Royal Wills and JR of the Upper Tribunal

Posted on | by Christopher Knight

Mr Brown became a well-known figure in litigation circles when he sought to unseal the Will of Princess Margaret in the belief that it might reveal information showing him to be her illegitimate son. In the course of his unsuccessful litigation, it was revealed that there existed what had been described orally during the court proceedings as a “Practice Direction in respect of the handling of Royal Wills” (although there is dispute over precisely what form this document takes), produced by the-then President of the Family Division following liaison with the Royal Household.

Having failed to unseal the Will, Mr Brown requested a copy of the document from the Attorney General. He was refused, under section 37 FOIA. The First-tier Tribunal upheld that refusal (on which see Robin’s blog here). Mr Brown appealed to the Upper Tribunal on the grounds of inadequacy of the Tribunal’s reasons and a failure to properly apply the public interest test. The Upper Tribunal refused permission at an oral hearing.

Under the revised CPR procedure in rule 54.7A, Mr Brown sought permission to judicially review the refusal of permission to appeal by the Upper Tribunal. Following an oral hearing, Phillips J granted permission. It will now be a matter for the Attorney General (as respondent/defendant in the proceedings) to decide whether to defend the judicial review at a substantive hearing, or simply to defend the substantive appeal in the Upper Tribunal.

For a news report on the decision, see here.

Anya Proops appeared for Mr Brown before the High Court and Upper Tribunal. Jonathan Swift QC and Joanne Clement appeared for the Attorney General. Robin Hopkins appeared for the Commissioner at first instance.

Christopher Knight

Legal analysis of individual’s situation is not their personal data, says Advocate General

Posted on | by Robin Hopkins

YS, M and S were three people who applied for lawful residence in the Netherlands. The latter two had their applications granted, but YS’ was refused. All three wanted to see a minute drafted by an official of the relevant authority in the Netherlands containing internal legal analysis on whether to grant them residence status. They made subject access requests under Dutch data protection law, the relevant provisions of which implement Article 12 of Directive 95/46/EC. They were given some of the contents of the minutes, but the legal analysis was withheld. This was challenged before the Dutch courts. Questions were referred to the CJEU on the application of data protection law to such information. In Joined Cases C‑141/12 and C‑372/12, Advocate General Sharpston has given her opinion, which the CJEU will consider before giving its judgment next year. Here are some important points from the AG’s opinion.

The definition of personal data

The minutes in question contained inter alia: the name, date of birth, nationality, sex, ethnicity, religion and language of the applicant; information about the procedural history; information about declarations made by the applicant and documents submitted; the applicable legal provisions and an assessment of the relevant information in the light of the applicable law.

Apart from the latter – the legal advice – the AG’s view is that this information does come within the meaning of personal data under the Directive. She said this:

“44. In general, ‘personal data’ is a broad concept. The Court has held that the term covers, for example, ‘the name of a person in conjunction with his telephone coordinates or information about his working conditions or hobbies’, his address, his daily work periods, rest periods and corresponding breaks and intervals, monies paid by certain bodies and the recipients, amounts of earned or unearned incomes and assets of natural persons.

45. The actual content of that information appears to be of no consequence as long as it relates to an identified or identifiable natural person. It can be understood to relate to any facts regarding that person’s private life and possibly, where relevant, his professional life (which might involve a more public aspect of that private life). It may be available in written form or be contained in, for example, a sound or image.”

The suggestion in the final paragraph is that the information need not have a substantial bearing on the individual’s privacy in order to constitute their personal data.

The AG also observed that “Directive 95/46 does not establish a right of access to any or every document or file in which personal data are listed or used” (paragraph 71). This resonates with the UK’s long-established Durant ‘notions of assistance’.

Legal analysis is not personal data

AG Sharpston’s view, however, was that the legal analysis of the individuals’ situations did not constitute their personal data. Her reasoning – complete with illustrative examples – is as follows:

“55. I am not convinced that the phrase ‘any information relating to an identified or identifiable natural person’ in Directive 95/46 should be read so widely as to cover all of the communicable content in which factual elements relating to a data subject are embedded.

56. In my opinion, only information relating to facts about an individual can be personal data. Except for the fact that it exists, a legal analysis is not such a fact. Thus, for example, a person’s address is personal data but an analysis of his domicile for legal purposes is not.

57. In that context, I do not find it helpful to distinguish between ‘objective’ facts and ‘subjective’ analysis. Facts can be expressed in different forms, some of which will result from assessing whatever is identifiable. For example, a person’s weight might be expressed objectively in kilos or in subjective terms such as ‘underweight’ or ‘obese’. Thus, I do not exclude the possibility that assessments and opinions may sometimes fall to be classified as data.

58. However, the steps of reasoning by which the conclusion is reached that a person is ‘underweight’ or ‘obese’ are not facts, any more than legal analysis is.”

Interestingly, her conclusion did touch upon the underlying connection between personal data and privacy. At paragraph 60, she observed that “… legal analysis as such does not fall within the sphere of an individual’s right to privacy. There is therefore no reason to assume that that individual is himself uniquely qualified to verify and rectify it and ask that it be erased or blocked. Rather, it is for an independent judicial authority to review the decision for which that legal analysis was prepared.”

In any event, legal analysis does not amount to “processing” for data protection purposes

The AG considered that legal analysis such as this was neither ‘automatic’ nor part of a ‘relevant filing system’. “Rather, it is a process controlled entirely by individual human intervention through which personal data (in so far as they are relevant to the legal analysis) are assessed, classified in legal terms and subjected to the application of the law, and by which a decision is taken on a question of law. Furthermore, that process is neither automatic nor directed at filing data” (paragraph 63).

Entitlement to data, but not in a set form

The AG also says that what matters is that individuals are provided with their data – data controllers are not, under the Directive, required to provide it in any particular form. For example, they can extract or transcribe rather than photocopy the relevant minute:

“74. Directive 95/46 does not require personal data covered by the right of access to be made available in the material form in which they exist or were initially recorded. In that regard, I consider that a Member State has a considerable margin of discretion to determine, based on the individual circumstances in case, the form in which to make personal data accessible.

75. In making that assessment, a Member State should take account of, in particular: (i) the material form(s) in which that information exists and can be made available to the data subject, (ii) the type of personal data and (iii) the objectives of the right of access.”

If the legal analysis is personal data, then the exemptions do not apply

Under the Directive, Article 12 provides the subject access right. Article 13 provides exemptions. The AG’s view was that if, contrary to her opinion, the legal analysis is found to be personal data, then exemptions from the duty to communicate that data would not be available. Of particular interest was her view concerning the exemption under Article 13(1)(g) for the “protection of the data subject or of the rights and freedoms of others”. Her view is that (paragraph 84):

“the protection of rights and freedoms of others (that is, other than the data subject) cannot be read as including rights and freedoms of the authority processing personal data. If a legal analysis is to be categorised as personal data, that must be because it is related to the private interests of an identified or identifiable person. Whilst the public interest in protecting internal advice in order to safeguard the administration’s ability to exercise its functions may indeed compete with the public interest in transparency, access to such advice cannot be restricted on the basis of the first of those two interests, because access covers only what falls within the private interest.”

If the Court agrees with the AG’s view, the case will be an important addition to case law offering guidance on the limits of personal data. It would also appear to limit, at least as regards the exemption outlined above, the data controller’s ability to rely on its own interests or on public interests to refuse subject access requests. That said, there is of course the exemption under Article 9 of the Directive for freedom of expression.

Robin Hopkins @hopkinsrobin

APPGER in the Upper Tribunal

Posted on | by Christopher Knight

The Upper Tribunal has finally handed down its judgment in All Party Parliamentary Group on Extraordinary Rendition v IC & Foreign and Commonwealth Office [2013] UKUT 560 (AAC). It is a judgment of Charles and Burnett JJ and Judge Wikeley. The appeal was from an FTT judgment which is analysed in detail by Rachel Kamm here. That post also contains the background to the case. In essence, the request was made by the APPGER for information relating to the participation of the UK in the practice of extraordinary rendition. The judgment is long, and will be blogged on in more detail in due course. But in brief, there were five broad grounds of appeal:

1) That the FTT erred in its approach to Article 10 ECHR;

2) That the FTT erred in its construction of section 23(1) FOIA (information relating to a security body);

3) That the FTT failed to provide adequate reasons for its conclusions on section 23(1);

4) That the FTT erred in its approach to the control principle (put simply, that information acquired through diplomatic or security channels is not disclosed without consent) and so failed to carry out the balancing process correctly under section 27 FOIA (international relations);

5) That the FTT erred in its approach to the section 35(1)(a) FOIA exemption (formulation and development of policy).

Grounds 1 and 2 have not been decided. They are stayed pending the judgment of the Supreme Court in Kennedy v Charity Commission (see here).

The Upper Tribunal rejected grounds 3 and 5. They held that the reasons provided by the FTT were sufficient when read as a whole, and that their approach to section 35(1)(a) had been in accordance with the authorities.

The bulk of the judgment concerns ground 4, and the appeal on section 27. The Upper Tribunal held that the APPGER had been rendered ignorant of the FCO’s primary case on the relevant harm caused by disclosure, and that the FCO, the ICO and the FTT had failed to identify or explain this in open session: at [89]-[90]. There was no good reason for this failure, and it resulted in avoidance substantive and procedural unfairness: at [95]-[96]. The failure of the FTT to hold a further hearing or allow further submissions to be made to consider alterations made to the draft judgment at the behest of the FCO was an error of law which perpetuated unfairness: at [113].

Although obiter, the Tribunal also concluded that the FTT’s approach meant that it did not properly understand the underlying reasoning of the arguments advanced and its conclusions did not have a proper evidential and reasoned foundation under section 27: at [118].

The Upper Tribunal also made general observations on the nature of closed sessions; the need for cases advanced in closed to be identified with clarity; the need to make a record of closed sessions; the need to identify in open the competing public interests wherever possible; and the need to limit material adduced only in closed session, along with the utility of schedules identifying the issues: at [144]-[156].

There is much to be taken from the Upper Tribunal decision, and of course the APPGER litigation is some way off being over. Further analysis will doubtless be forthcoming, but you can read the judgment here:

GIA 2230 2012 Upper Tribunal decision

Tim Pitt-Payne QC and Joanne Clement (11KBW) acted pro bono to represent APPGER; Robin Hopkins (11KBW) acted for the Information Commissioner; and Karen Steyn (also of 11KBW) and Julian Blake represented the FCO.

Christopher Knight

The Upper Tribunal’s first consideration of monetary penalty notices

Posted on | by Julian Milford

The Upper Tribunal has just issued judgment in Central London Community Healthcare NHS Trust v Information Commissioner [2013] UKUT 0551. This significant decision is the first time the Upper Tribunal has considered an appeal against a monetary penalty notice (“MPN”), issued by the Commissioner under section 55A Data Protection Act 1998 (“DPA”).

The Commissioner is empowered to issue an MPN under section 55A DPA, where he is satisfied that there has been a serious contravention of the data protection principles by a data controller, the contravention was of a kind likely to cause substantial damage or distress, and other relevant conditions are met. The amount of an MPN may be up to £500,000. In this case, the Trust had repeatedly faxed sensitive medical details of patients to a member of the public by mistake, believing that it was faxing them to a hospice. The Trust had “self-reported” its own contravention to the Commissioner, who had issued an MPN of £90,000.

The Trust appealed against the MPN under section 49 DPA, first to the First-Tier Tribunal, which rejected the appeal, and then to the Upper Tribunal. The grounds of appeal were fourfold: (1) the Commissioner failed to recognise he had a discretion as to whether to issue a MPN, and failed to consider how it should be exercised; (2) the Tribunal should have concluded that the Commissioner was barred from serving an MPN, because the Trust had self-reported its breach; (3) the Commissioner had acted unlawfully in offering the Trust a discount of £18,000 for early payment of the MPN, but refusing to allow the Trust to benefit from the discount if it decided to appeal; and (4) the quantum of the award was unsustainably high.

The Upper Tribunal rejected all four grounds of appeal. Along the way, it made some useful general observations about the way in which the MPN regime works. In particular, it stated as follows:

(1)    The fact that a public authority has self-reported a breach does not prevent the Commissioner from issuing an MPN. Among other matters, the logical implication of that argument would be that a data controller responsible for a deliberate and very serious breach of the DPA could avoid an MPN simply by self-reporting. That could not be correct.

(2)    As a matter of principle, the Commissioner has discretion whether to issue an MPN where the statutory conditions for its issue are met, as well as discretion as to the amount. On appeal, the First-Tier Tribunal (“FTT”) must conduct a full merits review of the Commissioner’s exercise of his discretion. The nature of the FTT’s jurisdiction on an appeal under section 49 DPA was akin to the nature of its jurisdiction in an appeal against a decision notice of the Commissioner under section 58 Freedom of Information Act 2000 (“FOIA”). In other words, the FTT’s function under section 49 DPA was to decide whether the Commissioner’s decision to issue an MPN and the amount of the penalty was right.

(3)    It was permissible for the Commissioner to operate a scheme which gave a discount for early payment, if and only if the public authority did not appeal. There was a strong public policy argument justifying such a scheme – the early payment and early resolution of the issue. The proper analogy was with discount schemes operated for fixed penalty notices e.g. for minor motoring contraventions.

(4)    The Upper Tribunal did in principle have the power to increase a penalty under section 55A DPA, although that issue did not arise on the facts of this case.

The decision is an important validation of the way in which the Commissioner presently approaches the issuance of MPNs, and usefully clarifies the nature of appeals against MPNs.

Timothy Pitt-Payne QC of 11KBW acted for the Trust; Anya Proops of 11KBW acted for the Commissioner.

Julian Milford 

Confidentiality of medical information after patient’s death: two new Upper Tribunal decisions

Posted on | by Robin Hopkins

The absolute exemption at section 41 extends to information obtained by the public authority the disclosure of which would give to an actionable breach of confidence. Does the obligation of confidence survive the death of the confider? If so, would a breach of that obligation be actionable, even if it is not clear exactly who could bring such an action? These issues arise most notably in the context of medical records. The Upper Tribunal has had something to say on this in two recent decisions.

In Webber v IC and Nottinghamshire Healthcare NHS Trust (GIA/4090/2012), the appellant had made a FOIA request for information (including hospital records) about the death of her son in 1999 when he was compulsorily resident at Rampton hospital. This was refused on section 41 grounds. The Commissioner upheld the refusal, as did the First-Tier Tribunal. In doing so, it somewhat unusually did not see the withheld information for itself, since it had not been asked to by anyone.

Mrs Webber’s appeal to the Upper Tribunal has also been dismissed. Judge Williams considered that the Tribunal could not be faulted for not differentiating between different categories of withheld information (which it obviously could not do, as it had not seen the information): “it is the task of the tribunal to decide the case before it unless it sees reason to investigate further” (paragraph 30).

He also confirmed the well-established principle that what matters under FOIA is information rather than documents: though the records were created by the NHS Trust, the information contained in those records came from the patient. In the section 41 context, “obtained” simply means “come to have”, which can be active or passive (paragraph 38).

Judge Williams confirmed a further touchstone of FOIA, namely that whatever the particular interests of the requester, this “remained an application to put the information into the public domain” (paragraph 37), that being the effect of disclosure under FOIA.

Disclosure would entail a breach of confidence which was actionable after the patient’s death, notwithstanding the argument that, in this case, the only person who could sue would be the personal representative (who was likely to have been the requester: thus it was submitted that she would in effect have been suing herself).

Judge Williams also found that there would not have been a public interest defence to the breach of confidence. Here he gave weight to the fact that some of the information sought would or could come into the public domain or be obtained in another way: a coroners’ inquest, or through an application under the Access to Health Records Act 1990 (now largely supplanted by FOIA, but not as regards deceased persons) which allows for requests for access to information to be made by (inter alia) patients’ personal representatives. Such an application was outside the Upper Tribunal’s jurisdiction but it was “relevant to note that it exists as a specific if limited remedy for some aspects of the application made for the appellant in this case” (see paragraphs 23-24).

In M v IC and Medicines and Health Products Regulatory Authority (GIA/3017/2010), Upper Tribunal Judge Lloyd-Davies allowed the requester’s appeal for information in a report held by the public information concerning a pharmaceutical trial of a drug developed by Pfizer. That information had again been withheld under section 41, with the Commissioner and First-Tier Tribunal agreeing – regardless of whether the participants in the trial were dead or alive at the time of the request.

The appeal was allowed because of a procedural error – the Tribunal had authorised more extensive redactions than were in fact being put to it.

The remitted hearing is to include questions of identifiability of patients in the context of anonymised drug trial data. The line of authorities on statistical information (Common Services Agency, Department of Health) will no doubt be considered.

The decision contained this obiter observation on actionable breaches of confidence in the case of deceased patients: “where the confidence arises in the context of a patient/healthcare professional relationship, I am minded to conclude that the obiter observations of Mr Justice Foskett in R (Lewis) v Secretary of State for Health [2008] EWHC 2196 (QB) are correct”.

I acted for the Commissioner in the M case; my colleague Joe Barrett acted for the appellant in Webber.

Robin Hopkins @hopkinsrobin

Sex in the IPT

Posted on | by Christopher Knight

As with all the best headlines, this one is slightly misleading. Readers can scarcely fail to have noticed the coverage surrounding the major ongoing case regarding a former undercover (under-the-covers?) police officer, Mark Kennedy, who (together with others) infiltrated political and environmental activists over a period of years. Claims were commenced in the High Court, with part of the conduct complained of involving ensuing sexual relations between activists/their partners and undercover officers.

Earlier this year, AJA and others v Commissioner of Police for the Metropolis [2013] EWHC 32 (QB) saw part of the claims struck out. The Court held that the Investigatory Powers Tribunal had exclusive jurisdiction over the claims under the Human Rights Act 1998; it struck out these parts accordingly. It observed that conduct breaching Article 3 (inhuman and degrading treatment) – which included the claims relating to sexual activity – could not be authorised under RIPA, but conduct breaching Article 8 (privacy) could be authorised. Sexual activity with undercover officers did not necessarily engage Article 3.

Those parts of the claims which did not concern the Human Rights Act 1998 (actions at common law and for alleged breaches of statutory duties) were not exclusively within the Investigatory Powers Tribunal’s jurisdiction and were thus not struck out as an abuse of process, notwithstanding the police’s difficulties in presenting its case due to the ‘neither confirm nor deny’ approach to covert sources. However, the common law claims were stayed to await the IPT ruling.

The Court of Appeal has now reviewed the decision of Tugendhat J: [2013] EWCA Civ 1342 (Lord Dyson MR, Maurice Kay and Sharp LJJ). In essence, the Court of Appeal felt the High Court judgment was half right.

The Court rejected the submission that words “personal or other relationship” in s.26(8)(a) of the Regulation of Investigatory Powers Act 2000 formed part of the definition of the type of conduct which could be authorised under s.27 (lawful surveillance) and which, if it was carried out in challengeable circumstances, might be the subject of human rights proceedings before the IPT under s.65. In the plain and ordinary meaning of the words, it included intimate sexual relationships. While some readers of this blog may have had intimate sexual relationships which felt rather impersonal, in general terms it is difficult to see how the Court of Appeal could have concluded otherwise. Parliament clearly intended that human rights proceedings about the establishing of relationships by undercover police officers should only be determined by the IPT: R (A) v Director of Establishments of Security Service [2009] UKSC 12; [2010] 2 AC 1. The IPT had jurisdiction to determine the human rights claims made and was the appropriate forum for their determination.

However, the Court overturned the decision to stay the common law claims (for the torts of deceit, misfeasance in public office, assault and negligence). The legislation gave no priority to the IPT proceedings. It was difficult to see how a decision of the IPT would assist in resolving procedural issues which arose in the court proceedings. The IPT would only issue a summary of its determination and it was difficult to see how that would assist the court. The judge failed to apply the correct test and ask himself whether the respondents had shown that there was a real risk of prejudice to them if the court proceedings took precedence over the IPT proceedings. The respondents could not point to a real risk of injustice if the High Court proceedings continued and certainly not one which outweighed X’s and F’s rights to have their claims heard in open court. The stay was lifted.

The individuals who are understandably aggrieved and distressed by the actions of the undercover officers have a won a partial victory. Given the difficulties the police will have in defending the tort claims in open court without revealing material they do not wish to, the lifting of the stay may well end up being the much more important limb of the decision.

For those interested in the background to this case, see this review from the LRB of a recent book on the activities of officers like Mark Kennedy, which explains in some detail the effect undercover relationships have had on both ‘targets’ and officers.

Christopher Knight