One safeguard against such harms is to ensure that users are identifiable, i.e. that they really are who they say they are. This facilitates accountability and helps to ensure that only users of an appropriate age are communicating on Facebook. The ongoing litigation before the Northern Irish courts in the HL case raises exactly these sorts of concerns about child protection.

Part of the solution is Facebook’s ‘real names’ policy: you cannot register using a pseudonym, but only with your official identity.

On the other hand, Facebook encounters an argument which runs like this: individuals should be free to decide how they project themselves in their communications with the world. This means that, provided they are doing no harm, they should in principle be allowed to use whatever identity they like, including pseudonyms, working names (for people who wish to keep their private Facebooking and their professional lives separate) or stage names (particularly relevant for drag artists, for example). The real names policy arguably undermines this element of human autonomy, dignity and privacy. There have been colourful recent protests against the policy on these sorts of grounds.

Which is the stronger argument? Well, the answer to the question seems to depend on who you ask, and where you ask.

The Data Protection Commissioner in Ireland, where Facebook has its EU headquarters, has upheld the real names policy. When one of Germany’s regional Data Protection Commissioners (Schleswig-Holstein) took the opposite view, Facebook challenged his ruling and secured a court victory in 2013. The German court suspended the order against the real names policy and, equally importantly, decided that the challenge should proceed in Ireland, not Germany.

This week, however, another German decision turned the tables on the real names policy yet again. The Hamburg data protection authority upheld a complaint from someone who used a pseudonym on Facebook so as to separate her private and professional communications. The Hamburg DPA found against Facebook and held that it was not allowed unilaterally to change users’ chosen usernames to their real names. Nor was it entitled to demand official identification documents – an issue of particular relevance to child protection issues such as those arising in HL.

The Hamburg ruling is notable on a number of fronts. It exemplifies the tension between privacy – in all its nuanced forms – and other values. It illustrates the dilemmas bedevilling the business models of social media companies such as Facebook.

The case also highlights real challenges for the future of European data protection. The General Data Protection Regulation – currently clawing its way from draft to final form – aspires to harmonised pan-European standards. It includes a mechanism for data protection authorities to co-operate and resolve differences. But if authorities within the same country are prone to divergence on issues such as the real names policy, how optimistic can one be that regulators across the EU will sing from the same hymn sheet?

Important questions arise about data protection and multinational internet companies: in which country (or region, for that matter) should a user raise a complaint to a regulator? If they want to complain to a court, where do they do that? If a German user complains to an Irish regulator or court, to what extent do those authorities have to consider German law?

For the moment, Facebook clearly seeks home ground advantage. But its preference for the Irish forum was rejected by the Hamburg authority in this week’s ruling. He is reported as saying that “… Facebook cannot again argue that only Irish Data Protection law would be applicable … anyone who stands on our pitch also has to play our game”.

The draft Regulation has something to say on these matters, but is far from clear as to how to decide on the right pitch and the right rules for vital privacy battles like these.

Robin Hopkins @hopkinsrobin

Vidal-Hall to the Supreme Court

Posted on | by Christopher Knight

Has the announcement of the death of section 13(2) DPA been premature? Might it, after all, be nuzzling up the bars, ready to go ‘Voom’? Perhaps, but the Supreme Court is taking on the role of Burke and Hare because it has today announced that it has given leave to appeal on the following two questions:

  1. Whether the Court of Appeal was right to hold that section 13(2) of the Data Protection Act 1998 was incompatible with Article 23 of the Directive.
  2. Whether the Court of Appeal was right to disapply section 13(2) of the Data Protection Act 1998 on the grounds that it conflicts with the rights guaranteed by Articles 7 and 8 of the EU Charter of Fundamental Rights.

A further question, on whether it was correct to classify the misuse of private information claims as tortious ones, was refused leave, presumably on the basis that the Supreme Court only wants to think about the super-cool DPA issues.

A hearing is highly unlikely before 2016, but Panopticon will let you know when it knows. In the meantime, section 13(2) is still dead, so get your damages while they are still hot…

Christopher Knight

Circle the Wagons: They are Coming for the Information Tribunal

Posted on | by Christopher Knight

We all fell for it, didn’t we? If the greatest trick the Devil ever pulled was convincing the world he didn’t exist, then Michael Gove’s may have been to convince everyone that he wasn’t interested in FOIA. His shunting responsibility for FOIA/EIR matters off to the Cabinet Office, and the Cabinet Office’s announcement of the Commission on Freedom of Information (generally staffed by people who publicly don’t much like it), last week has led to a lot of comment and reaction – mostly adverse – from social media, blogs and even the mainstream press.

And that has rather caused everyone to take their eye off the ball, including Panopticon (which was alerted by an informant known only as Deep Throat), because in the midst of kerfuffle over the possible threat to the substance of aspects of FOIA through the new Commission the Ministry of Justice has announced a consultation on a more insidious threat to seekers of information and transparency: the introduction of Tribunal fees.

Contained within a document which is also the Government’s Response to an earlier consultation exercise on raising fees in various aspects of civil litigation (also problematic, but not relevant here) is a consultation is the introduction, for the first time, of fees to use certain parts of the First-tier Tribunal and Upper Tribunal. The Upper Tribunal (Administrative Appeals Chamber) is not within the scope of the proposal – although there is no explanation as to why not – but the First-tier Tribunal (General Regulatory Chamber) is.

The proposal is that there will be a £100 fee for an appeal to be issued, and a further £500 fee if an oral hearing takes place. Cases referred to the Upper Tribunal under rule 19 of the GRC Rules will also be subject to the same fee. There will be a system of remissions in place.

This gives rise to a number of issues. Anyone who has had anything to do with the Employment Tribunals over the last few years will know that since the introduction of fees (and, to be fair, compulsory settlement discussion periods) the workload of the ET has gone through the floor. It seems highly likely that something very similar will happen for FOIA/EIR appeals, where so many of the cases are brought by individuals, many of whom will not be able to afford to spend that kind of money on something which has no prospect, unlike the ET, of ever winning them any money and relates almost inevitably to the public interest rather than their own private interest. There must be a real difference of type between such litigation and private interest litigation elsewhere in the GRC. (To be fair, it is of course the case that judicial reviews brought on a public interest basis still incur fees, but they are the exception to the ordinary use of Part 54, whereas the public interest is at the heart of the vast majority of FOIA appeals, and assessed on that basis.) Why, when the legislation is requestor-blind, should the Tribunal system not be too? Alternatively, one might mount a plausible argument that if a public authority wishes to appeal a Decision Notice then it should have to pay a fee (because it is seeking to avoid transparency) but a requestor should not.

It is pretty likely, although the figures aren’t given in the consultation, that FOIA/EIR appeals make up a large proportion of the GRC’s work. But given their public interest element, are they really the cases to which a fee should be targeted? The GRC also hears appeals concerning the regulation of estate agents, driving instructors, claims management services and exam boards (amongst others). Those are all private interests, as are appeals against fines levied on public authorities for bugging phones without warrants. Is not an appeal about the release of public authority information worthy of greater ring-fencing from fees than an appeal about Defra banning you from micro-chipping a dog? (I may be barking up the wrong tree, but I am not making this up.)

In the calculations of the Government, the GRC costs them £1.6m a year. At best, they expect to recover £0.4m in fees, and that will reduce if the caseload drops as a result of fee introduction (which, bizarrely, they apparently do not anticipate). One might think that that was a relative drop in the ocean, although of course every penny counts, but fees won’t pay the GRC’s way (and Gambling disproportionately contributes already given the very high fees and the very low number of cases).

But aside from the issues of principle, there are also real problems of practice, particularly around the hearing fee. The proposal says “The claimant may alternatively elect for an oral hearing, in which case a further fee of £500 would be payable.” But this doesn’t reflect the reality of the GRC Rules. Rule 32 requires the GRC to hold a hearing where one party requests it: what if the ICO or the public authority request one? What if both do? Who pays then? What if the Tribunal itself lists a hearing, against the wishes of the parties, because it thinks it cannot do justice without one under rule 32(1)(b)? Who pays for that decision? The proposal appears to anticipate that the appellant will still have to pay the fee, presumably on the basis that that it is their ‘fault’ that the appeal exists at all, but that seems very unfair. What about directions hearings – does the fee apply to those, and who has to request one for it to be triggered? The proposal seems remarkably un-thought through and the consultation will need to point that out.

Why is it the GRC which is being targeted by fees rather than the appellate stage in the Upper Tribunal? Surely having a second bite on appeal is more worthy of a financial penalty, and a discouragement to unnecessary appeals on the facts? If fees still apply to rule 19 transfers, will it not be in the interest of every litigant to try and get a case transferred to the UT on the basis that if he has to pay, he may as well get the best court he can for his buck?

 

The consultation paper and the impact assessment on tribunal fees are both online. Panopticon strongly encourages readers to respond to the consultation, which closes on 15 September 2015.

Christopher Knight

Child Protection and Data Protection

Posted on | by Christopher Knight

The spectre of Jimmy Saville casts a long shadow and now it extends to data protection, the Data Protection Act 1998 being the latest august and uniformly popular institution (following the BBC, Broadmoor and Margaret Thatcher to name just some) to suffer as a result of his actions. The perennial sight of investigations and public inquiries into historic sex abuse of children in local authority, chiefly arising out of the wider ramifications of Operation Yewtree, has provided a very ready explanation for local authorities for the need to retain child protection data.

The fifth data protection principle says data should not be kept longer than necessary for the purposes for which it is processed, whereas the reality will often be that the information of greatest significance (accusations of abuse or records of care) will only become significant after the expiry of a lot of time and the child’s growth into an adult able to confront the abuse they have suffered.

As a result, there is no consistent practice across the country. The High Court in R (C) v Northumberland County Council & ICO [2015] EWHC 2134 (Admin) was informed that authorities adopt an approach which ranges from retention until the 21st birthday, to six years after the 18th birthday, to 75 years from the date of birth, to 35 years from the closure of a case: at [10]. This obviously poses concerns about compliance with the DPA and Article 8 ECHR.

C sought the destruction of his child protection held by Northumberland CC and considered that it had been retained under the 35 year policy applicable in Northumberland for too long. C considered that a period of six years after his 18th birthday would have been the cut-off point, and the ICO agreed intervening (although the ICO copped a lot of flak from Simon J for having issued a section 42 DPA determination indicating it was ‘likely’ the Council had complied with the DPA and had subsequently changed its mind).

The judgment of Simon J is not always the easiest to follow. It appears that the key question before the Court was whether the retention for 35 years (which clearly engaged Article 8) was in accordance with the law, and if it was, whether it was proportionate. Although the judgment does not actually reason expressly in this way, it seems as though the analysis revolves around the fifth principle: if data retention does not breach the longer than necessary test, it will be in accordance with the law and it will be proportionate. This is not actually what the judgment says; it must be broadly how the analysis goes (see at [9]), and it is open to some debate whether those assumptions are correct in law or in analysis of the judgment.

Simon J held that the purpose for retaining child protection records was not limited to defending litigation, and so an adoption of six years – based on the limitation period – did not read across. The purpose was broader: it was to protect other children, to allow data subjects access in later life, and to make the information available to subsequent investigation: at [33]. The Judge was clearly influenced by the difficulty of seeing the importance of information at the time, and its significance only becoming clear through a more historical lens: at [37]. The clearest examples are, of course, Saville-esque: at [49]-[53]. A six year cut off period would, in the view of Simon J, restrict the ability of people over 24 from making a request and learning about their child protection file contents: at [45]-[47]. Simon J concluded that the Council was not required to adopt a “cumbersome and time-consuming predictive exercise” and retention would help to identify risks only seen with hindsight: at [56]. Regular review, every seven years, was considered a disproportionate use of labour: at [58]. 35 years “fell within the bracket of legitimate periods of retention”: at [61].

One can readily sympathise with the position of the Council in a case like C, which will be (with other linked agencies) between a rock and a hard place on child protection data. If they delete too quickly they risk being castigated by history for not being able to answer questions; if they don’t delete they are hoarders of sensitive and traumatic data. Simon J clearly sympathised very strongly with this. However, the structure of the reasoning is regrettably unclear. The reader is left uncertain whether Simon J has found the fifth principle complied with (probably, on the basis of a wider reading of its purposes), whether that has meant the interference with Article 8 was in accordance with the law (presumably, but query how that works where it only falls within a legitimate bracket), and how the structured proportionality analysis has been carried out. It may well not matter on the conclusions of the judgment, but it does mean it will be harder to advise on and apply in related contexts. Nor does it give much guidance as to other periods adopted; is 6 years too short and is 75 years too long? Doubtless further case law will explore the undiscovered country. In the meantime, some national guidance wouldn’t go amiss…

Paul Greatorex appeared for C, Karen Steyn QC for Northumberland and Robin Hopkins for the ICO.

Christopher Knight