Damages under section 13 DPA: Court of Appeal’s judgment in Halliday

Posted on | by Robin Hopkins

I blogged a while ago about the ex tempore judgment from the Court of Appeal in a potentially groundbreaking case on damages under section 13 of the DPA, namely Halliday v Creation Consumer Finance [2013] EWCA Civ 333. The point of potential importance was that ‘nominal damages’ appeared to suffice for the purposes of section 13(1), thereby opening up section 13(2). In short, the point is that claimants under the DPA cannot be compensated for distress unless they have also suffered financial harm. A ‘nominal damages’ approach to the concept of financial harm threatened to make the DPA’s compensation regime dramatically more claimant-friendly.

The Court of Appeal’s full judgment is now available. As pointed out on Jon Baines’ blog, ground has not been broken: the ‘nominal damages’ point was a concession by the defendant rather than a determination by the Court. See paragraph 3 of the judgment of Lady Justice Arden:

“… this issue, which was the main issue of the proposed appeal to this court, is now academic as the respondent, CCF, concedes an award of nominal damages is “damage” for the purposes of the Directive and for the purposes of section 13(2) of the Data Protection Act 1998.”

Other potentially important points have also fallen somewhat flat. The question of whether UK law provided an adequate remedy for a breach of a right conferred by a European Directive fell away on the facts (“proof fell short in relation to the question of damage to reputation and credit”), while the provision for sanctions under Article 24 of Directive 95/46/EC was neither directly enforceable to Mr Halliday nor of assistance to him.

Still, the judgment is not without its notable points.

One is the recognition that compensation for harm suffered is a distinct matter from penalties for wrongdoing; the former is a matter for the courts in the DPA context, the latter a matter for the Information Commissioner and his monetary penalty powers. Such was the implication of paragraph 11:

“… it is not the function of the civil court, unless specifically provided for, to impose sanctions. That is done in other parts of the judicial system.”

Another point worth noting is Lady Justice Arden’s analysis of distress and the causation thereof. The distress must be caused by the breach, not by other factors such as (in this case) a failure to comply with a court order. See paragraph 20:

“Focusing on subsection (2), it is clear that the claimant has to be an individual, that he has to have suffered distress, and that the distress has to have been caused by contravention by a data controller of any of the requirements of the Act. In other words, this is a remedy which is not for distress at large but only for contravention of the data processing requirements. It also has to be distress suffered by the complainant and therefore would not include distress suffered by family members unless it was also suffered by him. When I say that it has to be caused by breach of the requirements of the Act, the distress which I accept Mr Halliday would have felt at the non-compliance of the order is not, at least directly, relevant because that is not distress by reason of the contravention by a data controller of the requirements of this Act. If the sole cause of the distress had been non-compliance with a court order, then that would have lain outside the Act unless it could be shown that it was in substance about the non-compliance with the Data Protection Act.”

The claimant had sought to draw an analogy with guidelines and banding for discrimination awards as set by Vento v Chief Constable of West Yorkshire Police [2013] 1 ICR 31. The Court of Appeal was not attracted. See paragraph 26:

“In answer to that point, the field of discrimination is, it seems to me, not a helpful guide for the purposes of data protection. Discrimination is generally accompanied by loss of equality of opportunity with far-reaching effects and is liable to cause distinct and well-known distress to the complainant.”

Finally, Lady Justice Arden commented as follows concerning the level of the compensation to be awarded on the facts of this case: “in my judgment the sum to be awarded should be of a relatively modest nature since it is not the intention of the legislation to produce some kind of substantial award. It is intended to be compensation, and thus I would consider it sufficient to render an award in the sum of £750” (paragraph 36).

Lord Justice Lloyd (who, along with Mr Justice Ryder agreed with Lady Justice Arden) did pause to think about a submission on this question ‘if you were so distressed, why did you not complain immediately?’, but concluded that (paragraph 47):

“I confess that I was somewhat impressed at one point by Mr Capon’s submission that it was a surprise, if Mr Halliday was so distressed by this contravention, that he did not immediately protest upon discovering, in response to his first credit reference enquiry, the fact of the contravention, and indeed he did not protest until about a month after the second report had been obtained. But I bear in mind, in response to that, Mr Halliday’s comment that he had had such difficulty in getting any sensible response, or indeed any response, out of CCF at the earlier stage, that it is perhaps less surprising that he did not immediately protest. In any event, the period in question is not a very lengthy one between his discovery of the contravention by his first reference request and his taking action in July. Accordingly, it does not seem to me that that is a matter that should be taken to reduce my assessment of the degree of distress that he suffered.”

Robin Hopkins

Information rights: proposed legislative changes and more

Posted on | by Robin Hopkins

Earlier this week, James Goudie QC blogged on the Intellectual Property Bill’s amendment to FOIA, introducing a new qualified exemption (section 22A) for continuing programmes of research intended for future publication. On the issue of research – which featured prominently in submissions from the university sector during FOIA’s post-legislative scrutiny health-check – this would bring FOIA into line with its Scottish counterpart. For an informative discussion of this topic, see this post from Kit Good.

Interestingly, that post refers to an ICO decision notice (FS50163282 of 29 March 2010) about “tree ring” data, a method used to analyse wood from archaeological sites to determine past climates. The ICO found that Queen’s University Belfast was not entitled to rely on (among other exceptions) regulations 12(4)(d) of the EIRs (material which is still in the course of completion, unfinished documents or incomplete data). As it happens, the Tribunal has today issued a decision concerned with tree ring data in a university research context: McIntyre v IC and UEA, EA/2012/0156. The Tribunal noted the ICO’s note of caution concerning ever-evolving research data: “this argument should not be used to withhold tree-ring chronologies endlessly, by arguing that they are always a ‘work in progress’”. However, on the facts of the case the Tribunal upheld UEA’s reliance on regulation 12(4)(d), as supported by the ICO.

This has not been FOIA’s only outing in Parliament this week. An early day motion was tabled on Tuesday of this week expressing concern at the Government’s proposal to make cost restrictions more public authority-friendly. The motion is worded as follows:

“That this House notes that the Government is proposing to make it easier for public authorities to refuse Freedom of Information requests on cost grounds in order to prevent disproportionate use of the Freedom of Information Act 2000 by some requesters; expresses concern that requests by those making moderate use of the legislation will also be more easily refused under the proposals; is particularly concerned at the proposal that the time which authorities spend considering whether to release information should be taken into account when calculating whether the cost limit has been reached; further notes that this proposal was expressly rejected by the Justice Committee in its post-legislative review of the Act; believes that this proposal will penalise requests raising new or complex issues which will inevitably require substantial time to consider; observes that the Government’s objective will in any case be achieved following recent decisions of an Upper Tribunal that requests which involve a disproportionate, manifestly unjustified, inappropriate or improper use of the Act can be refused as vexatious; and calls on the Government not to proceed with its proposals.”

The motion’s primary sponsor is Richard Shepherd. At present, there are 12 signatories. Maurice Frankel of the Campaign for FOI is urging more MPs to take up the cause.

Turning from FOIA to information rights concerns of a data protection variety, the Care Bill was introduced in the House of Lords last week. Notably, it contains an express provision making the provision of “false or misleading information” an offence (subject of course to the statutory definitions being met). Clause 81 provides as follows:

(1) A care provider of a specified description commits an offence if—

(a) it supplies, publishes or otherwise makes available information of a specified description,

(b) the supply, publication or making available by other means of information of that description is required under an enactment or other legal obligation, and

(c) the information is false or misleading in a material respect.

The aims of this clause are not confined to matters affecting personal privacy – indeed, the explanatory document suggests it is confined to ‘management information’. There may, however, be some crossover with information on individual cases, particularly in ‘low cell count’ cases where individuals could be identified from higher-level data. The Data Protection 1998 does not use the language of “misleading” – focusing instead on inaccuracy and fairness. There are often DPA-related grievances, however, in which “misleading” is an excellent summary of the data subject’s concern.

Robin Hopkins

Thirteen deadly sins: new ICO guidance on vexatious requests

Posted on | by Robin Hopkins

On Wednesday, the ICO launched its new guidance on section 14 (vexatious requests) on Wednesday. This follows the Upper Tribunal’s recent decisions on this exemption (Panopticon passim), as well as decisions such as Salford City Council v IC and TieKey Accounts (EA/2012/0047) concerning reliance on section 14 to avoid incurring unreasonable cost burdens.

The ICO’s long-standing 5 indicators are supplanted by a new list of 13 indicators – though the emphasis remains on their not being intended as pseudo-statutory tests (and thus they are not really ‘deadly sins’). The thirteen indicators are (in no particular order):

abusive or aggressive language; burden on the authority; personal grudges; unreasonable persistence; unfounded accusations; intransigence; frequent or overlapping requests; deliberate intention to cause annoyance; scattergun approach; disproportionate effort; no obvious intent to obtain information; futile requests; frivolous requests.

The guidance addresses such topics as round robins, fishing expeditions and requesters acting in concert/as part of a campaign, all of which arise frequently for consideration by public authorities. There is also a section on “recommended actions before making a final decision” (paragraphs 93-97) which public authorities would be wise to consider with an eye on complaints to the ICO from dissatisfied recipients of section 14 notices.

For discussions of the new guidance, see these blog posts from the ICO’s Deputy Commissioner, Graham Smith, and also from FOI Man.

Robin Hopkins

Google: autocomplete and the frontiers of privacy

Posted on | by Robin Hopkins

Unsurprisingly, the frontiers of privacy and data protection law are often explored and extended by reference to what Google does. Panopticon has, for example, covered disputes over Google Street View (on which a US lawsuit was settled in recent months), Google’s status as a ‘publisher’ of blogs containing allegedly defamatory material (see Tamiz v Google [2013] EWCA Civ 68) and its responsibility for search results directing users to allegedly inaccurate or out-of-date personal data (see Google Spain v Agencia Espanola de Proteccion de Datos (application C-131/12), in which judgment is due in the coming months).

A recent decision of a German appellate court appears to have extended the frontiers further. The case (BGH, VI ZR 269/12 of 14th May 2013) concerned Google’s ‘autocomplete’ function. When the complainants’ names were typed into Google’s search bar, the autocomplete function added the ensuing words “Scientology” and “fraud”. This was not because there was lots of content linking that individual with those terms. Rather, it was because these were the terms other Google users had most frequently searched for in conjunction with that person’s name. This was due to rumours the truth or accuracy of which the complainants denied. They complained that the continuing association of their names with these terms infringed their rights to personality and reputation as protected by German law (Articles 823(1) and 1004 of the German Civil Code).

In the Google Spain case, Google has said that the responsibility lies with the generators of the content, not with the search engine which offers users that content. In the recent German case, Google has argued in a similar vein that the autocomplete suggestions are down to what other users have searched for, not what Google says or does.

In allowing the complainants’ appeals, the Federal Court of Justice in Karlsruhe has disagreed with Google. The result is that once Google has been alerted to the fact that an autocomplete suggestion links someone to libellous words, it must remove that suggestion. The case is well covered by Jeremy Phillips at IPKat and by Karin Matussek of Bloomberg in Berlin.

The case is important in terms of the frontiers of legal protection for personal integrity and how we allocate responsibility for harm. Google says that, in these contexts, it is a facilitator not a generator. It says it should not liable for what people write (see Tamiz and Google Spain), not for what they search for (the recent German case). Not for the first time, courts in Europe have allocated responsibility differently.

Notably, this case was not brought under data protection law. In principle, it seems that such complaints could be expressed in data protection terms. Perhaps, if the EU’s final Data Protection Regulation retains the severe penalty provisions proposed in the draft version, data protection will move centre-stage in these sorts of cases.

Robin Hopkins

New FoIA Exemption

Posted on | by James Goudie KC

Following the Queen’s Speech, an Intellectual Property Bill has been introduced in the House of Lords.  Clause 19 inserts a new exemption into the FoIA (Section 22A).  The exemption is for continuing programmes of research intended for future publication.  Subsection 1(a) of Clause 19 provides that information is exempt from a Section 1(1)(b) FoIA disclosure requirement if it relates to information obtained in the course of, or derived from, a programme of continuing research that is intended for future publication.  Subsection (1)(b) of the new Clause, however, provides that the information will be exempt only if disclosure would, or would be likely to, prejudice a matter listed in that subsection.  The exemption will not be an absolute exemption. It will be subject to the public interest balance test.  Public authorities will not be required to confirm or deny that they hold Section 22A information if, or to the extent that, compliance would, or would be likely to prejudice, any of the matters mentioned in subsection (1)(b).  The Government does not consider that the new exemption raises any issues of compatibility under ECHR Article 10.

EIR: when is information ‘held’?

Posted on | by Edward Capewell

One of the issues which commonly arises for information law practitioners is the question, which arises under both FOIA and the EIR, of whether a public authority actually holds the information which has been requested. The leading case on section 1(1) FOIA is University of Newcastle v IC & British Union for the Abolition of Vivisection [2011] UKUT 185 (AAC), [2011] 2 Info LR 54 and substantially the same approach has been adopted in, for example, Keiller v IC and University of East Anglia [2012] 1 Info LR 128 and Clyne v IC & London Borough of Lambeth [2012] 2 Info LR 24 in relation to regulation 3(2) EIR. What is required is a common-sense and non-technical approach. That, of course, is easier stated than applied.

The issue arose again in Holland v IC & University of East Anglia (EA/2012/0098). Like Keiller, this case was concerned with the Climatic Research Unit (“CRU”) at UEA, the source of the so-called ‘Climategate’ controversy. Readers will recall that in November 2009 there was an unauthorised disclosure of a large number of emails concerning work undertaken at the CRU. The ensuing controversy led the university to set up the Independent Climate Change E-mail Review (“ICCER”) chaired by Sir Muir Russell, which reported in 2010.

Mr Holland, who had made a submission to the ICCER, requested “copies of all of the information held” by it. A lot of information had been published on the ICCER’s own website, and essentially what remained, the tribunal found, was the Review’s “working papers”. It seems not to have been in issue that they were in the physical possession of Sir Muir Russell or his solicitors and not UEA. The issue was, therefore, whether the information was held ‘on behalf of’ UEA for EIR purposes. The Commissioner thought not, and the tribunal agreed with him.

Directing itself by reference to BUAV as well as a number of other FTT decisions, the Tribunal decided that it needed first to examine the nature of the legal and practical relationship between UEA and the ICCER/Sir Muir Russell. It found that the inquiry could have been conducted internally, but that UEA had decided to externalise it not, as Mr Holland had argued, in order to avoid its obligations under FOIA and the EIR, but “at a time when UEA’s credibility was very much at stake, in order to inspire confidence in the independence of the findings” (para 104). It went on to find that there was nothing in the EIR, nor in the Aarhus Convention, which prevents public bodies from externalising functions or which means that environmental information thereby created is necessarily held by the public body (para 105). Although there was no written document evidencing a contract between Sir Muir and UEA, the Tribunal found that a contract did exist (para 108). It did, however, express considerable surprise at the absence of a written contract and of the fact that “there was no discussion … about the information that would be received or generated by the ICCER” (para 110). Nevertheless, the Tribunal accepted that both parties had proceeded on the assumption that UEA would have no claim to or be able to access the information and that it would be held by the ICCER on its own behalf (para 114).

The Tribunal went on to hold that there was no other sense in which the ICCER was beholden to UEA or in which its independence was compromised. It was not, as Mr Holland had argued, merely a ‘sham’: “we do not find it likely that [UEA] would have compounded its problems so greatly, and risked its credibility so completely, by setting up an inquiry that was independent in name only” (para 116). Neither the involvement of a Professor Boulton on the Review panel (who had previously worked for UEA) nor the decision not to publish the Appellant’s submission in full affected the fundamental independence of the ICCER (paras 117-118). It followed that the information requested was not held ‘on behalf of’ UEA and the appeal therefore failed. Interestingly, the Tribunal did perhaps give some succour to Mr Holland by saying in para 122 “It may be that the information should be held by the UEA and there may be good reason why, barring anything provided in confidence, the information should be passed to the UEA to form part of its historical records. Were that to happen, then in the future, the information may be held by the UEA.” Leaving aside the question-begging first sentence (why, in EIR terms, ‘should’ UEA hold this information?), the second sentence is an important reminder that the answer to the question of whether information is held is one which is liable to change over time and with circumstances.

Edd Capewell