Evans Vetos Badger Trust?

Posted on | by Christopher Knight

“The world is full of obvious things which nobody by any chance ever observes.” Sherlock Holmes, The Hound of the Baskervilles.

What else can there possibly be to say about Evans not covered in Robin’s excellent post from Thursday? One can contemplate the possible amendments the Government might make (how much clearer could Parliament have made the purpose of section 53), and what other changes might be made at the same time, especially in the light of the PM referring to FOIA as one of the “buggerations” of Government in the Times magazine yesterday. One can analyse the dissenting judgments, which is certainly worthy of time. One can remark again on the constitutional importance of the Supreme Court emphasising the rule of law.

Most information law practitioners probably think there isn’t really anything in Evans that is going to be very relevant to their daily lives. Even central Government FOIA officers have onlyseen seven vetos in ten years, so Evans isn’t going to make much of a practical difference.

But. Almost in passing, there is one passage in the judgment of Lord Neuberger (if not the majority judgment, at least the leading judgment) which is worthy of notice.

As has been previously pointed out on this blog, the Upper Tribunal in Defra v ICO & the Badger Trust [2014] UKUT 526 (AAC) set the cat amongst the FOIA pigeons (if that is not too much of a mixture of animal metaphors) by suggesting at [44]-[48] that it was an open question whether the public interest balance was to be assessed at the time of the request/response or afresh at the time of the Tribunal hearing. That baton is now being taken up in the  latest round of the interminable APPGER litigation.

However, it is possible that the Supreme Court has beaten them to it. The time of the assessment of the balancing exercise was a point of some relevance to the reasoning of Lord Neuberger, because a (powerful) objection to the reasoning of the Court of Appeal (including from me) was that the two permitted exceptional categories, particularly the reliance on fresh evidence, did not leave much room for application of the veto where the public interest was adjudged at or around the time of the request. Lord Neuberger, unlike the Court of Appeal, sought to address the point. In doing so, he noted at [72] that:

“It is common ground, in the light of the language of sections 50(1), 50(4) and 58(1), which all focus on the correctness of the original refusal by the public authority, that the Commissioner, and, on any appeal, any tribunal or court, have to assess the correctness of the public authority’s refusal to disclose as at the date of that refusal.”

As the text sets out, no contrary point was argued, but Lord Neuberger does not express any dissent about it and sets out the legal basis for it in the statutory language. Moreover, he went to reiterate the point, and the exceptions to it, at [72]:

“However, although the question whether to uphold or overturn (under section 50 or sections 57 or 58) a refusal by a public authority must be determined as at the date of the original refusal, facts and matters and even grounds of exemption may, subject to the control of the Commissioner or the tribunal, be admissible even though they were not in the mind of the indivdual responsible for the refusal or communicated at the time of the refusal to disclose (i) if they existed at the date of the refusal, or (ii) if they did not exist at that date, but only in so far as they throw light on the grounds now given for refusal“.

It is difficult to see how the obiter musings of the Upper Tribunal in Badger Trust can withstand this, fairly prolonged, piece of Supreme Court reasoning. Arguments may be made that it was common ground, and possibly that was obiter itself, but it will self-evidently persusive that such experienced and eminent counsel agreed such a standpoint, and that the leading judgment relies upon it.

Perhaps the debate door is shut only shortly after being opened? Perhaps Evans has something to say to FOIA lawyers outside the scope of the veto power after all? Perhaps, perhaps, perhaps…

Christopher Knight

PS A prize (kudos only though) for the first person to spot the link between opening and closing of this post.

Google and the DPA – RIP section 13(2)

Posted on | by Christopher Knight

Well, isn’t this an exciting week (and I don’t mean Zayn leaving One Direction)? First, Evans and now Vidal-Hall. We only need Dransfield to appear before Easter and there will be a full red bus analogy. Robin opened yesterday’s analysis of Evans by remarking on the sexiness of FOIA. If there is one thing you learn quickly as an information law practitioner, it is not to engage in a sexiness battle with Robin Hopkins. But high-profile though Evans is, the judgment in Vidal-Hall will be of far wider significance to anyone having to actually work in the field, rather than simply tuning every now and then to see the Supreme Court say something constitutional against a FOIA background. Vidal-Hall might not be the immediate head-turner, but it is probably going to be the life-changer for most of us. So, while still in the ‘friend zone’ with the Court of Appeal, before it all gets serious, it is important to explain what Vidal-Hall v Google [2015] EWCA Civ 311 does.

The Context

The claims concern the collection by Google of information about the internet usage of Apple Safari using, by cookies. This is known as “browser generated information” or “BGI”. Not surprisingly, it is used by Google to more effectively target advertising at the user. Anyone who has experienced this sort of thing will know how bizarre it can sometimes get – the sudden appearance of adverts for maternity clothes which would appear on my computer followed eerily quickly from my having to research pregnancy information for a discrimination case I was doing. Apple Safari users had not given their consent to the collection of BGI. The Claimants brought claims for misuse of private information, breach of confidence and breach of the DPA, seeking damages under section 13. There is yet to be full trial; the current proceedings arise because of the need to serve out of the jurisdiction on Google.

The Issues

These were helpfully set out in the joint judgment of Lord Dyson MR and Sharp LJ (with whom Macfarlane LJ agreed) at [13]. (1) whether misuse of private info is a tort, (2) whether damages are recoverable under the DPA for mere distress, (3) whether there was a serious issue to be tried that the browser generated data was personal data and (4) whether permission to serve out should have been refused on Jameel principles (i.e. whether there was a real and substantial cause of action).

Issues (1) and (4) are less important to readers of this blog, and need only mention them briefly (#spoilers!). Following a lengthy recitation of the development of the case law, the Court held that the time had come to talk not of cabbages and kings, but of the tort of misuse of private information, rather than being an equitable action for breach of confidence: at [43], [50]-[51]. This allowed service out under the tort gateway in PD6B. The comment of the Court on issue (4) is worth noting, because it held that although claims for breach of the DPA would involve “relatively modest” sums in damages, that did not mean the claim was not worth the candle. On the contrary, “the damages may be small, but the issues of principle are large”: at [139].

Damages under Section 13 DPA

Issue (2) is the fun stuff for DP lawyers. As we all know, Johnson v MDU [2007] EWCA Civ 262 has long cast a baleful glare over the argument that one can recover section 13 damages for distress alone. The Court of Appeal have held such comments to be obiter and not binding on them: at [68]. The word ‘damage’ in Art 23 of the Directive had to be given an autonomous EU law meaning: at [72]. It also had to be construed widely having regard to the underlying aims of the legislation: the legislation was primarily designed to protect privacy not economic rights and it would be strange if data subjects could not recover compensation for an invasion of their privacy rights merely because they had not suffered pecuniary loss, especially given Article 8 ECHR does not impose such a bar: at [76]-[79]. However, it is not necessary to establish whether there has also been a breach of Article 8; the Directive is not so restricted (although something which does not breach Article 8 is unlikely to be serious enough to have caused distress): at [82].

What then to do about section 13(2) which squarely bars recovery for distress alone and is incompatible with that reading of Article 23? The Court held it could not be ‘read down’ under the Marleasing principle; Parliament had intended section 13(2) to impose this higher test, although there was nothing to suggest why it had done so: at [90]-[93]. The alternative was striking it down on the basis that it conflicted with Articles 7 and 8 of the EU Charter of Fundamental Rights, which the Court of Appeal accepted. In this case, privacy and DP rights were enshrined as fundamental rights in the Charter; breach of DP rights meant that EU law rights were engaged; Article 47 of the Charter requires an effective remedy in respect of the breach; Article 47 itself had horizontal direct effect (as per the court’s conclusion in Benkharbouche v Embassy of Sudan [2015] EWCA Civ 33); the Court was compelled to disapply any domestic provision which offended against the relevant EU law requirement (in this case Article 23); and there could be no objections to any such disapplication in the present case e.g. on the ground that the Court was effectively recalibrating the legislative scheme: at [95]-[98], [105].

And thus, section 13(2) was no more. May it rest in peace. It has run down the curtain and joined the bleedin’ choir invisible.

What this means, of course, is a potential flood of DP litigation. All of a sudden, it will be worth bringing a claim for ‘mere’ distress even without pecuniary loss, and there can be no doubt many will do so. Every breach of the DPA now risks an affected data subject seeking damages. Those sums will invariably be small (no suggestion from the Court of Appeal that Article 23 requires a lot of money), and perhaps not every case will involve distress, but it will invariably be worth a try for the data subject. Legal costs defending such claims will increase. Any data controllers who were waiting for the new Regulation with its mega-fines before putting their house in order had better change their plans…

Was BGI Personal Data

For the DP geeks, much fun was still to be had with Issue (3). Google cannot identify a particular user by name; it only identifies particular browsers. If I search for nasal hair clippers on my Safari browser, Google wouldn’t recognise me walking down the street, no matter how hirsute my proboscis. The Court of Appeal did not need to determine the issue, it held only that there was a serious issue to be tried. Two main arguments were run. First, whether the BGI looked at in isolation was personal data (under section 1(1)(a) DPA); and secondly, whether the BGI was personal data when taken together with gmail account data held by Google (application of limb (b)).

On the first limb, the Court held that it was clearly arguable that the BGI was personal data. This was supported by the terms of the Directive, an Article 29 WP Opinion and the CJEU’s judgment in Lindqvist. The fact that the BGI data does not name the individual is immaterial: it clearly singles them out, individuates them and therefore directly identifies them: at [115] (see more detail at [116]-[121]).

On the second limb, it was also clearly arguable that the BGI was personal data. Google had argued that in practice G had no intention of amalgamating them, therefore there was no prospect of identification. The Court rejected this argument both on linguistic grounds (having regard to the wording of the definition of personal data, which does not require identification to actually occur) and on purposive grounds (having regard to the underlying purpose of the legislation): at [122]-[125].

A third route of identification, by which enable individual users could be identified by third parties who access the user’s device and then learn something about the user by virtue of the targeted advertising, the Court concluded it was a difficult question and the judge was not plainly wrong on the issue, and so it should be left for trial: at [126]-[133].

It will be interesting to see whether the trial happens. If it does, there could be some valuable judicial discussion on the nature of the identification question. For now, much is left as arguable.

Conclusion

The Court of Appeal’s judgment in Vidal-Hall is going to have massive consequences for DP in the UK. The disapplication of section 13(2) is probably the most important practical development since Durant, and arguably more so than that. Google are proposing to seek permission to appeal to the Supreme Court, and given the nature of the issues they may well get it on Issues (1) and (2) at least. In meantime, the Court’s judgment will repay careful reading. And data controllers should start looking very anxiously over their shoulders. The death of their main shield in section 13(2) leaves them vulnerable, exposed and liable to death by a thousand small claims.

Anya Proops and Julian Milford appeared for the ICO, intervening in the Court of Appeal.

Christopher Knight

PS No judicial exclamation marks to be found in Vidal-Hall. Very restrained.

Why Evans gets the spiders

Posted on | by Robin Hopkins

I told you FOI was sexy.

The Supreme Court’s judgment in R (Evans) v Attorney General [2015] UKSC 21 has received vast amounts of media coverage – more in a single day than everything else about FOI has received in ten years, I reckon. No need to explain what the case was about – the upshot is that Rob Evans gets Prince Charles’ ‘black spider’ letters. Here’s why.

In other words, this post summarises why the judgment went Evans’ way 5:2 on the FOIA veto and 6:1 on the EIR veto. I leave aside the trenchant dissenting judgments (Lord Wilson on both FOIA and the EIRs; Lord Hughes on FOIA only), which merit a post in their own right.

FOIA and the ministerial veto

Three of the five JSCs who found that the Attorney General’s veto under FOIA was unlawful took the following view (that of Lord Neuberger).

The constitutional context and the restrictive view of section 53

“A statutory provision which entitles a member of the executive… to overrule a decision of the judiciary merely because he does not agree with it would not merely be unique in the laws of the United Kingdom. It would cut across two constitutional principles which are also fundamental components of the rule of law”, i.e. (i) that a court’s decisions are binding and cannot be ignored or set aside by anyone, and (ii) that the executive’s actions are reviewable by the court on citizens’ behalf. “Section 53, as interpreted by the Attorney General’s argument in this case, flouts the first principle and stands the second principle on its head” (paragraphs 51-52).

Therefore, if Parliament intends to permit the executive to override a judicial decision merely because it disagrees with that decision, it must ‘squarely confront what it is doing’ and make its intentions ‘crystal clear’. Section 53 FOIA is a long way from authorising such an override on the grounds of disagreement (paragraphs 56-58).

The upshot is that a minister cannot use section 53 to override a judicial decision simply on the grounds that, having considered the issue based on the same facts and arguments as the court or tribunal, he reaches a different view. In their context, and in light of the serious constitutional implications, the words “on reasonable grounds” in section 53 FOIA must be construed more restrictively: mere disagreement with the court/tribunal will not do.

The threshold is higher: a section 53 certificate will be lawful if there has been a material change in circumstances, or if facts or matters come to light at some point which (a) indicate that the judicial decision being overturned was seriously flawed, but (b) cannot give rise to an appeal against that decision. Such cases will be exceptional, but they are a real possibility, in Lord Neuberger’s judgment. Section 53 therefore retains some utility (see paragraphs 68, 77 and 78). Lord Kerr and Lord Reed agreed with Lord Neuberger’s restrictive view of section 53.

A less restrictive view of section 53

Lord Mance (with whom Lady Hale agreed) also found the Attorney General’s veto in this case to have been unlawful. He agreed that mere disagreement with the decision being overturned will not do. Lord Mance’s interpretation of section 53, however, is markedly less restrictive than that of Lord Neuberger: the accountable person is entitled under section 53 to reach a different view on the balancing of competing interests, even in the absence of the sorts of new considerations Lord Neuberger envisages, provided he gives properly explained and solid reasons against the background and law established by the judicial decision (see paragraphs 130-131).

There is thus more scope for a lawful veto on Lord Mance’s view – but his was not the majority view. Lord Neuberger’s more restrictive view commanded wider support. This makes a big difference to the future use of section 53.

What about First-Tier and ICO decisions?

Here are some further important implications addressed by Lord Neuberger.

This veto was against a decision of the Upper Tribunal, which is a court of record. Do the same stringent restrictions apply to an attempt to veto a decision of the First-Tier Tribunal? Answer: yes.

What about the ICO’s decisions? Is the threshold for a lawful veto equally high, or is it lower? Answer: it is lower, as the ICO’s evaluation can seldom be as exhaustive as that of a Tribunal. Nonetheless, the option to appeal to the Tribunal will be a relevant consideration: to use the section 53 power to achieve what you could also achieve by the more constitutionally appropriate route of an appeal may be an abuse of that power.

Those distinctions are important. Some section 53 certificates have been issued against First-Tier Tribunal decisions – the NHS risk register veto, for example. Others have been against ICO decisions – the High Speed 2 veto, for example. The Iraq war cabinet minutes have been the subject of two section 53 certificates – one against a Tribunal decision, the other against an ICO decision.

The EIRs and the ministerial veto

By comparison, the answer under the EIRs was relatively straightforward: Article 6 of Directive 2003/4/EC requires that refusals to disclose environmental information can be challenged before court whose decisions will be final. The ministerial veto provision does not square with that requirement. Environmental information cannot be the subject of the ministerial veto. These were the arguments advanced by Mr Evans, and by Tim Pitt-Payne on the ICO’s behalf. They were accepted by six of the seven JSCs.

So, a triumphant day for Rob Evans and The Guardian – and indeed for FOIA, the EIRs, transparency and the rule of law.

The outlook for the future use of section 53 is challenging, though there is nuance aplenty, even aside from the dissenting judgments.

Robin Hopkins @hopkinsrobin

Evans – Supreme Court rules that AG’s veto was unlawful

Posted on | by Anya Proops KC

The Supreme Court has today handed down a judgment which has very significant ramifications for the operation of the veto regime by the Government in connection with FOIA and EIR cases: R(Evans) v Attorney General. It marks a great victory for the Guardian in its 10 year struggle to gain access to correspondence written by HRH Prince Charles to various government departments. But more than this, it marks an important milestone in the development of FOI jurisprudence, as our highest court makes clear that, when it comes to the application of FOIA, Government cannot trump the decisions of the courts merely because it takes a different view of the facts of the case.

In short, the Supreme Court has held: (a) by a 5:2 majority that the veto issued under FOIA by the AG in respect of the Upper Tribunal’s order that the correspondence should be disclosed was unlawful and (b) by a 6:1 majority that provisions in the EIR which permit the Government to issue a veto in cases falling within the scope of the environmental information access regime were invalid, as they are incompatible with the EU Directive on public access to environmental information (2003/4/EC). The Supreme Court’s Press Summary, which contains a useful summary of the judgment, can be found here.

Posts containing careful analysis of the judgment will undoubtedly follow on Panopticon. 11KBW’s Karen Steyn QC appeared for the Attorney General. Timothy Pitt-Payne QC appeared for the ICO.

Anya Proops

Google Spain, freedom of expression and security: the Dutch fight back

Posted on | by Robin Hopkins

The Dutch fighting back against the Spanish, battling to cast off the control exerted by Spanish decisions over Dutch ideologies and value judgments. I refer of course to the Eighty Years’ War (1568-1648), which in my view is a sadly neglected topic on Panopticon.

The reference could also be applied, without too much of a stretch, to data protection and privacy rights in 2015.

The relevant Spanish decision in this instance is of course Google Spain, which entrenched what has come to be called the ‘right to be forgotten’. The CJEU’s judgment on the facts of that case saw privacy rights trump most other interests. The judgment has come in for criticism from advocates of free expression.

The fight-back by free expression (and Google) has found the Netherlands to be its most fruitful battleground. In 2014, a convicted criminal’s legal battle to have certain links about his past ‘forgotten’ (in the Google Spain sense) failed.

This week, a similar challenge was also dismissed. This time, a KPMG partner sought the removal of links to stories about him allegedly having to live in a container on his own estate (because a disgruntled builder, unhappy over allegedly unpaid fees, changed the locks on the house!).

In a judgment concerned with preliminary relief, the Court of Amsterdam rejected his application, finding in Google’s favour. There is an excellent summary on the Dutch website Media Report here.

The Court found that the news stories to which the complaint about Google links related remained relevant in light of public debates on this story.

Importantly, the Court said of Google Spain that the right to be forgotten “is not meant to remove articles which may be unpleasant, but not unlawful, from the eyes of the public via the detour of a request for removal to the operator of a search machine.”

The Court gave very substantial weight to the importance of freedom of expression, something which Google Spain’s critics say was seriously underestimated in the latter judgment. If this judgment is anything to go by, there is plenty of scope for lawyers and parties to help Courts properly to balance privacy and free expression.

Privacy rights wrestle not only against freedom of expression, but also against national security and policing concerns.

In The Hague, privacy has recently grabbed the upper hand over security concerns. The District Court of The Hague has this week found that Dutch law on the retention of telecommunications data should be down due to its incompatibility with privacy and data protection rights. This is the latest in a line of cases challenging such data retention laws, the most notable of which was the ECJ’s judgment in Digital Rights Ireland, on which see my post here. For a report on this week’s Dutch judgment, see this article by Maarten van Tartwijk in The Wall Street Journal.

As that article suggests, the case illustrates the ongoing tension between security and privacy. In the UK, security initially held sway as regards the retention of telecoms data: see the DRIP Regulations 2014 (and Panopticon passim). That side of the argument has gathered some momentum of late, in light of (for example) the Paris massacres and revelations about ‘Jihadi John’.

Just this week, however, the adequacy of UK law on security agencies has been called into question: see the Intelligence and Security Committee’s report entitled “Privacy and Security: a modern and transparent legal framework”. There are also ongoing challenges in the Investigatory Powers Tribunal – for example this one concerning Abdul Hakim Belhaj.

So, vital ideological debates continue to rage. Perhaps we really should be writing more about 17th century history on this blog.

Robin Hopkins @hopkinsrobin

Catt is put back in the bag – supreme court reverses court of appeal in police data retention case

Posted on | by Anya Proops KC

The Catt and T cases are both concerned with this important question: to what extent may the police lawfully retain records relating to individuals who have not in fact been arrested or charged in connection with any criminal offence. The Supreme Court has now had its say on this question – see the judgment here.

The background to the appeal is very helpfully set out in this earlier post. In short, Mr Catt (C) is a peaceful protestor who participated in an anti-arms trade protest conducted by a group called Smash-EDO. Smash-EDO is associated with violent crime. The police overtly recorded information about individuals attending Smash EDO demonstrations, including C. The police went on to retain information about C, including his name, address and information confirming his presence at a particular protest. The data was stored on the police’s Domestic Extremism Database. T is an individual who is alleged to have made a homophobic comment to a neighbour’s friend. The police sent her a ‘Prevention of Harassment’ letter warning her that she could be liable to arrest and prosecution should she commit any act amounting to harassment. The letter was originally retained on the police’s files in accordance with its policy that such correspondence should be retained for 7 years. However, in point of fact, the letter sent to T was destroyed after only two and half years.

The High Court dismissed claims made by C and T that the police’s act of retaining their data constituted a breach of their Article 8 rights. The Court of Appeal allowed the claimants’ appeal, reversing the High Court’s judgment. Now the Court of Appeal’s judgment has itself been reversed by the Supreme Court which, in summary, held that whilst retention of the data interfered with the claimants’ Article 8 rights, the retention was justified under Article 8(2). The core question which the Supreme Court had to address was the proportionality of the retention, particularly having regard to the fact that neither claimant had actually been arrested or charged with any offence.

Mr Catt’s case – The judgment in C’s case was a majority judgment, with Lord Toulson dissenting. In terms of the majority (Lords Sumption, Mance and Neuberger and Lady Hale), it is clear that the judges were of the view that the retention of C’s data was not disproportionate because:

  • the level of intrusion with C’s privacy rights was minimal, particularly given that:
    • the information in question is not intimate or sensitive;
    • it related to C’s activities in a public forum – the recorded facts were in that sense in the public domain;
    • there are tight constraints on the uses to which the data may be put (essentially they may only be used for police purposes and are subject to a strict review/deletion policy
  • moreover, it would require disproportionate effort for the police to have to weed out this type of record from its other records.
  • by way of contrast, the benefits to be obtained from retaining the data were potentially substantial and included enabling the police to develop a detailed intelligence picture of organisations prepared to engage in violent crime

Lord Toulson took a different view of the proportionality issues. In essence, he concluded that the information in question was unlikely to add much value in terms of meeting policing objectives and, further, that the weeding exercise would not be unduly onerous, particularly given that the police regularly had to undertake such weeding exercises in any event.

T’s case – In T’s case, the majority (Lady Hale, Lord Toulson and Lord Mance) were of the view that the retention policy in issue was lawful. Lady Hale and Lord Toulson both made the point that retention of such information over an extended period of time was important, particularly in terms of dealing effectively with domestic abuse cases. By way of contrast, Lord Sumption was of the view that such a lengthy retention period was disproportionate, particularly given the trivial nature of the incident in question. However, on the facts relating to T’s case, he held that it was not disproportionate for the police to have retained the letter for the relatively short period of 2.5 years. Thus, he concurred with the conclusion that the appeal should be allowed.

A key point emerging from the judgment, and indeed the litigation history of these appeals, is that there is no perfect science when it comes to applying the proportionality principle. Instead, the exercise of assessing proportionality is inherently impressionistic, as is illustrated by the wide divergence of views expressed by the judges in the High Court, Court of Appeal and the Supreme Court. It is understood that the claimants will now seek to have the case referred to the European Court of Human Rights. So we may yet see another reversal of fortunes in this interesting and important litigation.

Jason Coppel QC and Robin Hopkins appeared for the Secretary of State for the Home Department, who intervened in the appeal.

Anya Proops