Operation Motorman: Latin, Leveson and Personal Data

August 28th, 2015 by Christopher Knight

We here at Panopticon like to adopt an occasionally light-hearted look at information law developments. Not a ‘sideways look’ you will note, because we aren’t running a smug Radio 4 panel show, but a more gentle touch of humour as a coping mechanism with what can on occasion be a dry topic. So it is with considerable pleasure that we can say that the Upper Tribunal – or at least that part of it that is formed by Judge Wikeley – has followed suit.

In Information Commissioner v Colenso-Dunne [2015] UKUT 471 (AAC), the UT was considering an appeal by the ICO concerning an order of the FTT that it disclose names of journalists that the ICO had seized during a raid on the home of Steve Whittamore in 2003. The raid was known as Operation Motorman, and it is generally supposed that Mr Whittamore, a private investigator, had a list of journalist who used his morally and legally dubious services.

Within the first two paragraphs of his judgment on appeal, Judge Wikeley manages to get in some latin (quis custodiet ipsos custodies?), a Boris Johnson reference and a hat-tip to “some of the more outlandish conspiracy theories that abound on the internet” concerning the ICO, the latter of which in particular suggests that his previous experience of section 14 FOIA cases has left something of an aftertaste… There is also a reference at [26] to a “Grand Tour” with one Mr R Hopkins of the phone-hacking saga, which sounds rather like one of those dubious looking budget cruise holidays advertised on inserts in newspaper magazines which fall out when least expected.

However, more importantly, the ICO argued that the list of names should not released because they were sensitive personal data (because they were information as to the alleged commission of a criminal offence, which was the Commissioner’s evidence to the Leveson Inquiry) and that the ICO had no lawful authority to disclose the names under section 59 of the DPA. Mr Colenso-Dunne argued that the names showed only “a cavalier attitude owards the privacy of those individuals who were the subjects of the inquiries to Mr Whittamore” rather than criminal conduct (not a stance naturally adopted by all Hacked Off members), and that the public interest in disclosure was overwhelming.

The sensitive personal data point was the critical one, because the parties agreed that no Schedule 3 condition applied, and it had to be protected much more carefully. The UT rejected an Orwellian submission that some sensitive personal data were more equal than others because s.2(g) didn’t appear in the Directive, because the commission of criminal offences was selected by Parliament and is just as much part of a life-story as any other category. However, the application of it was fact-specific. The FTT was entitled to find that even if the investigator committed criminal offences, the list of names did not show an instruction to do so or Nelsonian blindness to that effect. Nor was the UT persuaded that release of the list in context would mean that the public would assume the journalists had committed a criminal offence; data controllers are not required to conduct a search of the public domain to see whether anything else could be combined with the data to transform its sensitivity; it has to be apparent from its immediate context: at [45]. The FTT was entitled to find that the data was not sensitive.

As to the balancing exercise under condition 6(1) of Schedule 2, the UT held that the FTT had considered that any reputational damage to journalists was justified in that they would be subject to legitimate criticism for their use of Mr Whittamore. Perhaps worryingly, one only gets the reputational rights one deserves: at [55] (although it is not quite clear in whose eyes these just deserts are to be judged: quis custodiet ipos custards?). The fact that Leveson declined to name the journalists was not determinative, and nor was the fact that the FTT had not followed the precise taxonomy set out in Goldsmith (on which see here and which, for reasons unfathomable, still appears not to have become known as the ‘Knight Principles’). Essentially, the UT was wholly unpersuaded that the FTT’s balancing exercise that the public interest in disclosure and furthering the debate over the ICO’s own role had erred in any way, noting that not all of the 305 names were ordered to be disclosed following the careful analytical exercise undertaken by the FTT.

Judge Wikeley noted that the ICO had been correct to drop an argument that a higher standard of public interest was required to meet the section 59 DPA test, and thus avoid the application of s.44 FOIA. No truck was had with a steps discretion argument – very much in vogue at the moment, although not yet in Vogue – not least because it had not been raised below. Subject to any appeal, the names ordered to be disclosed by the FTT will now have to be disclosed by the ICO. The fall-out from Leveson is not over yet.

Robin Hopkins appeared for the ICO in his capacity as lead tour guide.

Christopher Knight

 

 

Refusing a subject access request: proportionality, anxious scrutiny and judicial discretion

August 25th, 2015 by Robin Hopkins

Zaw Lin and Wai Phyo v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB), a judgment of Green J handed down today, is an interesting – if somewhat fact-specific – contribution to the burgeoning body of case law on how subject access requests (SARs) made under the Data Protection Act 1998 (DPA) should be approached, both by data controllers and by courts.

The Claimants are on trial in Thailand for the murder in September 2014 of British tourists Hannah Witheridge and David Miller. They could face the death penalty if convicted.

Under the Police Act 1996, and following high-level discussions (including at Prime Ministerial level), it was agreed that the Metropolitan Police Service (MPS) would send an officer to observe and review – but not assist with – the Thai police investigation. The MPS compiled a detailed Report. They agreed to keep this confidential, except that it could be summarised verbally to the families of the victims so as to reassure about the state of the investigation and proceedings. The Report has never been provided to the families or the Thai authorities.

The Claimants made SARs, seeking disclosure of the MPS’ Report. Green J summarised their objectives as follows (para 29):

“The Claimants have endeavoured to clothe their arguments in the somewhat technical language of the DPA.  It seems to me that the bottom line of these arguments, stripped bare of technical garb, can be put in two ways.  First, the views of the MPS carry weight. Scotland Yard has an international reputation.  If the Report is seen as favourable to the prosecution and contains material supportive of the RTP [Royal Thai Police] investigation (which is in effect how the Claimants say it has been presented in public by the families) then they should have the right to see the personal data so they can correct any misapprehensions.  Secondly, that in any event they should be able to use any personal data which is favourable to their defence.”

The Claimants were entitled to request disclosure of at least some of the contents of the Report, though Green J estimated that only a small percentage of its contents constituted their personal data (para 25).

The MPS refused the SARs, relying on the exemption for crime and taxation under section 29 DPA.

In determining the claim under section 7(9) DPA, Green J considered arguments as to the applicability (or not) of Directive 95/46/EC (which contains exceptions for criminal matters: see Articles 3 and 13) and the European Convention on Human Rights. His view was that not much turned on these points here (para 49). At common law, the court’s scrutiny must always be fact- and context-specific. In a life-and-death context, anxious scrutiny would be applied to a data controller’s refusal. See para 69:

“… when construing the DPA 1998 (whether through common law or European eyes) decision makers and courts must have regard to all relevant fundamental rights that arise when balancing the interest of the State and those of the individual.  There are no artificial limits to be placed on the exercise.”

Green J expressed his discomfort about the application of section 15(2) DPA, which allows the court – but not the data subject – to view the withheld information. This, together with the prospect of a closed session, raised concerns as to natural and open justice. Given the expedited nature of the case before him, it was not appropriate to appoint a special advocate, but that may need to be considered in future cases where the stakes are very high. Green J proceeded by asking questions and hearing submissions on an open basis in a sufficiently generic and abstract way.

In expressing those procedural misgivings, Green J has touched on an important aspect of DPA litigation which has received little attention to date.

He also took a narrower view of the breadth of his discretion under section 7(9) DPA than has often been assumed. At para 98, he said this of the ‘general and untrammelled’ nature of that judicial discretion:

“If Parliament had intended to confer such a broad residual discretion on the court then, in my view, it would have used far more specific language in section 7(9) than in fact it did. In any event I do not understand the observations in the authorities referred to above to suggest that if I find that the MPS has erred that I should simply make up and then apply whatever test I see fit.  If I find an error on the part of the MPS such that I must form my own view then I should do in accordance with the principles set out in the DPA 1998 and taking account of the relevant background principles in the Directive and the Convention. My discretion is unfettered by the decision that has gone before, and which I find unlawful, but I cannot depart from Parliament’s intent.”

Such an approach to section 7(9) could make a material difference to litigation concerning SARs.

Green J then set out and determined the issues before him as follows:

Issue I: Who has the burden of proof of proving both the right to invoke the exemption? What is the standard of proof?

Following R (Lord) v Secretary of State of the Home Department [2003] EWHC 2073 (Admin), the answer is that the data controller bears the burden. “The burden of proof is thus upon the MPS in this case to show its entitlement to refuse access and it must do this with significant and weighty grounds and evidence” (para 85).

Issue II: Was the personal data in the MPS report “processed” for purposes of (a) the prevention or detection of crime or (b) the apprehension or prosecution of offenders?

Green J’s answer was yes. Although the purposes behind the Report differed from the usual policing context, there should be no artificially narrow interpretation of the ‘prevention and detection of crime/apprehension or prosecution of offenders’.

Issue III: Would granting access be likely to prejudice any of those purposes?

This required a balancing exercise to be performed between the individual’s right to access and the interests being pursued by the data controller in refusing disclosure. This called for a “classic proportionality balancing exercise to be performed” (para 78).

Here, the starting point was the Claimant’s prima facie right to the personal data. This was bolstered by the life-and-death context of the present case.

The MPS’ refusal, however, pursued legitimate and weighty objectives. In assessing those objectives, it was relevant to consider what precedent would be set by disclosure: the “focus of attention was not just on the facts of the instant case but could also take account of the impact on other cases” (as per Lord).

On that basis, and in light of the evidence, the MPS’ ‘chilling effect’ argument was powerful. See para 107:

“… I accept their judgment and opinion as to the risks that release of the Report would give rise to and in particular, their position on: the considerable benefit to the public interest (in relation to crime enforcement and public security) generally in the MPS (and other relevant police authorities) being able to engage with foreign authorities; the high importance that is attached by foreign authorities to confidentiality; and the risk that not being able to give strong assurances as to confidentiality would pose to the ability of the MPS and others to enter into meaningful working relationship with such overseas authorities.”

It was also important to avoid any potential interference with a criminal trial in a foreign country.

The Claimants’ SARs were not made for any improper purposes, i.e. for purposes other than those which Directive 95/46/EC sought to further. In that respect, the present case was wholly unlike Durant.

The balancing exercise, however, favoured the MPS. Having considered each item of personal data, Green J said his “ultimate conclusion is that there is nothing in the personal data which would be of any real value to the Claimants” (para 125). He expressed his unease with both the procedure and the outcome. Permission to appeal was granted, though Panopticon understands that an appeal is not being pursued by the Claimants.

Anya Proops and Christopher Knight acted for the Defendant.

Robin Hopkins @hopkinsrobin

Privacy and data protection – summer roundup

August 18th, 2015 by Robin Hopkins

August tends to be a quiet month for lawyers. There has, however, been little by way of a summer break in privacy and data protection developments. Here are some August highlights.

Privacy injunction: sexual affairs of sportsman (not philosophers)

Mrs Justice Laing’s August does not appear to have begun restfully. Following a telephone hearing on the afternoon of Saturday 1 August, she granted what became a widely-reported privacy injunction (lasting only until 5 August) restraining the publication of a story about an affair which a prominent sportsman had some years ago: see the judgment in AMC and KLJ v News Group Newspapers [2015] EWHC 2361 (QB).

As usual in such cases, Article 8 and Article 10 rights were relied upon to competing ends. There is no automatic favourite in such contests – an intense focus on the facts is required.

In this case, notwithstanding submissions about the extent to which the affected individuals ‘courted publicity’ or were not ‘private persons’ – there was a reasonable expectation of privacy about a secret sexual affair conducted years ago. The interference needed to be justified.

The right to free expression did not constitute adequate justification without more: “I cannot balance these two incommensurables [Articles 8 and 10] without asking why, and for what purposes, X and R seek to exercise their article 10 rights… The public interest here is, I remind myself, a contribution to a debate in the general interest”.

On the facts, there was insufficient public interest to justify that interference. The sportsman was not found to have hypocritically projected himself as ‘whiter than white’, and his alleged deceits and breaches of protocols in the coducting of his affair were not persuasive – especially years after the event. In any event, the sportsman was a role model for sportsmen or aspiring sportsmen: “he is not a role model for cooks, or for moral philosophers”. The latter point will no doubt be a weight off many a sporting shoulder.

Subject access requests: upcoming appeals

Subject access requests have traditionally received little attention in the courts. As with data protection matters more broadly, this is changing.

Holly Stout blogged earlier this month about the High Court’s judgment in Dawson-Damer and Ors v Taylor Wessing and Ors [2015] EWHC 2366 (Ch). The case concerned legal professional privilege, manual records and relevant filing systems, disproportionate searches and the court’s discretion under section 7(9) DPA. That case is on its way to the Court of Appeal.

So too is the case of Ittihadieh [2015] EWHC 1491 (QB), in which I appeared. That case concerned, among other issues, identification of relevant data controllers and the domestic purposes exemption. It too is on its way to the Court of Appeal.

Subject access requests: the burden of review and redaction

There has also been judgment this month in a County Court case in which I appeared for the Metropolitan Police Service. Mulcahy v MPS, a judgment of District Judge Langley in the Central London County Court, deals in part with the purposes behind a subject access request. It also deals with proportionality and burden, which – as Holly’s recent post discusses – has tended to be a vexed issue under the DPA (see Ezsias, Elliott, Dawson-Damer and the like).

Mulcahy deals with the proportionality of the burden imposed not so much by searching for information within the scope of a subject access request, but for reviewing (and, where necessary, redacting) that information before disclosure. This is an issue which commonly concerns data controllers. The judgment is available here: Mulcahy Judgment.

Privacy damages: Court of Appeal to hear Gulati appeal

May of 2015 saw Mr Justice Mann deliver a ground-breaking judgment on damages awards for privacy breaches: see Gulati & Ors v MGN Ltd [2015] EWHC 1482 (Ch), which concerned victims of phone-hacking (including Paul Gascoigne and Sadie Frost). The awards ranged between £85,000 and £260,250. The judgment and grounds of appeal against the levels of damages awards are explained in this post by Louise Turner of RPC.

Earlier this month, the Court of Appeal granted MGN permission to appeal. The appeal is likely to be expedited. It will not be long before there is a measure of certainty on quantum for privacy breaches.

ICO monetary penalties

Lastly, I turn to privacy-related financial sanctions of a different kind. August has seen the ICO issue two monetary penalty notices.

One was for £50,000 against ‘Stop the Calls’ (ironically, a company which markets devices for blocking unwanted marketing calls) for serious contraventions of regulation 21 of the Privacy and Electronic Regulations 2003 (direct marketing phone calls to persons who registered their opposition to such calls with the Telephone Preference Service).

Another was for £180,000 for a breach of the seventh data protection principle. It was made against The Money Shop following a burglary in which an unencrypted server containing customers’ personal information was stolen.

Robin Hopkins @hopkinsrobin

Refusing to respond to subject access requests – legal professional privilege, disproportionate effort and collateral purposes

August 12th, 2015 by Holly Stout

The Information Commissioner’s Code of Practice on Data Protection steadfastly maintains that data controllers cannot refuse to respond to a subject access request unless one of the specific exceptions in the Data Protection Act 1998 (“DPA”) applies.  However, there is a growing body of case law on the circumstances in which the courts will refuse to enforce compliance with subject access requests under s 7(9) of the Act, even where one of the specific exceptions under the Act does not apply.  See previous Panopticon posts on this subject here and here.

In a judgment handed down on 6 August 2015, HHJ Behrens (sitting as Judge of the High Court) considered a refusal by Taylor Wessing LLP (“TW”) and two individual defendants to respond to a subject access request made by a family involved in legal proceedings in the Bahamas concerning a discretionary settlement known as the Glenfinnan Settlement.  TW’s client (Grampian) is the sole trustee of that Settlement.

TW resisted the family’s application for an order under s 7(9) requiring compliance with the subject access request on the following bases:

  1. The data in question was covered by legal professional privilege as it is only processed by TW in connection with their capacity as legal advisors;
  2. Some of the information was held in manual files and not in a relevant filing system for the purposes of the DPA;
  3. It was not reasonable or proportionate to expect TW even to carry out a search for the information and to assess what was covered by privilege and what was not;
  4. As a matter of discretion the Court should refuse to make an order under s 7(9) because the application had been made for improper purposes.

The Court’s ruling on each of these issues is worthy of note.  The full judgment is available here.

Legal professional privilege 

Paragraph 10 of Schedule 7 to the DPA provides a specific exception for “information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality as between client and professional legal adviser, could be maintained in legal proceedings”.  The family argued that this exception was restricted to English law professional privilege and did not extend to documents that were covered by Bahamian rules on disclosure or which were subject to equitable rules in English trust law about non-disclosure of information to Trust beneficiaries.  HHJ Behrens did not accept these submissions.  He considered, following Durant v FSA [2003] EWCA 1746 that a purposive approach is to be taken to interpretation of the DPA and that the exception in para 10 of Sch 7 was not to be strictly construed.  Adopting a purposive approach, he held that the exception was to be construed as if it applied to any documents in respect of which there is a right to resist compulsory disclosure in legal proceedings.  Accordingly, it covered all the documents in respect of which the parties would be entitled to resist compulsory disclosure in the Bahamian proceedings, even though these were not covered by the English doctrine of legal professional privilege.  This is a novel interpretation that may receive further attention from the courts in due course.

Relevant filing system 

HHJ Behrens referred to the observations of Auld LJ in Durant in relation to the meaning of ‘relevant filing system’ for the purposes of the DPA.  Auld LJ held (at [48] of Durant) that “Parliament intended to apply the Act to manual records only if they are of sufficient sophistication to provide the same or similar ready accessibility as a computerised filing system.  That requires a filing system so referenced or indexed that it enables the data controller’s employee responsible to identify at the outset of his search with reasonable certainty and speed the file or files in which the specific data relating to the person requesting the information is located and to locate the relevant information about him within the file or files, without having to make a manual search of them. To leave it to the searcher to leaf through files, possibly at great length and costs, and fruitlessly, to see whether it or they contain information relating to the person requesting information and whether that information is data within the Act bears … no resemblance to a computerised search”.  Although HHJ Behrens did not ultimately determine whether TW’s filing system satisfied the definition of ‘relevant filing system’ he indicated that as it appeared that documents within the manual files were not chronologically arranged or filed in any way by reference to individuals, they may well fall outside the scope of the Act.

Disproportionate effort 

Section 8(2) of the DPA provides that a data controller need not supply copies of information “in permanent form” if that would require “disproportionate effort”.  The Information Commissioner in his Code of Practice is keen to minimise reliance on this exception stating, “You cannot refuse to comply with a SAR on the basis that it would involve disproportionate effort, simply because it would be costly and time consuming to find the requested personal data held in archived emails.”  And: “We stress that you should rely on the disproportionate effort exception only in the most exceptional of cases. The right of subject access is central to data protection law and we rarely hear of instances where an organisation could legitimately use disproportionate effort as a reason for denying an individual access to any of their personal data. Even if you can show that supplying a copy of information in permanent form would involve disproportionate effort, you must still comply with the request in some other way.”  However, in this case HHJ Behrens referred to his own earlier judgment in Elliott v Lloyds TSB Bank and Hickinbottom J’s decision in Ezsias v Welsh Ministers before summarising the position in relation to s 8(2) as follows: “A data controller is only required under s 8(2) to supply the individual with such personal data as is found after a reasonable and proportionate search”.  This is arguably a significantly more relaxed approach than that taken by the Information Commissioner.  It remains to be seen whether the Information Commissioner will amend his guidance in the light of this string of decisions.

In this case, HHJ Behrens went on to hold that it would not have been reasonable and proportionate for TW to carry out the search in this case.  In reaching this conclusion, HHJ Behrens interestingly appears to have been influenced by the disproportionality of requiring ‘skilled lawyers’ to review documents for LPP when the applicant need only pay £10 for a subject access request.

Improper purposes 

Section 7(9) of the DPA undoubtedly gives the court a discretion as to whether to order a data controller to comply with a subject access request.  In a number of cases now the courts have ruled that this discretion enables the court to refuse to make such an order even if none of the exceptions under the DPA apply and therefore the data controller is breaching the Act by refusing to respond: see the previous Panopticon posts mentioned in the first paragraph of this blog.  This case is another such.  Although not necessary to his decision, as TW had already ‘won’ on the LPP and disproportionate effort points above, HHJ Behrens gave three reasons why he would not in any event have exercised his discretion under s 7(9) in this case:

  1. The real purpose of the subject access requests was to obtain information for used in connection with the Bahamian proceedings.  HHJ Behrens was satisfied that the claimants would not have brought the applications at all were it not for the Bahamian proceedings.  This was, following Durant, not a proper purpose for a request under the DPA;
  2. It would be unreasonable and disproportionate to order TW to comply with the request: the same points as were relevant to the s 8(2) exception were relevant to the s 7(9) discretion; and
  3. It was not a proper use of the DPA to enable the claimants to obtain documents that they could not have obtained in the Bahamian proceedings.

HHJ Behrens recognised that a number of points in his judgment were novel and indicated that he was therefore minded to grant permission to appeal, if permission were sought.  Permission was sought and duly granted so expect to hear further from the Court of Appeal on these issues in due course.

Jonathan Swift QC appeared for the claimants.

Holly Stout

The Right to be Forgotten and the County Court

July 31st, 2015 by Christopher Knight

The right to be forgotten is beginning to generate some litigation, albeit not yet with any blaze of glory. Following on from the attempt to judicially review the ICO for refusing to try and enforce an individual’s complaint that his data rights were being breached (see here), earlier this week a claimant failed to get his right to be forgotten claim to fly before the Nottingham County Court.

The background is that the claimant, Mr Edwards, was convicted in 2007 in connection with his criminal participation in a vast carousel VAT fraud. He was sentenced to six and a half years in prison for the fraud. He was also given a three and a half year sentence for stealing £18,000 from personal injury claimants through a scheme under which he deceitfully pretended to be a solicitor. Additionally, he was subject to a 12 year ban from taking up any company office. Mr Edwards continues to serve his sentence, although he is now out on licence. The length of Mr Edwards’ sentence means that there is no question of Mr Edwards being rehabilitated on an application of the Rehabilitation of Offenders Act. The fact of his conviction, and the circumstances of it, were widely reported by the media. The BBC, the Guardian and the Daily Mail, amongst others, all published stories about these events on their respective websites. Mr Edwards was unhappy about the fact that the stories continued to be available to the public at large, as hosted by the websites of these media organisations. As far as he was concerned, his offences were historic, dating back over a decade. So he brought a right to be forgotten claim against various media organisations, including the BBC, the Guardian and Associated News, relying heavily on the CJEU’s judgment in Google Spain: Edwards v Nottingham Post Media Ltd & Others.

However, after evidence was served by the Defendants in response to the claim, Mr Edwards confirmed that he wished to discontinue his DPA claim against the Defendants. You might have thought that that was the end of the matter but, rather than abandoning his claim altogether, Mr Edwards decided instead to apply to the court to substitute the BBC et al with Google Inc as the defendant. In effect, Mr Edwards wanted to convert his claim from a claim that the data should be deleted at source to a claim that the data should be de-indexed by the intermediary which effectively brought that data to a wide online audience, namely Google.

At a hearing which took place in Nottingham County Court on 29 July, HHJ Godsmark QC refused Mr Edwards’ application to substitute the defendants with Google Inc. He concluded that substitution should not be ordered because the claim against Google had no reasonable prospect of success, with the result that the court would not grant permission for service out of the jurisdiction on Google Inc.

The judge agreed with the submissions on behalf of the media organisations that the claim was hopeless, particularly in the light of the serious nature of Mr Edwards’ offences and the fact that he is continuing to serve his sentence and remains banned from running a company until 2019. The judge held that, in these circumstances, Mr Edwards could have no reasonable expectation of privacy in respect of the data in question and there was no reasonable prospect of him succeeding in his case that his Article 8 right to privacy outweighed the Article 10 justification for the continued publication of the stories. The public interest, the judge concluded, strongly favoured continued publication and indexing by Google.

In response to a query from Mr Edwards about when that balance might alter, the judge is reported to have commented that he could not imagine a court entertaining such an application during the period of the sentence, the license or indeed for a considerable time thereafter.

The claim was marked as ‘totally without merit’. The media organisations were awarded 100% of their costs.

Mr Edwards’ case was not, perhaps, the most promising context in which to rely on Google Spain. However, it is interesting to see that the right to be forgotten is penetrating the litigation consciousness (especially in chokey, where a lengthy CJEU judgment helps while away the time) and harder cases are doubtless around the corner. The balance between the right to a private life, historic information and free expression will not always be so straightforward to weigh.

Anya Proops appeared for the media organisations, defending the claim. For the BBC’s story see here.

Christopher Knight

Facebook, drag artists and data protection dilemmas: ‘if you stand on our pitch, you must play by our rules’

July 31st, 2015 by Robin Hopkins

Facebook is one of the main battlegrounds between privacy and other social goods such as safety and security.

On the one hand, it faces a safeguarding challenge. Interactions through Facebook have the potential to cause harm: defamation, data protection breaches, stalking, harassment, abuse and the like. One safeguard against such harms is to ensure that users are identifiable, i.e. that they really are who they say they are. This facilitates accountability and helps to ensure that only users of an appropriate age are communicating on Facebook. The ongoing litigation before the Northern Irish courts in the HL case raises exactly these sorts of concerns about child protection.

Part of the solution is Facebook’s ‘real names’ policy: you cannot register using a pseudonym, but only with your official identity.

On the other hand, Facebook encounters an argument which runs like this: individuals should be free to decide how they project themselves in their communications with the world. This means that, provided they are doing no harm, they should in principle be allowed to use whatever identity they like, including pseudonyms, working names (for people who wish to keep their private Facebooking and their professional lives separate) or stage names (particularly relevant for drag artists, for example). The real names policy arguably undermines this element of human autonomy, dignity and privacy. There have been colourful recent protests against the policy on these sorts of grounds.

Which is the stronger argument? Well, the answer to the question seems to depend on who you ask, and where you ask.

The Data Protection Commissioner in Ireland, where Facebook has its EU headquarters, has upheld the real names policy. When one of Germany’s regional Data Protection Commissioners (Schleswig-Holstein) took the opposite view, Facebook challenged his ruling and secured a court victory in 2013. The German court suspended the order against the real names policy and, equally importantly, decided that the challenge should proceed in Ireland, not Germany.

This week, however, another German decision turned the tables on the real names policy yet again. The Hamburg data protection authority upheld a complaint from someone who used a pseudonym on Facebook so as to separate her private and professional communications. The Hamburg DPA found against Facebook and held that it was not allowed unilaterally to change users’ chosen usernames to their real names. Nor was it entitled to demand official identification documents – an issue of particular relevance to child protection issues such as those arising in HL.

The Hamburg ruling is notable on a number of fronts. It exemplifies the tension between privacy – in all its nuanced forms – and other values. It illustrates the dilemmas bedevilling the business models of social media companies such as Facebook.

The case also highlights real challenges for the future of European data protection. The General Data Protection Regulation – currently clawing its way from draft to final form – aspires to harmonised pan-European standards. It includes a mechanism for data protection authorities to co-operate and resolve differences. But if authorities within the same country are prone to divergence on issues such as the real names policy, how optimistic can one be that regulators across the EU will sing from the same hymn sheet?

Important questions arise about data protection and multinational internet companies: in which country (or region, for that matter) should a user raise a complaint to a regulator? If they want to complain to a court, where do they do that? If a German user complains to an Irish regulator or court, to what extent do those authorities have to consider German law?

For the moment, Facebook clearly seeks home ground advantage. But its preference for the Irish forum was rejected by the Hamburg authority in this week’s ruling. He is reported as saying that “… Facebook cannot again argue that only Irish Data Protection law would be applicable … anyone who stands on our pitch also has to play our game”.

The draft Regulation has something to say on these matters, but is far from clear as to how to decide on the right pitch and the right rules for vital privacy battles like these.

Robin Hopkins @hopkinsrobin

Vidal-Hall to the Supreme Court

July 28th, 2015 by Christopher Knight

Has the announcement of the death of section 13(2) DPA been premature? Might it, after all, be nuzzling up the bars, ready to go ‘Voom’? Perhaps, but the Supreme Court is taking on the role of Burke and Hare because it has today announced that it has given leave to appeal on the following two questions:

  1. Whether the Court of Appeal was right to hold that section 13(2) of the Data Protection Act 1998 was incompatible with Article 23 of the Directive.
  2. Whether the Court of Appeal was right to disapply section 13(2) of the Data Protection Act 1998 on the grounds that it conflicts with the rights guaranteed by Articles 7 and 8 of the EU Charter of Fundamental Rights.

A further question, on whether it was correct to classify the misuse of private information claims as tortious ones, was refused leave, presumably on the basis that the Supreme Court only wants to think about the super-cool DPA issues.

A hearing is highly unlikely before 2016, but Panopticon will let you know when it knows. In the meantime, section 13(2) is still dead, so get your damages while they are still hot…

Christopher Knight

Circle the Wagons: They are Coming for the Information Tribunal

July 24th, 2015 by Christopher Knight

We all fell for it, didn’t we? If the greatest trick the Devil ever pulled was convincing the world he didn’t exist, then Michael Gove’s may have been to convince everyone that he wasn’t interested in FOIA. His shunting responsibility for FOIA/EIR matters off to the Cabinet Office, and the Cabinet Office’s announcement of the Commission on Freedom of Information (generally staffed by people who publicly don’t much like it), last week has led to a lot of comment and reaction – mostly adverse – from social media, blogs and even the mainstream press.

And that has rather caused everyone to take their eye off the ball, including Panopticon (which was alerted by an informant known only as Deep Throat), because in the midst of kerfuffle over the possible threat to the substance of aspects of FOIA through the new Commission the Ministry of Justice has announced a consultation on a more insidious threat to seekers of information and transparency: the introduction of Tribunal fees.

Contained within a document which is also the Government’s Response to an earlier consultation exercise on raising fees in various aspects of civil litigation (also problematic, but not relevant here) is a consultation is the introduction, for the first time, of fees to use certain parts of the First-tier Tribunal and Upper Tribunal. The Upper Tribunal (Administrative Appeals Chamber) is not within the scope of the proposal – although there is no explanation as to why not – but the First-tier Tribunal (General Regulatory Chamber) is.

The proposal is that there will be a £100 fee for an appeal to be issued, and a further £500 fee if an oral hearing takes place. Cases referred to the Upper Tribunal under rule 19 of the GRC Rules will also be subject to the same fee. There will be a system of remissions in place.

This gives rise to a number of issues. Anyone who has had anything to do with the Employment Tribunals over the last few years will know that since the introduction of fees (and, to be fair, compulsory settlement discussion periods) the workload of the ET has gone through the floor. It seems highly likely that something very similar will happen for FOIA/EIR appeals, where so many of the cases are brought by individuals, many of whom will not be able to afford to spend that kind of money on something which has no prospect, unlike the ET, of ever winning them any money and relates almost inevitably to the public interest rather than their own private interest. There must be a real difference of type between such litigation and private interest litigation elsewhere in the GRC. (To be fair, it is of course the case that judicial reviews brought on a public interest basis still incur fees, but they are the exception to the ordinary use of Part 54, whereas the public interest is at the heart of the vast majority of FOIA appeals, and assessed on that basis.) Why, when the legislation is requestor-blind, should the Tribunal system not be too? Alternatively, one might mount a plausible argument that if a public authority wishes to appeal a Decision Notice then it should have to pay a fee (because it is seeking to avoid transparency) but a requestor should not.

It is pretty likely, although the figures aren’t given in the consultation, that FOIA/EIR appeals make up a large proportion of the GRC’s work. But given their public interest element, are they really the cases to which a fee should be targeted? The GRC also hears appeals concerning the regulation of estate agents, driving instructors, claims management services and exam boards (amongst others). Those are all private interests, as are appeals against fines levied on public authorities for bugging phones without warrants. Is not an appeal about the release of public authority information worthy of greater ring-fencing from fees than an appeal about Defra banning you from micro-chipping a dog? (I may be barking up the wrong tree, but I am not making this up.)

In the calculations of the Government, the GRC costs them £1.6m a year. At best, they expect to recover £0.4m in fees, and that will reduce if the caseload drops as a result of fee introduction (which, bizarrely, they apparently do not anticipate). One might think that that was a relative drop in the ocean, although of course every penny counts, but fees won’t pay the GRC’s way (and Gambling disproportionately contributes already given the very high fees and the very low number of cases).

But aside from the issues of principle, there are also real problems of practice, particularly around the hearing fee. The proposal says “The claimant may alternatively elect for an oral hearing, in which case a further fee of £500 would be payable.” But this doesn’t reflect the reality of the GRC Rules. Rule 32 requires the GRC to hold a hearing where one party requests it: what if the ICO or the public authority request one? What if both do? Who pays then? What if the Tribunal itself lists a hearing, against the wishes of the parties, because it thinks it cannot do justice without one under rule 32(1)(b)? Who pays for that decision? The proposal appears to anticipate that the appellant will still have to pay the fee, presumably on the basis that that it is their ‘fault’ that the appeal exists at all, but that seems very unfair. What about directions hearings – does the fee apply to those, and who has to request one for it to be triggered? The proposal seems remarkably un-thought through and the consultation will need to point that out.

Why is it the GRC which is being targeted by fees rather than the appellate stage in the Upper Tribunal? Surely having a second bite on appeal is more worthy of a financial penalty, and a discouragement to unnecessary appeals on the facts? If fees still apply to rule 19 transfers, will it not be in the interest of every litigant to try and get a case transferred to the UT on the basis that if he has to pay, he may as well get the best court he can for his buck?

 

The consultation paper and the impact assessment on tribunal fees are both online. Panopticon strongly encourages readers to respond to the consultation, which closes on 15 September 2015.

Christopher Knight

Child Protection and Data Protection

July 23rd, 2015 by Christopher Knight

The spectre of Jimmy Saville casts a long shadow and now it extends to data protection, the Data Protection Act 1998 being the latest august and uniformly popular institution (following the BBC, Broadmoor and Margaret Thatcher to name just some) to suffer as a result of his actions. The perennial sight of investigations and public inquiries into historic sex abuse of children in local authority, chiefly arising out of the wider ramifications of Operation Yewtree, has provided a very ready explanation for local authorities for the need to retain child protection data.

The fifth data protection principle says data should not be kept longer than necessary for the purposes for which it is processed, whereas the reality will often be that the information of greatest significance (accusations of abuse or records of care) will only become significant after the expiry of a lot of time and the child’s growth into an adult able to confront the abuse they have suffered.

As a result, there is no consistent practice across the country. The High Court in R (C) v Northumberland County Council & ICO [2015] EWHC 2134 (Admin) was informed that authorities adopt an approach which ranges from retention until the 21st birthday, to six years after the 18th birthday, to 75 years from the date of birth, to 35 years from the closure of a case: at [10]. This obviously poses concerns about compliance with the DPA and Article 8 ECHR.

C sought the destruction of his child protection held by Northumberland CC and considered that it had been retained under the 35 year policy applicable in Northumberland for too long. C considered that a period of six years after his 18th birthday would have been the cut-off point, and the ICO agreed intervening (although the ICO copped a lot of flak from Simon J for having issued a section 42 DPA determination indicating it was ‘likely’ the Council had complied with the DPA and had subsequently changed its mind).

The judgment of Simon J is not always the easiest to follow. It appears that the key question before the Court was whether the retention for 35 years (which clearly engaged Article 8) was in accordance with the law, and if it was, whether it was proportionate. Although the judgment does not actually reason expressly in this way, it seems as though the analysis revolves around the fifth principle: if data retention does not breach the longer than necessary test, it will be in accordance with the law and it will be proportionate. This is not actually what the judgment says; it must be broadly how the analysis goes (see at [9]), and it is open to some debate whether those assumptions are correct in law or in analysis of the judgment.

Simon J held that the purpose for retaining child protection records was not limited to defending litigation, and so an adoption of six years – based on the limitation period – did not read across. The purpose was broader: it was to protect other children, to allow data subjects access in later life, and to make the information available to subsequent investigation: at [33]. The Judge was clearly influenced by the difficulty of seeing the importance of information at the time, and its significance only becoming clear through a more historical lens: at [37]. The clearest examples are, of course, Saville-esque: at [49]-[53]. A six year cut off period would, in the view of Simon J, restrict the ability of people over 24 from making a request and learning about their child protection file contents: at [45]-[47]. Simon J concluded that the Council was not required to adopt a “cumbersome and time-consuming predictive exercise” and retention would help to identify risks only seen with hindsight: at [56]. Regular review, every seven years, was considered a disproportionate use of labour: at [58]. 35 years “fell within the bracket of legitimate periods of retention”: at [61].

One can readily sympathise with the position of the Council in a case like C, which will be (with other linked agencies) between a rock and a hard place on child protection data. If they delete too quickly they risk being castigated by history for not being able to answer questions; if they don’t delete they are hoarders of sensitive and traumatic data. Simon J clearly sympathised very strongly with this. However, the structure of the reasoning is regrettably unclear. The reader is left uncertain whether Simon J has found the fifth principle complied with (probably, on the basis of a wider reading of its purposes), whether that has meant the interference with Article 8 was in accordance with the law (presumably, but query how that works where it only falls within a legitimate bracket), and how the structured proportionality analysis has been carried out. It may well not matter on the conclusions of the judgment, but it does mean it will be harder to advise on and apply in related contexts. Nor does it give much guidance as to other periods adopted; is 6 years too short and is 75 years too long? Doubtless further case law will explore the undiscovered country. In the meantime, some national guidance wouldn’t go amiss…

Paul Greatorex appeared for C, Karen Steyn QC for Northumberland and Robin Hopkins for the ICO.

Christopher Knight

Time to End the Time Debate

July 23rd, 2015 by Christopher Knight

The apparently endless APPGER litigation has produced yet another decision of the Upper Tribunal for seasoned FOIA watchers, which amongst some very fact-specific issues, also contains two important clarifications of law: APPGER v ICO & FCO [2015] UKUT 377 (AAC).

As anyone who has ever done any information law ever will know, the APPGER litigation concerns requests under FOIA for information related to alleged British involvement in extraordinary rendition. Some information has been released, some has been released following earlier rounds of litigation, some remains withheld under various exemptions.

Following previous hearings staying various points, the present round of litigation concerned the application of section 23 (the security bodies exemption) and section 27 (international relations). There were two points of wider interest discussed in particular. One is the time at which the public interest is assessed (relevant to section 27), and one is the breadth of the “relates to” limb of section 23.

The time point was one which only really arose because of the Upper Tribunal’s desire to throw a mangy cat amongst the pigeons by suggesting in Defra v ICO & Badger Trust [2014] UKUT 526 (AAC) at [44]-[48] that the correct time to assess the public interest might be the date of Tribunal hearing. As some wise and learned commentators have pointed out, this rather seemed to have been overtaken by the Supreme Court’s – technically obiter – reasoning in R (Evans) v Attorney General [2015] UKSC 21 at [72]-[73] that the time was at the point of the authority’s refusal.

The Upper Tribunal in APPGER (containing at least one member of the panel in Badger Trust) issued a mea culpa and accepted that Evans was right: at [49]-[57]. It did not reach any more specific decision on situations where, for example, the authority has been late in complying. Doubtless the difference in time will often not matter very much. But the principle of the point now seems resolved.

Section 23(1) was not a point answered by Evans, and an argument was run by the requestor that “relates to” should be construed narrowly, as in the DPA. The Upper Tribunal disagreed: at [15]-[19]. The ordinary meaning of the language was broad, it was consistent with the aim of shutting the backdoor to the security bodies, it was consistent with authority, and met the contextual aim of FOIA where the contextual aim of the DPA was very different. The idea of requiring a “focus or main focus” was rejected.

Whilst agreeing that it should not attempt to gloss the statutory language, the Upper Tribunal nonetheless sought to assist future cases by indicating that asking whether the information requested had been supplied to a security body for the purposes of the discharge of its statutory functions (a test attributed to Mitting J) would have considerable utility. It would enable a clear explanation, it would allow differentiation within and without the scope of the exemption, and it was less likely to require a detailed line-by-line approach to redactions: at [33]. The language remains broad, but the practical application of it appears to have been ‘guided’ into a slightly narrower pigeon-hole than might have otherwise been the case.

The judgment as a whole is worth reading on the application of those exemptions to the particular information and the treatment of the evidence by the Upper Tribunal, but those two points of principle are the keys to take away. And about time too.

Timothy Pitt-Payne QC and Joanne Clement appeared for APPGER; Karen Steyn QC appeared for the FCO; Robin Hopkins appeared for the ICO.

Christopher Knight