PRISM and TEMPORA: ECtHR proceedings issued against UK

Posted on | by Robin Hopkins

Panopticon reported in July that Privacy International had commenced proceedings in the Investigatory Powers Tribunal against the UK intelligence and security agencies concerning PRISM and TEMPORA.

Big Brother Watch, the Open Rights Group, English PEN and Dr Constance Kurz announced yesterday that they have issued proceedings on the same issues – this time in the European Court of Human Rights. They have also published their pleadings and expert evidence (see the bottom of this page). To quote from their pleadings, they challenge on Article 8 ECHR grounds:

(a)    The soliciting or receipt and use by the UK intelligence services (“UKIS”), of data obtained from foreign intelligence partners, in particular the US National Security Agency’s “PRISM” and “UPSTREAM” programmes; and

(b)   The acquisition of worldwide and domestic communications by the Government Communications Head Quarters (“GCHQ”) for use by UKIS and other UK and foreign agencies through the interception, under global and rolling warrants, of electronic data transmitted on transatlantic fibre-optic cables (the “TEMPORA” programme).

The claim is put in summary terms as follows (again, quoting from the pleadings):

(1) In relation to receipt of foreign intercept material—i.e. the receipt, use, retention and dissemination of information received by UKIS from foreign intelligence partners which have themselves obtained it by communications intercept—the legal framework [including RIPA 2000] is inadequate to comply with the “in accordance with the law” requirement under Article 8(2).

(2) In relation to GCHQ’s own generic interception capability, the provisions contained in RIPA relating to external communications warrants allow UKIS to obtain general warrants permitting indiscriminate capturing of vast amounts of communication, effectively on an indefinite basis. The legal provisions which permit generic warrants in relation to such external communications are insufficiently protective to provide an ascertainable check against arbitrary use of secret and intrusive state power.

(3) Such legal provisions do not enable persons to foresee the general circumstances in which external communications may be the subject of surveillance (other than that any use may be made of communications if considered in the interests of national security—a concept of very broad scope in UK law); they do not require authorisations to be granted in relation to specific categories of persons or premises; they permit indiscriminate capture of communications data by reference only to its means of transmission; and they impose no significant restrictions on the access that foreign intelligence partners may have to such intercepted material. In short, there are no defined limits on the scope of discretion conferred on the competent authorities or the manner of its exercise. Moreover, there is no adequate degree of independent or democratic oversight. Indiscriminate and generic interception and the legal provisions under which it is carried out thereby breach the requirements that interferences with Article 8 must be “in accordance with the law” and must be proportionate.

To quote the briefing note, the applicants “are asking the Court to declare that the UK’s internet surveillance practices are disproportionate and that the legislation intended to protect the public’s rights to privacy in this context is not fit for purpose”.

In other words, this is challenge not only to specific actions, but to the UK’s regulatory regime for surveillance more broadly. The applicants also draw attention (pleadings, paragraph 121.7) to the fact that the Data Protection Act 1998 is powerless to protect personal data in this context, given the exemption for national security at s. 28 of that Act.

Robin Hopkins

Refusal to destroy part of a ‘life story’ justified under Article 8(2) ECHR

Posted on | by Robin Hopkins

The High Court of Justice (Northern Ireland) has today given judgment In the matter of JR60’s application for judicial review [2013] NIQB 93. The applicant sought to challenge the right of the two Social Care Trusts to keep and use various records generated when she was a resident of children’s homes and a training school between the years 1978-1991.

In most cases of challenges to the retention of records, the applicant seeks to expunge information which suggests they have done wrong. This application is interesting because it focused (though not exclusively) on what the applicant had suffered, as opposed to what she had done. In short, she wished to erase from the record a part of her life story which was painful for her to recall. The application failed: there were weightier reasons for retaining those records, and in any event whatever her current wish to forget matters of such import, she might come to change her mind.

The applicant was described as having had a very difficult childhood, to which those records relate. It was not known who her father was. She had grown up to achieve impressive qualifications. Horner J described her as having “survived the most adverse conditions imaginable and triumphed through the force of her will. By any objective measurement she is a success”.

She wished to move on, and to have the records about her childhood expunged. The Trusts refused; their policy was to retain such information for a 75-year period. The applicant challenged this refusal on Article 8 ECHR grounds. Horner J readily agreed that the retention of such information interfered with her rights under Article 8, but dismissed her application on the grounds that the interference was justified.

The applicant had argued that (i) she did not intend to make any claim for ill-treatment or abuse while she was in care, (ii) she did not want to retrieve information about her life story, (iii) she did not want the records to be used to carry out checks on her, as persons who were not in care would not be burdened by such records in respect of their early lives, and (iv) she did not want others, including her own child, to be able to access these records.

In response to the applicant’s assertion that she did not want and did not envisage wanting access to her records, Horner J said this at paragraph 19:

“Even if the applicant does not want to know at present what is in her records, it does not follow that she may not want to find out in the future what they contain for all sorts of reasons. She may, following the birth of a grandchild, be interested in her personal history for that grandchild’s sake. She may want to find out about her genetic inheritance because she may discover, for example, that she, or her off-spring, is genetically predisposed to a certain illness whether mental or physical. She may want to know whether or not this has been passed down through her mother’s side or her father’s side. There may be other reasons about which it is unnecessary to speculate that will make her want to seek out her lost siblings. There are any number of reasons why she may change her mind in the future about accessing her care records. Of course, if the records are destroyed then the opportunity to consider them is lost forever.”

The Trusts argued that they needed to retain such records for the purposes of their own accountability, any background checks on the applicant or related individuals which may become necessary, for the purposes of (hypothetical) public interest issues such as inquiries, and for responding to subject access requests under the Data Protection Act 1998. Horner J observed that the “right for an individual to be able to establish details of his or her identity applies not just to the Looked After Child but also, inter alia, to that child’s offspring”.

In the circumstances, the application failed; the Trusts’ interference with the applicant’s Article 8 rights was justified.

Horner J added a short concluding observation about the DPA (paragraph 29):

“It is significant that no challenge has been made to the Trust’s storage of personal information of the applicant on the basis that such storage constitutes a breach of the Data Protection Act 1998. This act strengthens the safeguards under the 1984 Act which it replaced. The Act protects “personal data which is data relating to a living individual who can be identified from data whether taken alone or read with other information which is the possession (or is likely to come into possession) of the data controller: see 12-63 of Clayton and Tomlinson on The Law of Human Rights (2nd Edition). It will be noted that “personal” has been interpreted as almost meaning the same as “private”: see Durant v Financial Services Authority [2004] FSR 28 at paragraph [4].”

Robin Hopkins

Post-summer round up

Posted on | by Anya Proops KC

It has been a relatively quiet summer on the information law front. However, this has very much been the calm before the storm. Important up-coming hearings include not least:

–       Kennedy in the Supreme Court (application of the Article 10 right to freedom of expression in the context of FOIA; previously discussed on Panopticon here, here and here): hearing listed for 29-31 October;

–       T v Secretary of State for the Home Department in the Supreme Court (whether CRB disclosure regime is compatible with Article 8; Court of Appeal judgment previously discussed on Panopticon here): hearing listed for 9-10 December;

–       Edem v Information Commissioner & FSA in the Court of Appeal (appeal against Upper Tribunal FOIA decision that information comprising an individual’s name taken together with information as to their role within an organisation constitutes ‘personal data’, such that it may fall within the scope of s. 40 FOIA): hearing listed for 14 November;

 –       Central London Community Healthcare NHS Trust v Information Commissioner in the Upper Tribunal (appeal against the first ever tribunal decision on the imposition of a monetary penalty notice by the Information Commissioner under the DPA; see previous post on this case here): hearing listed for 16 and 17 October;

–       East Sussex County Council v Information Commissioner & Anor in the First-Tier Tribunal: hearing listed for 12-13 November 2013. The case in question is the fourth case to come before the tribunal concerning the imposition of charges by local authorities under the EIR for the provision of property search information – see further the tribunal decisions in East Riding of Yorkshire Council v IC, Kirklees Council v IC and Leeds City Council v IC. In the Leeds case, the Tribunal held that the relatively substantial charges which the Council had sought to impose were impermissible under the EIR. In reaching this conclusion, the Tribunal held that, under r. 8 EIR, a public authority was entitled to impose charges only in respect of the costs of transmitting the information to the applicant and was not entitled to charge for other costs such as the costs of searching for, retrieving and redacting the information. The Tribunal held that this conclusion was in keeping with the conclusions which had been reached by the ECJ in Commission v Germany (Case C-217/97) (the decision is discussed in more detail here). In East Sussex, both the Council and the Commissioner will be inviting the Tribunal to refer to the CJEU the question of the scope of a public authority’s power to charge applicants for environmental information, having regard to the relevant provisions in the Directive.

And in other news…

–       This week the First Tier Tribunal heard the first ever appeal against the imposition of a monetary penalty notice under the Privacy and Electronic Communications Regulations 2003. The appeal was brought by Tetrus Telecoms and concerned the sending of unsolicited text messages. You can read the relevant MPN here. A second set of appeals is due to be heard later on this year, this time concerning Nationwide Energy Services and We Claim U Gain Limited. It concerns the sending of unsolicited telephone calls (see the relevant MPN here). It will be interesting to see whether the Tribunal calibrates its approach depending on the type of communication in issue.

11KBW heavily dominates in all of the above cases. No doubt they will all be subject to further comment on Panopticon in due course.

Anya Proops

11KBW triumphs in the Directories

Posted on | by Panopticon Blog

We are thrilled to report that 11KBW has been chosen by the Legal 500 as the leading chambers in the field of data protection. Comments include in the directory: the ‘set of choice’ for data protection matters; ‘high-quality, value-for-money’ service is ‘a standout feature’ of the ‘knowledgeable and responsive’ team, which is also noted for its ‘excellence in the area of information rights cases’. 11KBW’s Timothy Pitt-Payne QC and Anya Proops are listed respectively as the pre-eminent Silk and Leading Junior in this area. Ben Hooper is also listed as a Leading Junior. Other members of Chambers singled out for praise for their data protection work include Jonathan Swift QC, Akhlaq Choudhury, Karen Steyn and Robin Hopkins – see the listing here. 11KBW has also this week won both the Chambers & Partners Human Rights & Public Law set of the year and the Legal 500 Employment set of the year – see here and here. Many thanks to all those of our readers who have supported us over the years and helped us to reach these heady heights.

Public Authorities under the EIR – Fishing for an Answer from the AG

Posted on | by Christopher Knight

Panopticon is fairly sure that it can imagine the breakfast table dialogue in most right-thinking households this morning. Namely:

“Who owes obligations under the Environmental Information Regulations 2004? Public authorities: regulation 2.

Who is a public authority? Erm, well, not water companies: Smartsource v IC and a Group of 19 additional water companies [2010] UKUT 415 (AAC).

Are we sure? No and it has been necessary to refer the question to the Court of Justice of the EU to find out: Fish Legal v IC [2012] UKUT 177 (AAC) (again about water companies).

What have the CJEU got to do with the price of fish (legal)? Because the EIR implements Directive 2003/4/EC and so the correct interpretation is a matter on which definitive guidance can be sought from Luxembourg.

And what does the CJEU think? We don’t know yet, but we are a bit closer after Advocate General Villalon delivered the AG’s Opinion in the case yesterday: see Case C-279/12 Fish Legal v Information Commissioner, Opinion of 5 September 2013.

So what does the AG say? The test is posed along the following lines. It is for the national court to establish whether the water companies concerned may impose on individuals obligations for which they did not require the consent of those individuals, with the result that the companies concerned were in a position substantially equivalent to that of the administrative authorities. An individual was under the control of a body if his actions were subject to a degree of control exercised by that body or person which prevented him from acting with real autonomy in private affairs, thereby reducing him to the status of an instrument of the will of the State. Bodies or persons who also performed other, completely separate, non-public activities were not under an obligation to provide the information which they obtained in relation to those activities. [This sounds a bit like hybrid public authorities under s.6 of the Human Rights Act 1998, which has caused no difficulties in application at all. Ahem.] If in doubt, they should have to disclose the information.

And will the CJEU adopt this test? Wait and see. But usually the AG’s Opinion forms a key part of the Court’s analysis. So it is a good pointer, even if not the definitive answer.

And will the judgment, when it comes, tell us whether privatised water companies are public authorities? Probably not. That will almost certainly be left to the Upper Tribunal to decide in the light of the CJEU’s Delphic pronouncements.”

Doubtless there will be plenty more litigation to come, not to mention the cases stayed pending Fish Legal, and Panopticon will bring you the CJEU judgment when it appears.

11KBW’s Anya Proops appeared for the Commissioner in the CJEU, and Rachel Kamm did the same before the Upper Tribunal.

Christopher Knight

Penalty shoot out – tribunal decision in scottish borders council appeal

Posted on | by Anya Proops KC

The First-Tier Tribunal has today issued its decision in the Scottish Borders Council monetary penalty notice case – the decision can be found on the tribunal’s website here (11KBW’s Robin Hopkins acted for the ICO). The background to the case is that the ICO had issued SBC with a monetary penalty notice requiring it to pay a penalty of £250,000. The penalty was issued in circumstances where a data processor, appointed by SBC to digitise its pension records, had ended up placing the hard copies of the records in the post box bins at Tesco and another supermarket. In total about 1,600 files had been disposed of in this way. SBC appealed against the imposition of the penalty to the Information Tribunal. The Tribunal held that the penalty was unlawful and, indeed, that the Commissioner had no power to issue a penalty under s. 55A DPA. This was because, whilst SBC had seriously contravened the DPA, the facts and circumstances of the case were such that the contravention was not of a kind likely to cause substantial damage or distress. Thus, an essential precondition for the engagement of the Commissioner’s power to issue a penalty under s. 55A had not been met. I am reluctant to comment further on this decision as I am shortly to be appearing against Timothy Pitt-Payne QC in the first ever appeal to the Upper Tribunal on the application of the monetary penalty regime (Central London Community Healthcare Trust NHS v IC). However, doubtless one of my colleagues will in due course provide illuminating analysis of this important decision.

Anya Proops