LANDMARK IPT DECISION ON LOCAL AUTHORITY’S USE OF RIPA

The Investigatory Powers Tribunal today issued its decision in the first substantive public case on the use of surveillance powers under the Regulation of Investigatory Powers Act 2000.

Poole Borough Council suspected that Jenny Paton and her family may have lied about living in the catchment area of a sought-after primary school in Dorset. It therefore monitored their activity for around 3 weeks in 2008. This included covertly monitoring the movements of family members and their car, as well as examining the contents of their rubbish.

The IPT found that:

(1) investigating a potentially fraudulent school application was not a proper purpose in the sense required by RIPA;
(2) in these circumstances, the Council’s actions were in any event disproportionate, in that they were not necessary to achieve that aim, and
(3) the Council’s actions had breached the family’s rights under Article 8 of the ECHR.

Poole Borough Council has accepted the ruling and apologised to Ms Paton and her family.

PRIVACY IN THE DOCK

It is a fundamental rule of our justice system that it should be administered in public (Attorney General v Leveller Magazine Ltd [1979] AC 440). In the criminal justice system this rule generally operates so as to require individuals who are charged with an offence to give their home address in open court. But what is the position if the accused claim that confirming their address in open court will expose them and their family to attack? Are they entitled to demand that their address be given in camera? This is an issue which was recently posed in the case of R(Harper) & Anor v Aldershot Magistrates Court & Anor [2010] EWHC 1319 Admin. In this case, two senior police officers who had been charged with the offence of misconduct in public office sought to judicially review a ruling of the Magistrates Court that they must each confirm their address in open court. The officers, who had been suspended from duty, claimed that the ruling was unlawful because there was a real and genuine fear of reprisal and the safety of the officers and their family was at risk. The Court rejected the claim on the basis that any fears which the officers may have had were unreasonable, particularly because publication of their address would not in fact enhance any risk that they faced (notably, the addresses could simply have been accessed through the electoral roll). In reaching the conclusion that the ruling was lawful, the Court took into account not least Lord Diplock’s judgment in Belfast Telegraph Newspaper Limited’s Application [1997] NI QBD 309. In that case, Lord Diplock held that information may be withheld in criminal proceedings on the basis that this was necessary to serve the public interest in the administration of justice but that it could not be withheld simply in the interest of protecting ‘the private welfare of those caught up in that administration’ (at page 314F). The Court in Harper noted that there might be circumstances in which the individual’s well-being may overlap with the administration of justice such that the information can be withheld in the public interest. However, these were not the facts of the instant case. Notably, there is no analysis in the judgment of the application of Article 8 ECHR. Nor further is there any explicit consideration of the rights of the families of the accused. Query what role these considerations would have played if the facts of Harper had been less clear-cut.

UK interception regime upheld in Strasbourg

The European Court of Human Rights handed down a significant judgment today in Kennedy v. UK (application no. 26839/05).

A warrant under s. 8(1) of the Regulation of Investigatory Powers Act 2000 permits the interception of the communications of a particular person (or particular set of premises). Mr Kennedy sought to challenge the Art. 8 compatibility of the s. 8(1) warrant regime, and in particular sought to criticise its foreseeability. The Court unanimously rejected his challenge and, in a relatively detailed judgment, upheld the compatibility of the domestic law.

The case is also interesting for the Court’s analysis of Mr Kennedy’s Art. 6 complaint. Mr Kennedy had brought domestic proceedings in the Investigatory Powers Tribunal, which had resulted in two public decisions on legal issues, together with a final ruling that no determination had been made in his favour (i.e. that there had either been no interception, or that any interception that had taken place had been lawful). In Strasbourg, Mr Kennedy complained that the restrictive procedures of the Tribunal had breached Art. 6. In its judgment, the Court avoided deciding whether Art. 6 applied to such proceedings, but went on to confirm that if Art. 6 did apply then the Tribunal’s procedures satisfied its requirements.

GOOGLE IN EUROPE – PRIVACY CONTROVERSIES CONTINUE

In March 2010, we posted on a New York Times article which explored how Google’s quest to increase access to information via the internet appeared to be clashing with European privacy laws. The article followed in the wake of the prosecution in Italy of Google executives for violating Italian privacy laws after Google allowed a user to post a video showing an autistic boy being bullied. More recently, further controversies over Google’s record on privacy rights have emerged. First, privacy regulators from a number of different countries, including our own Information Commissioner, Christopher Graham, wrote a joint letter to Google’s chief executive and challenging him to improve protections for users, thereby highlighting concerns that Google is not doing enough to protect the privacy of users – see further this article in the Guardian dated 20 April 2010. Second, last week reports emerged that German regulators had renewed their criticism of Google’s Streetview when it emerged that Google was using the Streetview system to archive information about the location of household wireless networks – see this article in the New York Times dated 29 April 2010. What these developments suggest is that the clash between European social values and the expansion of Google’s techno-commercial empire is likely to continue for some time to come.

PATIENT DATA SHARING – ARE WE RUNNING OUT OF PATIENCE?

The question of the extent to which those working within the national health service should have access to patient data is a difficult one to resolve. On the one hand, permitting widespread access can potentially enable health service provides to provide more efficient, ‘joined up’ health-care to patients. On the other hand, there will always be concerns that too much access increases the risk that patient data, which is obviously sensitive personal data for the purposes of s. 2 of the Data Protection Act 1998, will be misused and/or inadvertently disclosed to third parties. We have seen this debate unfolding not least in respect of the Spine database project which is aimed at achieving a comprehensive centralised database of NHS patient records. The British Medical Association amongst others have alreeady expressed concern that the system is being rolled out too quickly (see further this article from the Guardian earlier this month). Today, reports are surfacing in the media that an NHS Trust in Wales is failing to ensure that proper restrictions are being placed on hospital staff accessing patient data (see further this BBC article which suggests hospital porters, IT staff and administrators have all been permitted access to patient data). This kind of story is only going to fuel concerns that the quest for efficiency in patient treatment requires too high a price to be paid in terms of compromising the privacy rights of patients.

DISCLOSING INFORMATION FOR CHILD PROTECTION PURPOSES – NEW ADMINISTRATIVE COURT JUDGMENT

The question of whether and to what extent local authorities can or should share information about individuals thought to pose a risk to children is often a very difficult one to answer in practice. Failure to disclose the information may expose the authority to claims that it has not acted in accordance with its duties to safeguard children’s interests. On the other hand, sharing the information may expose the authority to claims that it has acted in excess of its powers and has otherwise breached the individual’s right to privacy under Article 8 ECHR. In the recent case of H & L v X City Council and Y City Council [2010] EWHC 466 (Admin), the Administrative Court considered this question in a case involving the disclosure of information by a local authority about a severely disabled man (H) who been convicted of indecent assault on a child. In this case, the council had made a variety of disclosures to organisations with which H was involved. It had also adopted a policy of considering on a case by case basis whether it should make disclosure of information relating to H to organisations with which he became involved in the future. In addition, the local authority had a policy of disclosing information to H’s personal care assistants, purportedly to protect any children those carers may bring into contact with H.

In a judgment which recognised the very strong imperative in favour of protecting children’s interests, Judge Langan QC held that the policies of disclosure to organisations with which H was involved constituted a proportionate interference with H’s Article 8 right to privacy and was otherwise lawful. In reaching this conclusion, the judge took into account the fact that the disclosures were fairly guarded in nature; were not made in lurid terms and did not go beyond what was required for the purpose of making a measured communication. The judge similarly held that the policy of notifying other organisations with which H came into contact in future on a case-by-case basis was a reasonable, proportionate and otherwise lawful policy. However, the judge took issue with the authority’s policy of notifying H’s care assistants. He held that this was a disproportionate measure, particularly in view of the facts that: two of the three long-term carers had no children; there was a ‘no children at work’ provision in the relevant employment contracts and, further, the terms of the disclosures would raise suspicions in the minds of the carers which was more grave than H’s past conduct justified. In reaching his conclusions on the various policies adopted by the council, the judge plainly had in mind the recent important Supreme Court judgment in R(L) v Commissioner of Police of the Metropolis [2009] 3 WLR 1056, where the Supreme Court held that it was no longer right to assume that priority must be given to the need to protect the vulnerable over the right to respect for the private life of the individual. What this case perfectly illustrates is the highly fact-sensitive approach which needs to be adopted in any case where the local authority is contemplating sharing information for child protection purposes. Tim Pitt-Payne appeared on behalf of the local authority