APPGER in the Upper Tribunal

Posted on | by Christopher Knight

The Upper Tribunal has finally handed down its judgment in All Party Parliamentary Group on Extraordinary Rendition v IC & Foreign and Commonwealth Office [2013] UKUT 560 (AAC). It is a judgment of Charles and Burnett JJ and Judge Wikeley. The appeal was from an FTT judgment which is analysed in detail by Rachel Kamm here. That post also contains the background to the case. In essence, the request was made by the APPGER for information relating to the participation of the UK in the practice of extraordinary rendition. The judgment is long, and will be blogged on in more detail in due course. But in brief, there were five broad grounds of appeal:

1) That the FTT erred in its approach to Article 10 ECHR;

2) That the FTT erred in its construction of section 23(1) FOIA (information relating to a security body);

3) That the FTT failed to provide adequate reasons for its conclusions on section 23(1);

4) That the FTT erred in its approach to the control principle (put simply, that information acquired through diplomatic or security channels is not disclosed without consent) and so failed to carry out the balancing process correctly under section 27 FOIA (international relations);

5) That the FTT erred in its approach to the section 35(1)(a) FOIA exemption (formulation and development of policy).

Grounds 1 and 2 have not been decided. They are stayed pending the judgment of the Supreme Court in Kennedy v Charity Commission (see here).

The Upper Tribunal rejected grounds 3 and 5. They held that the reasons provided by the FTT were sufficient when read as a whole, and that their approach to section 35(1)(a) had been in accordance with the authorities.

The bulk of the judgment concerns ground 4, and the appeal on section 27. The Upper Tribunal held that the APPGER had been rendered ignorant of the FCO’s primary case on the relevant harm caused by disclosure, and that the FCO, the ICO and the FTT had failed to identify or explain this in open session: at [89]-[90]. There was no good reason for this failure, and it resulted in avoidance substantive and procedural unfairness: at [95]-[96]. The failure of the FTT to hold a further hearing or allow further submissions to be made to consider alterations made to the draft judgment at the behest of the FCO was an error of law which perpetuated unfairness: at [113].

Although obiter, the Tribunal also concluded that the FTT’s approach meant that it did not properly understand the underlying reasoning of the arguments advanced and its conclusions did not have a proper evidential and reasoned foundation under section 27: at [118].

The Upper Tribunal also made general observations on the nature of closed sessions; the need for cases advanced in closed to be identified with clarity; the need to make a record of closed sessions; the need to identify in open the competing public interests wherever possible; and the need to limit material adduced only in closed session, along with the utility of schedules identifying the issues: at [144]-[156].

There is much to be taken from the Upper Tribunal decision, and of course the APPGER litigation is some way off being over. Further analysis will doubtless be forthcoming, but you can read the judgment here:

GIA 2230 2012 Upper Tribunal decision

Tim Pitt-Payne QC and Joanne Clement (11KBW) acted pro bono to represent APPGER; Robin Hopkins (11KBW) acted for the Information Commissioner; and Karen Steyn (also of 11KBW) and Julian Blake represented the FCO.

Christopher Knight

The Upper Tribunal’s first consideration of monetary penalty notices

Posted on | by Julian Milford

The Upper Tribunal has just issued judgment in Central London Community Healthcare NHS Trust v Information Commissioner [2013] UKUT 0551. This significant decision is the first time the Upper Tribunal has considered an appeal against a monetary penalty notice (“MPN”), issued by the Commissioner under section 55A Data Protection Act 1998 (“DPA”).

The Commissioner is empowered to issue an MPN under section 55A DPA, where he is satisfied that there has been a serious contravention of the data protection principles by a data controller, the contravention was of a kind likely to cause substantial damage or distress, and other relevant conditions are met. The amount of an MPN may be up to £500,000. In this case, the Trust had repeatedly faxed sensitive medical details of patients to a member of the public by mistake, believing that it was faxing them to a hospice. The Trust had “self-reported” its own contravention to the Commissioner, who had issued an MPN of £90,000.

The Trust appealed against the MPN under section 49 DPA, first to the First-Tier Tribunal, which rejected the appeal, and then to the Upper Tribunal. The grounds of appeal were fourfold: (1) the Commissioner failed to recognise he had a discretion as to whether to issue a MPN, and failed to consider how it should be exercised; (2) the Tribunal should have concluded that the Commissioner was barred from serving an MPN, because the Trust had self-reported its breach; (3) the Commissioner had acted unlawfully in offering the Trust a discount of £18,000 for early payment of the MPN, but refusing to allow the Trust to benefit from the discount if it decided to appeal; and (4) the quantum of the award was unsustainably high.

The Upper Tribunal rejected all four grounds of appeal. Along the way, it made some useful general observations about the way in which the MPN regime works. In particular, it stated as follows:

(1)    The fact that a public authority has self-reported a breach does not prevent the Commissioner from issuing an MPN. Among other matters, the logical implication of that argument would be that a data controller responsible for a deliberate and very serious breach of the DPA could avoid an MPN simply by self-reporting. That could not be correct.

(2)    As a matter of principle, the Commissioner has discretion whether to issue an MPN where the statutory conditions for its issue are met, as well as discretion as to the amount. On appeal, the First-Tier Tribunal (“FTT”) must conduct a full merits review of the Commissioner’s exercise of his discretion. The nature of the FTT’s jurisdiction on an appeal under section 49 DPA was akin to the nature of its jurisdiction in an appeal against a decision notice of the Commissioner under section 58 Freedom of Information Act 2000 (“FOIA”). In other words, the FTT’s function under section 49 DPA was to decide whether the Commissioner’s decision to issue an MPN and the amount of the penalty was right.

(3)    It was permissible for the Commissioner to operate a scheme which gave a discount for early payment, if and only if the public authority did not appeal. There was a strong public policy argument justifying such a scheme – the early payment and early resolution of the issue. The proper analogy was with discount schemes operated for fixed penalty notices e.g. for minor motoring contraventions.

(4)    The Upper Tribunal did in principle have the power to increase a penalty under section 55A DPA, although that issue did not arise on the facts of this case.

The decision is an important validation of the way in which the Commissioner presently approaches the issuance of MPNs, and usefully clarifies the nature of appeals against MPNs.

Timothy Pitt-Payne QC of 11KBW acted for the Trust; Anya Proops of 11KBW acted for the Commissioner.

Julian Milford 

Confidentiality of medical information after patient’s death: two new Upper Tribunal decisions

Posted on | by Robin Hopkins

The absolute exemption at section 41 extends to information obtained by the public authority the disclosure of which would give to an actionable breach of confidence. Does the obligation of confidence survive the death of the confider? If so, would a breach of that obligation be actionable, even if it is not clear exactly who could bring such an action? These issues arise most notably in the context of medical records. The Upper Tribunal has had something to say on this in two recent decisions.

In Webber v IC and Nottinghamshire Healthcare NHS Trust (GIA/4090/2012), the appellant had made a FOIA request for information (including hospital records) about the death of her son in 1999 when he was compulsorily resident at Rampton hospital. This was refused on section 41 grounds. The Commissioner upheld the refusal, as did the First-Tier Tribunal. In doing so, it somewhat unusually did not see the withheld information for itself, since it had not been asked to by anyone.

Mrs Webber’s appeal to the Upper Tribunal has also been dismissed. Judge Williams considered that the Tribunal could not be faulted for not differentiating between different categories of withheld information (which it obviously could not do, as it had not seen the information): “it is the task of the tribunal to decide the case before it unless it sees reason to investigate further” (paragraph 30).

He also confirmed the well-established principle that what matters under FOIA is information rather than documents: though the records were created by the NHS Trust, the information contained in those records came from the patient. In the section 41 context, “obtained” simply means “come to have”, which can be active or passive (paragraph 38).

Judge Williams confirmed a further touchstone of FOIA, namely that whatever the particular interests of the requester, this “remained an application to put the information into the public domain” (paragraph 37), that being the effect of disclosure under FOIA.

Disclosure would entail a breach of confidence which was actionable after the patient’s death, notwithstanding the argument that, in this case, the only person who could sue would be the personal representative (who was likely to have been the requester: thus it was submitted that she would in effect have been suing herself).

Judge Williams also found that there would not have been a public interest defence to the breach of confidence. Here he gave weight to the fact that some of the information sought would or could come into the public domain or be obtained in another way: a coroners’ inquest, or through an application under the Access to Health Records Act 1990 (now largely supplanted by FOIA, but not as regards deceased persons) which allows for requests for access to information to be made by (inter alia) patients’ personal representatives. Such an application was outside the Upper Tribunal’s jurisdiction but it was “relevant to note that it exists as a specific if limited remedy for some aspects of the application made for the appellant in this case” (see paragraphs 23-24).

In M v IC and Medicines and Health Products Regulatory Authority (GIA/3017/2010), Upper Tribunal Judge Lloyd-Davies allowed the requester’s appeal for information in a report held by the public information concerning a pharmaceutical trial of a drug developed by Pfizer. That information had again been withheld under section 41, with the Commissioner and First-Tier Tribunal agreeing – regardless of whether the participants in the trial were dead or alive at the time of the request.

The appeal was allowed because of a procedural error – the Tribunal had authorised more extensive redactions than were in fact being put to it.

The remitted hearing is to include questions of identifiability of patients in the context of anonymised drug trial data. The line of authorities on statistical information (Common Services Agency, Department of Health) will no doubt be considered.

The decision contained this obiter observation on actionable breaches of confidence in the case of deceased patients: “where the confidence arises in the context of a patient/healthcare professional relationship, I am minded to conclude that the obiter observations of Mr Justice Foskett in R (Lewis) v Secretary of State for Health [2008] EWHC 2196 (QB) are correct”.

I acted for the Commissioner in the M case; my colleague Joe Barrett acted for the appellant in Webber.

Robin Hopkins @hopkinsrobin

Sex in the IPT

Posted on | by Christopher Knight

As with all the best headlines, this one is slightly misleading. Readers can scarcely fail to have noticed the coverage surrounding the major ongoing case regarding a former undercover (under-the-covers?) police officer, Mark Kennedy, who (together with others) infiltrated political and environmental activists over a period of years. Claims were commenced in the High Court, with part of the conduct complained of involving ensuing sexual relations between activists/their partners and undercover officers.

Earlier this year, AJA and others v Commissioner of Police for the Metropolis [2013] EWHC 32 (QB) saw part of the claims struck out. The Court held that the Investigatory Powers Tribunal had exclusive jurisdiction over the claims under the Human Rights Act 1998; it struck out these parts accordingly. It observed that conduct breaching Article 3 (inhuman and degrading treatment) – which included the claims relating to sexual activity – could not be authorised under RIPA, but conduct breaching Article 8 (privacy) could be authorised. Sexual activity with undercover officers did not necessarily engage Article 3.

Those parts of the claims which did not concern the Human Rights Act 1998 (actions at common law and for alleged breaches of statutory duties) were not exclusively within the Investigatory Powers Tribunal’s jurisdiction and were thus not struck out as an abuse of process, notwithstanding the police’s difficulties in presenting its case due to the ‘neither confirm nor deny’ approach to covert sources. However, the common law claims were stayed to await the IPT ruling.

The Court of Appeal has now reviewed the decision of Tugendhat J: [2013] EWCA Civ 1342 (Lord Dyson MR, Maurice Kay and Sharp LJJ). In essence, the Court of Appeal felt the High Court judgment was half right.

The Court rejected the submission that words “personal or other relationship” in s.26(8)(a) of the Regulation of Investigatory Powers Act 2000 formed part of the definition of the type of conduct which could be authorised under s.27 (lawful surveillance) and which, if it was carried out in challengeable circumstances, might be the subject of human rights proceedings before the IPT under s.65. In the plain and ordinary meaning of the words, it included intimate sexual relationships. While some readers of this blog may have had intimate sexual relationships which felt rather impersonal, in general terms it is difficult to see how the Court of Appeal could have concluded otherwise. Parliament clearly intended that human rights proceedings about the establishing of relationships by undercover police officers should only be determined by the IPT: R (A) v Director of Establishments of Security Service [2009] UKSC 12; [2010] 2 AC 1. The IPT had jurisdiction to determine the human rights claims made and was the appropriate forum for their determination.

However, the Court overturned the decision to stay the common law claims (for the torts of deceit, misfeasance in public office, assault and negligence). The legislation gave no priority to the IPT proceedings. It was difficult to see how a decision of the IPT would assist in resolving procedural issues which arose in the court proceedings. The IPT would only issue a summary of its determination and it was difficult to see how that would assist the court. The judge failed to apply the correct test and ask himself whether the respondents had shown that there was a real risk of prejudice to them if the court proceedings took precedence over the IPT proceedings. The respondents could not point to a real risk of injustice if the High Court proceedings continued and certainly not one which outweighed X’s and F’s rights to have their claims heard in open court. The stay was lifted.

The individuals who are understandably aggrieved and distressed by the actions of the undercover officers have a won a partial victory. Given the difficulties the police will have in defending the tort claims in open court without revealing material they do not wish to, the lifting of the stay may well end up being the much more important limb of the decision.

For those interested in the background to this case, see this review from the LRB of a recent book on the activities of officers like Mark Kennedy, which explains in some detail the effect undercover relationships have had on both ‘targets’ and officers.

Christopher Knight

Private Detectives, Estate Agents and Data Protection in the CJEU

Posted on | by Christopher Knight

Belgium has rules on who may act as an estate agent. Mr Englebert (disappointingly, not Humperdink) was such an estate agent. The professional regulatory body of estate agents (the IPI) applied to the local court to have Mr Englebert struck off the list of estate agents, based in large part on information obtained about him from private detectives. The allegations are not recorded in the judgment of the Court of Justice, but one suspects that the underlying facts are not causing Raymond Chandler to turn in his grave in disappointment at the plot he failed to think up.

The domestic court considered the suggestion that requiring the data subject to be informed of the detective’s investigation in advance or, where the data is collected from third parties, at the time of undertaking the recording of the data at issue, would make it impossible for a private detective to carry on his activities under Articles 10 and 11 of the Data Protection Directive (Directive 95/46/EC). The Tribunal de commerce de Charleroi was uncertain whether, by not extending to private detectives the exceptions to the obligation to inform which apply to other professional categories or bodies working in the public interest (under Article 13 of the Directive), the domestic law might give rise to unequal treatment contrary to the Constitution. The Constitutional Court referred to the CJEU the question whether Directive 95/46 is “to be interpreted as meaning that it leaves the Member States free to choose whether or not to provide for an exception to the immediate obligation to inform set out in Article 11(1) if this is necessary in order to protect the rights and freedoms of others”.

In Case C‑473/12 Institut professionnel des agents immobiliers v Englebert (judgement of 7 November 2013) the Third Chamber of the CJEU ruled that Article 13(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that Member States have no obligation, but have the option, to transpose into their national law one or more of the exceptions which it lays down to the obligation to inform data subjects of the processing of their personal data.

The activity of a private detective acting for a professional body in order to investigate breaches of ethics of a regulated profession, in this case that of estate agent, is covered by the exception in Article 13(1)(d) of Directive 95/46 (which provides an exemption in terms for “the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions”).

It is for the Member States to decide whether they consider it necessary to provide, in their legislation for the exception laid down in Article 13(1)(d) of Directive 95/46 in favour of professional bodies such as IPI, acting directly or with the help of private detectives. It is open to them to take the view that those professional bodies and the private detectives acting for them have sufficient means, notwithstanding the application of Articles 10 and 11 of that directive, of detecting the breaches of ethics at issue, so that it is not necessary for that exception to be implemented in order for those bodies to be able to carry out their duty of ensuring compliance with the rules (see at [48]).

The CJEU also confirmed that the rules on access to a regulated profession form part of the rules of professional ethics. It follows that investigations concerning the acts of persons who breach those rules by passing themselves off as estate agents are covered by the exception in Article 13(1)(d) of Directive 95/46 (see at [50]).

The CJEU did not itself answer whether it amounted to unequal treatment for Belgian law not to have applied the Article 13 exemptions to private detectives. The effect of the judgment was that Belgian was entitled – although not obliged – to apply the exemption from the duty to inform under Article 11 to private detectives if it chose to do so.

Christopher Knight

Kennedy in the Supreme Court: News Flash

Posted on | by Christopher Knight

At the close of the first day’s oral argument in Kennedy v The Charity Commission, the Supreme Court indicated that it would be dismissing the first ground of appeal, i.e. on the domestic construction of section 32(2) of FOIA. Reasons for this decision will be given at a later date, but the effect will be that the construction preferred by the Court of Appeal in the first Kennedy appeal ([2011] EWCA Civ 367; [2011] 2 Info LR 152) will stand and that information falling within the scope of section 32(2) does not cease to be absolutely exempt upon the conclusion of the inquiry or arbitration.

The hearing continues on the application, or otherwise, of Article 10 ECHR.