Neutral Citation No: [2024] NIKB 66
Judgment: approved by the court for handing down
(subject to editorial corrections)*
Ref: COL12588
ICOS No: 20/15928/01
Delivered: 30/08/2024
IN THE HIGH COURT OF JUSTICE IN NORTHERN IRELAND
___________
KING'S BENCH DIVISION
(JUDICIAL REVIEW)
___________
IN THE MATTER OF AN APPLICATION BY RAYMOND McCORD
FOR JUDICIAL REVIEW
BETWEEN:
RAYMOND McCORD
Applicant
and
THE LEGAL SERVICES AGENCY FOR NORTHERN IRELAND
Respondent
___________
Mr Ronan Lavery KC with Mr Conan Fegan (instructed by McIvor Farrell Solicitors)
for the Applicant
Mr Tony McGleenan KC with Mr Christopher Summers (instructed by the Departmental Solicitor's Office) for the Respondent
___________
COLTON J
Introduction
[1] The applicant describes himself as a "peace campaigner." He has been active in the public domain in relation to victims' rights seeking, in particular, answers to the circumstances in which his son was murdered by loyalist paramilitaries in November 1997. Over the years he has been involved in high profile public law litigation. Amongst such litigation were legal challenges he brought to steps taken by the government to implement the result of the referendum on the UK's withdrawal from the European Union - the "Brexit litigation."
[2] By letter of 30 August 2019, Jim Allister QC, MLA, made a Freedom of Information (FOI) request to the Legal Services Agency (LSA) for a list of all the occasions on which the applicant was granted civil legal aid, the subject matter of each and the amount of legal aid expended.
[3] By email of 2 September 2019, Carla Lockhart MLA, made a FOI request to Peter May (the Permanent Secretary to the Department of Justice) regarding the grant of legal aid to Mr McCord for a "Brexit challenge" in the High Court.
[4] By letter of 24 September 2019, Gregory Campbell MP, made a FOI request to the LSA regarding legal aid costs of three high court hearings of a case relating to the government's Brexit strategy brought by the applicant.
[5] The request from Mr Allister was considered by the respondent and it was decided that it was in the public interest that the information should be disclosed as it related to the administration of public funds. The applicant's solicitor was informed of this decision on 2 October 2019 inviting him to make any representations he felt necessary in respect of the proposed response to the FOI request.
[6] There followed a series of correspondence between the applicant and the respondent, during which the respondent sought legal advice, conducted an internal review but, ultimately, concluded that the information sought should be disclosed, subject to some exceptions which are referred to later in this judgment.
[7] By these proceedings the applicant seeks to challenge the respondent's decision to:
"(a) To release or publish on 17 February 2020, the applicant's personal data (to wit, a list of the applicant's legal aid certificates and all payments made thereunder) under the Freedom of Information Act 2000 before the Information Commissioner has had the necessary time to investigate, consider and determine a complaint made by the applicant to release the said personal data; and/or
(b) The decision to release the personal data at any time at all of the proceedings."
[8] This matter initially came before Keegan J. At the risk of repetition and over‑elaboration, it is nonetheless necessary to refer to the judgment delivered by Keegan J on 24 February 2020 in McCord's Application for Leave [2020] NIQB 17, in light of the way this application was argued before the court.
[9] Having summarised the background to the case referring to the final decision letter which provoked the judicial review application Keegan J says:
"[14] What is important to note is that in the concluding pages of the decision letter the LSA states that:
'The Agency is also of the view that the indication that Mr McCord will seek an urgent injunction to prevent publication is misplaced, as Mr McCord has a statutory remedy. If Mr McCord believes that the Agency's final reply is not in accordance with the Freedom of Information Act 2000, he may ask for an internal review within two calendar months of the date of the Agency's final response. If you request a review, you should do so in writing stating the reasons.
If following an internal review Mr McCord remains dissatisfied, he may make a complaint to the Information Commissioner and ask him to investigate whether the DOJ has complied with the terms of FOIA.'
The LSA provided contact details of the Information Commissioner ("ICO").
[15] Further correspondence followed but of particular note is an e-mail exchange immediately prior to these proceedings. Specifically, the applicant's solicitor emailed the proposed respondent on 11 February stating as follows:
'We refer to your review decision of 5 February 2020. We write to advise that our client wishes to make a complaint to the Information Commissioner, subject to an undertaking from you that you will not release any information whatsoever until the Information Commissioner makes a decision in respect of our client's complaint. Please provide us with the undertaking sought by close of business 12 February 2020, otherwise we have instructions to seek urgent injunctive relief without any further notice to you.'
[16] This e-mail was replied to by e-mail of 12 February 2020 in which the LSA stated as follows:
'I note that, further to my review decision of 5 February, Mr McCord intends to exercise his right to complain to the Information Commissioner. You have requested that an undertaking be provided that no information whatsoever be released until a decision has been made by the Information Commissioner in respect of Mr McCord's complaint. I write to advise that no such undertaking is to be provided. This matter has been carefully considered and I can confirm the position is, as previously set out, that the information will be released on 17 February in accordance with the review decision.'
[17] A further important piece of information is contained in an e-mail from the ICO to the applicant's solicitor dated 13 February 2020. This states as follows:
'Reference our telephone conversation this morning regarding the above, many thanks for sending me through correspondence and submissions for consideration. As you are aware, these contain a voluminous amount of information, which will take some weeks to read through and provide a view regarding the proposed disclosure of personal data and consideration of exemptions under FOIA as well as consideration of the Data Protection Act 2018 and the General Data Protection Regulation 2018 GDPR. Please keep me updated with developments regarding this and in the meantime, I will give the matter consideration and form a preliminary view as to what action, if any, the Commissioner can take in such an instance.'
[18] The above has all led to a position where the Information Commissioner has a complaint before it which is under consideration. The court is effectively being asked to assume a supervisory role in addition to this and to provide some interim relief pending adjudication. This application therefore throws up some interesting issues which must be examined in the context of the statutory scheme."
[10] The matter first came before Keegan J on 14 February 2020 on an emergency basis. Those proceedings were adjourned on the basis that the respondent gave an undertaking not to release the information in the meantime.
[11] When delivering her judgment on 24 February 2020, Keegan J granted leave in respect of the decision referred to in para [7](a) above.
[12] Upon granting leave Keegan J considered the issue of interim relief, stating at para [35] of her judgment:
"[35] ... I propose to grant leave regarding the point raised by the applicant at (a) in the Order 53 statement, that is whether or not personal data should be released in the interim pending the progression of the complaints process. I am minded to join the ICO as a Notice Party and ask for an update within one week of today's judgment and, in particular, I would welcome a view from the ICO regarding the interim position. I invite the proposed respondent to continue the undertaking in the meantime, to be kept under review, otherwise I will issue interim relief by way of an injunction or declaration as I consider that relief is merited otherwise the applicant at the moment is left without any remedy."
[13] That undertaking was given by the respondent.
[14] In respect of the challenge to the decision identified at para (b) of the Order 53 Statement, at para [29] of her judgment Keegan J says:
"[29] One aspect of the judicial review before me, contained in (b) of the Order 53 clearly overlaps with the territory of the ICO. This alternative remedy is being utilised. That, it seems to me, militates against judicial review in relation to the question of whether or not the information should be released ie the claim comprised in (b) of the Order 53 Statement. There is nothing apparent from my examination of the facts that would make me think a parallel judicial review process is required to deal with this issue. However, rather than dismiss the claim at this stage I intend to stay the matter pending the response from the Information Commissioner. I do this out of an abundance of caution and in case there might be some impediment to the Information Commissioner dealing with the substantive aspect of the case, whether or not the LSA were right to decide to release this personal data."
[15] It will be seen, therefore, that it was the hope of Keegan J that this matter could be resolved via the applicant's complaint to the Information Commissioner's Office (ICO). Since the judgment, there was further correspondence with the ICO. The judicial review application stalled as a result of complications arising from that correspondence.
[16] On 3 March 2020, the ICO wrote to the applicant's solicitor in response to being asked to provide an update or preliminary view in respect of the applicant's complaint. It was indicated that:
"We intend to respond substantively to that correspondence in due course, but are not in a position at this stage to give a preliminary view on what is an undoubtedly complex matter."
[17] In respect of the ICO's views on the interim position in a "case such as this" it was stated:
"As we understand it, the 'interim position' is a question as to whether the Commissioner had any power to make some form of 'interim position' order prohibiting the disclosure of personal data."
At para [34] of the draft judgment Mrs Justice Keegan suggests that Article 58(2)(f) of the GDPR may provide an answer to this question.
Article 58(2)(f) provides that supervisory authorities, such as the Commissioner, shall have the power "to impose a temporary or definitive limitation including a ban on processing." By virtue of section 115(8) of the Data Protection Act 2018 (the Act), this power is exercisable only by the issuing of an Enforcement Notice under section 149 of the Act.
An Enforcement Notice can only be issued under section 149(1) where the Commissioner is satisfied that a person failed, or is failing to comply, with any of the provisions set out in sub-sections (2) to (5). Where the Commissioner is so satisfied, the notice can require the person to whom it is addressed to take or refrain from taking specified steps for the purpose of remedying the failure in question.
It follows that the Commissioner can only issue an Enforcement Notice once he is satisfied that there has been failure to comply with the Data Protection Legislation. It does not provide a basis for issuing an interim." [my emphasis]
[18] On 26 March 2020, the ICO provided an update in the following terms:
"Article 77 of the GDPR provides that a data subject may make a complaint to a supervisory authority if he/she considers that the processing of personal data relating to him/her infringes the GDPR. It might be helpful to explain that the obligations placed on supervisory authorities by this part of GDPR are enacted via section 165 of the DPA 2018.
As you may be aware, if the ICO receives a complaint under sub-section 2 of the above section of the DPA 2018, the Commissioner must take appropriate steps to respond to the complaint and inform the complainant of the outcome. These steps include investigating the subject matter of the complaint (to the extent to which it is appropriate) and informing the complainant regarding progress on the complaint including whether it is necessary to further investigate the complaint or to coordinate with another supervisory authority or foreign designated authority.
We, of course, appreciate your client's concern that there may be an infringement of the DPA or the GDPR in the future, should the Data Controller of the Legal Services Agency not have applied the correct consideration or interpretation of our guidance, or have correctly followed the safeguards that exist to protect personal data when freedom of information requests are submitted? However, at this point our decision is that there are no infringements of the DPA or the GDPR and that, therefore, we are taking no regulatory action at this time." [my emphasis]
[19] Importantly, on 29 June 2020, the ICO provided further correspondence to the parties and directly to the court in the following terms:
"The ICO has considered all issues arising under both the FOIA (under which the request for information was made) and the General Data Protection Regulations 2018 (GDPR)/Data Protection Act 2018 (DPA) and I have set out our position below:
Case considerations under the FOIA and the GDPR DPA 2018
Where a request has been made under the FOIA, personal data is 'processed' if it is disclosed in response to that request. This means that the information can only be disclosed if disclosure would be lawful, fair, and transparent.
Article 6(1) of the GDPR specifies the requirements for lawful processing. It states that processing shall be lawful only if, and to the extent, that at least one of the lawful basis for processing listed in the Article applies. In this case, the Commissioner considers that the most applicable lawful basis is provided by Article 6(1)(f), this states:
'Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except which interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular, where the data subject is a child.' [original emphasis]
Having perused the requested information and the arguments for and against disclosure by the Legal Services Agency and the applicant respectively, the ICO considers that any legitimate public interest in disclosure of the information is overridden by the fundamental rights and freedoms of the data subject, ie the applicant in this case. Therefore, it is opinion of the ICO that such disclosure would be likely to be both unfair and unlawful.
Please note that the ICO's opinion is in no way legally binding in this case, however, it should be of assistance to the court in making a final decision."
[my emphasis added]
[20] The ICO sent further correspondence on 25 July 2020 confirming the position as outlined in their correspondence on 29 June 2020:
"It is clear from the above and from our previous correspondence that the ICO has not changed its position regarding the potential disclosure of the requested information. Our letter to the court of 29 June 2020, which was copied to all relevant parties, made it clear we were providing our opinion, purely to assist the court in its decision making. However, this was in no way legally binding on any party. That remains the position."
[21] Following the exchange of further correspondence, various other applications and various reviews, the respondent indicated that its position had not changed and that it intended to release the requested information, though it would not do so until such times as the matter had been determined by the court.
The relevant data
[22] Before analysing the relevant legislation it is useful to set out the nature of the material it is proposed will be disclosed.
[23] The material in question consists of a two-column table containing the certificate narrative for each case for which legal aid was granted under the Access to Justice (Northern Ireland) Order 2003 ("the 2003 Order"); a succinct statement of the nature of the proceedings, the date and the proposed respondent, and any payment made, if known.
[24] The most extensive list applies to Mr Allister's request given its wider ambit. It contained 18 entries. As a result of internal reviews, it was determined that only 16 of these should be disclosed as they related to public law challenges. The remaining two were essentially private matters.
The statutory framework
The legislation applicable to the LSA
[25] Article 24 of the Legal Aid, Advice and Assistance (Northern Ireland) Order 1981 provided that information furnished to any person in connection with legal aid, advice or assistance could not be disclosed save in very limited circumstances, or with the consent of the applicant (which does not apply here).
[26] This position was altered by Article 3(2) of the 2003 Order, whereby the prohibition on disclosure was made subject to Regulations.
[27] The Civil Legal Services (Disclosure of Information) Regulations (Northern Ireland) 2015 provides at Regulation 3:
" 3.—(1) This regulation applies to information which is furnished—
(a) to the Department or any court, tribunal or other person or body on whom functions are imposed or conferred by or under Articles 12A to 20A of the Order, and
(b) in connection with the case of an individual seeking or receiving civil legal services funded by the Department.
(2) Information as described in paragraph (1) may be disclosed—
(a) in accordance with the law of Northern Ireland or a court order;
..."
[28] The prohibition of disclosure of information is, therefore, subject to a discretion whereby the information may be disclosed, inter alia, in accordance with the law of Northern Ireland. Therefore, the relevant data in this case relates only to applications made after 1 April 2015, under the 2003 Order.
The law of Northern Ireland in relation to the disclosure of information
[29] The relevant law in Northern Ireland is to be found in the Freedom of Information Act 2000 ("FOIA"), the General Data Protection Regulations 2018 ("GDPR") and the Data Protection Act 2018 ("DPA").
[30] Section 1(1)(a) of the FOIA imposes upon a public body (here the LSA) a duty to confirm or deny whether it holds the information sought, subject to a number of exemptions.
[31] In this case the relevant exemption is contained in section 40 which provides:
" 40 Personal information
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if—
(a) it constitutes personal data which does not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a) would contravene any of the data protection principles, or
...
(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—
(a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—
(i) would (apart from this Act) contravene any of the data protection principles, or
...
(7) In this section—
"the data protection principles" means the principles set out in—
(a) Article 5(1) of the GDPR, and
(b) section 34(1) of the Data Protection Act 2018;
...
(8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted."
[32] In accordance with the ICO decision in Philpott (FS50563489, 11 May 2015) the information sought by the elected representatives in this case constitutes the applicant's personal data.
[33] It is also beyond dispute that the disclosure of the proposed data constitutes "processing" within the statutory framework.
[34] The issue in this case is whether the disclosure would breach the data protection principles which are set out at Article 5 GDPR.
[35] The relevant principle in this case is the first principle which provides that processing of data must be lawful, fair and transparent.
[36] In order to be lawful, the processing must meet one of the conditions set out in Article 6 GDPR.
[37] The respondent relies on Article 6(1)(f) which states:
"(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data."
[38] The applicant also argues that the exemptions set out in sections 41 and 42 of FOIA are relevant.
[39] Section 41 relates to information provided in confidence and provides:
" 41 Information provided in confidence
(1) Information is exempt information if—
(a) it was obtained by the public authority from any other person (including another public authority), and
(b) the disclosure of the information to the public (otherwise than under this Act) by the public authority holding it would constitute a breach of confidence actionable by that or any other person.
(2) The duty to confirm or deny does not arise if, or to the extent that, the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) constitute an actionable breach of confidence."
[40] Section 42(d) provides:
" 42 Legal professional privilege
(1) Information in respect of which a claim to legal professional privilege or, in Scotland, to confidentiality of communications could be maintained in legal proceedings is exempt information.
(2) The duty to confirm or deny does not arise if, or to the extent that, compliance with section 1(1)(a) would involve the disclosure of any information (whether or not already recorded) in respect of which such a claim could be maintained in legal proceedings."
The parties' arguments
[41] Mr Lavery argues that the court should approach this case in two parts. Firstly, he argues that the court should exercise its inherent supervisory jurisdiction to prevent the respondent acting unlawfully and unfairly in breach of the applicant's data rights as portended by the ICO. Relatedly, he submits that the applicant had a legitimate expectation that the respondent would abide by the ICO's opinion expressed in its correspondence on 29 June 2020.
[42] Secondly, he argues that the court should only consider the substantive case if it is against the applicant on the first argument.
[43] The first submission relies on the argument that the court should adopt the opinion of the ICO as the specialist body tasked with the supervision of data protection in this jurisdiction. Given that the ICO has failed to take any enforcement action, the applicant looks to the court to enforce the stated opinion of the ICO.
[44] In addition, the applicant says that he had a legitimate expectation in law that the respondent would abide by the ICO's opinion. He argues that this expectation was engendered by letter dated 19 November 2019 in which the LSA said that if the applicant was dissatisfied "he may make a complaint to the Information Commissioner and ask him to investigate whether the DoJ has complied with the terms of the FOIA." He argues that the respondent created a legitimate expectation that it would abide by the ICO's opinion and that that expectation has been frustrated. The respondent's indication was that it will still release information notwithstanding that opinion.
[45] I do not consider this is the proper approach for a number of reasons. Firstly, I return to Keegan J's judgment in which she indicated that she would grant an interim injunction absent an undertaking by the respondent that it would not publish the material pending the ICO's consideration of the applicant's complaint. Clearly, that was appropriate in the circumstances which prevailed at that time. The court was "holding the ring" pending consideration of the matter by the ICO. It did not express any opinion as to the substantive issues raised in this application.
[46] The primary difficulty with this submission is that the ICO has not provided a "judgment", the term used by Mr Lavery in his submissions. The position in respect of the ICO opinion is clear on the face of it. It has provided an opinion without any reasoning whatsoever. It manifestly does not purport to be a determination of legal rights and obligations. Indeed, this is acknowledged expressly by the ICO when it states that this is "in no way legally binding."
[47] In any event, the court cannot give effect to any prohibitory or quia timet injunction grounded on the ICO opinion without forming its own view on the legal merits of the proposed disclosure. It seems to the court that it is unavoidable that it must determine for itself the substance of the legal issues raised in the Order 53 Statement to grant the relief sought to the applicant by way of an injunction or otherwise.
[48] The fact that the respondent agreed to provide an undertaking at the time of Keegan J's consideration of the matter in February 2020 does not constitute an express promise or substantive undertaking that would give rise to the legitimate expectation in law argued for by the applicant. Indeed, throughout the course of these proceedings, the respondent has indicated that it does intend to disclose the material subject to any decision of this court. This was clearly set out in its position paper of 24 March 2021 when the respondent sought a review of the application and the timetabling of the case for hearing.
[49] In relation to the ICO position generally, I make the observation that it seems to me contrary to the purpose of the legislative framework that the ICO can only act when a breach has actually occurred. There has been no application for judicial review of the ICO's position, and this matter has not been argued before me.
[50] I consider that adopting a two-stage approach is simply not an option and would be an arid exercise. The circumstances are such that the court must address the substantive legal issues in this case to resolve the dispute.
[51] In that event, I propose to turn to the decision identified in (b) of the Order 53 Statement, namely the decision to publish the relevant material.
[52] The applicant was not granted leave to argue this point in the particular circumstances of Keegan J's consideration in February 2020. I confirm that I grant the applicant leave on this issue.
[53] The substantive issue was fully argued before me at the hearing and the court has all the relevant information to deal with the matter.
Is the proposed disclosure compliant with the GDPR principles? Is it "lawful, fair and transparent?"
[54] In South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 at paras [19]-[23] the Supreme Court held that, in the context of personal data and FOIA requests, three questions required to be answered:
(i) Whether a legitimate interest was being pursued?
(ii) Whether the processing was necessary for the purposes of that interest?
(iii) Whether the processing was unwarranted by reason of any prejudice to the interests of the data subject?
[55] In answering the three questions posed in South Lanarkshire it is axiomatic that each case will depend on its own facts.
[56] That said, the issue in relation to publication of data relating to legal aid is not a new one and has been considered by the courts and the ICO on a number of occasions. Those decisions are not determinative of this case but, nonetheless, help chart a path for the court's decision.
A review of previous decisions
[57] On 8 October 2012, the ICO published a decision in the case of Abu Qatada FS50441223.
[58] In that case the complainant had sought the cost of legal aid provided to Abu Qatada in respect of his case before the Special Immigration Appeals Committee with a breakdown of all sums paid since 2008 to date.
[59] The Commissioner decided that by first maintaining that it did not hold the information and then by exempting it under section 40(2) section 31(1)(c) and section 43(2) the Legal Services Commission (LSC) did not deal with the request in accordance with the FOIA.
[60] The ICO directed that the information sought be provided. It should be noted that in this decision the relevant legislation was Schedule 2 condition (6) rather than the GDPR. Schedule 2 condition (6) permitted disclosure where:
"Necessary for the purposes of the legitimate interests pursued by the data controller or by third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights, freedoms and legitimate interests of the data subject."
[61] It will be seen, therefore, that the Commissioner was nonetheless considering identical principles and that he applied the three-part test set out above.
[62] The Commissioner was highly critical of the LSC decision. The decision states:
"27. The LSC did not provide any specific arguments as to how or why disclosure of the information would cause any unnecessary unjustified damage or distress to the data subject. The Commissioner considers that the actual amounts involved might result in the individual receiving further public criticism but he doubts whether any specific reputational damage would arise, given the notoriety of his case.
28. In relation to the individual's reasonable expectations, the Commissioner considers that given the high profile nature of the case it would not be unreasonable or unexpected that the public interest would require transparency on all aspects of the matter.
29. With regard to the legitimate interests of the public the Commissioner considers that:
· There is a legitimate public interest in the openness and accountability of the LSC as a public authority responsible for the expenditure of substantial public funds.
· The amount of legal aid involved having been subject to significant press speculation which reflects the power of the public interest in this case and terrorism cases in general.
· Disclosure of the information would augment and assist the public's understanding of the legal aid system and how it operates in such cases.
· An orderly disclosure of information would set the record straight.
30. Taking the above factors into account, the Commissioner is satisfied that the legitimate interests of the public are sufficient to justify the negative impact to the rights, freedoms and interests of the individual concerned. He therefore considers that disclosure of the information would be fair."
[63] In the ICO decision of Philpott, the Commissioner considered a request for information relating to legal aid payments made in respect of Michael and Mairead Philpott. The Philpotts were found guilty of manslaughter in relation to the deaths of six children in a house fire. As was the case in Abu Qatada this case pre-dated GDPR but the data principles under Schedule 2 applied.
[64] In that case the Ministry of Justice (MoJ) confirmed it held the requested information but refused to provide it citing section 40(2) (Personal Information) of the FOIA. The Commissioner decided that the MoJ incorrectly withheld the information.
[65] In considering the "legitimate public interest" test, the Commissioner said:
"35. Despite the reasonable expectations of individuals and the fact that damage or distress may result from disclosure, it may still be fair to provide the information if there is an overriding legitimate interest in disclosure to the public. Under the first principle, the disclosure of the information must be fair to the data subject, assessing fairness involves balancing their rights and freedoms against legitimate interest in disclosure to the public.
...
37. With regard to the legitimate interests of the public the Commissioner considers that:
· There is a legitimate public interest in the openness and accountability of the LSA as a public authority responsible for the expenditure of substantial public funds.
· The case had been subject to significant press and public interest.
· The issue of legal aid, who qualifies and how much they get is a matter of some debate.
· Disclosure of the information would augment and assist the public's understanding of the legal aid system and how it operates in such cases.
38. Taking the above factors into account, the Commissioner is satisfied that the legitimate interests of the public are sufficient to justify any negative impact to the rights, freedoms and interests of the individuals concerned. We, therefore, consider the disclosure would be fair."
[66] In its decision the Commissioner expressly identified the three questions set out in the South Lanarkshire case and considered that it was necessary to disclose the requested information.
[67] In ICO v Halpin [2019] UKUT 29 (AAC) the Upper Tribunal Appeals Chamber considered a request made by Mr Halpin to the Devon Partnership NHS Trust ("the Trust") under the section 40(2) of the FOIA for information about two named social workers employed by the Trust. He said:
"I would like to know the dates that they have undertook training for doing assessments under the Care Act 2014 section 9 and also the training they have received for implementation of Care Act 2014 and any qualifications so received."
[68] The Trust refused the request. The Trust's position was that it considered the level of detail sought would be overly intrusive, that neither individual was a senior manager, nor holding a position within the Trust that warranted a greater level of accountability, and that professional registration could be verified by other means to professional bodies. They said that FOIA requests had been used to target individual members of staff by individuals dissatisfied with the care received and so would normally refuse that level of data sought, although each case was considered on its merits.
[69] The Information Commissioner agreed that the exemption applied. Mr Halpin appealed to the First Tier Tribunal (FTT), which decided the information was not exempt.
[70] The Upper Tribunal allowed the Commissioner's appeal and remitted the power to a differently constituted Tribunal.
[71] In the decision of the ICO-104906-L7P6 of 6 December 2021, the Commissioner upheld the decision of the respondent who refused to release requested information in relation to the granting of legal aid in a private law matter.
[72] In that case in considering any legitimate interests in confirming whether the requested information was held the Commissioner recognised that such interests could include broad general principles of accountability and transparency for their own sake as well as case specific interests.
[73] In discussing the necessity test the Commissioner said:
"33. 'Necessary' means more than desirable but less than indispensable or absolute necessity. Accordingly, the test is one of reasonable necessity which involves a consideration of alternative measures; so, confirming whether or not the requested information is held would not be necessary if legitimate aim could be achieved by something else. Confirmation or denial under a FOIA as to whether the requested information is held must therefore be the least intrusive means of achieving the legitimate aim in question.
34. The Commissioner is aware that LSANI does not routinely publish the amounts of legal aid granted to individuals in family law cases. Furthermore, the Commissioner is also aware that LSANI has avenues in place dedicated to the reporting and investigation of suspected legal aid fraud, whereby any personal data involved in the matter would only be made available to the appropriate personnel within the Counter Fraud Team for the purpose of conducting an investigation into the alleged fraud and determining if any wrongdoing has occurred, rather than being disclosed to the world at large.
35. He is, therefore, satisfied that to confirm or deny that the information is held would not be necessary in this case, and there are less intrusive means of achieving the legitimate aims identified."
[74] In the ICO decision of FS50076855 dated 23 October 2006, the complainant requested information on the amount of money his opponent in legal proceedings had received in legal aid. The LSC refused the request on the basis that the information constituted personal data about the complainant's opponent and so was exempt under section 40(2) of the Act. The Commissioner agreed with the LSC that the information was personal data. Furthermore, although it was likely that some of the information requested was already known by the complainant as a consequence of his involvement in the legal proceedings, disclosing information to the public at large, which was the test under section 40(2), would breach the DPA. Therefore, the Commissioner agreed the information was exempt and upheld the LSC's decision to refuse the request.
[75] In the course of the decision the Commissioner said at para 32:
"32. It is true to say that when assessing compliance with the first data protection principle some public interest arguments may feed into the consideration of whether the process is fair or may help shape the reasonable expectations of the data subject. However, the Commissioner is satisfied that it would not be fair to the data subject in this case to disclose the precise outcome of a particular decision by the LSC at the costs of the privacy to an individual who sought to claim a benefit to which he was entitled."
[76] In the ICO decision FS50566444, the Commissioner upheld a decision of the MoJ not to disclose information to a complainant about legal aid costs relating to several cases involving named individuals. The MoJ had neither confirmed nor denied holding the requested information citing Section 40(5) (Personal Information) of the FOIA.
[77] The decision sets out the applicable law and in balancing the rights and freedoms of the data subject and the legitimate interests of the public said in relation to reasonable expectations:
"35. MoJ stated that there is no expectation on the part of the AAA's funded clients that such information, if held, would be disclosed. It also considers that the named individual should not hold an office, an official position or post that would lead them to expect greater levels of transparency.
36. On this occasion, the Commissioner is satisfied that the data subjects would reasonably expect their personal data, if held, would not be disclosed."
[78] The Commissioner concluded:
"39. The Commissioner appreciates that there is a general public interest in accountability and transparency, and that the public is entitled to be informed about the legal aid costs relating to prosecutions.
40. On the other hand, the Commissioner recognises that this legitimate interest must be weighed against any unwarranted prejudice to the rights and freedoms or legitimate interests of any individual who would be affected by confirming or denying that the requested information is held.
41. In considering whether the exemption contained within section 40(5)(b)(i) was correctly applied, the Commissioner has taken into account that disclosure under the FOIA should be considered in its widest sense - which is to the public at large. A confirmation or denial in the circumstances of this case would reveal to the public information which is not already in the public domain.
42. With due regard to the reasonable expectations of the data subjects, and the potential impact on them if the existence of their personal data were to be confirmed or denied, the Commissioner considers that it would be unfair to do so. While he accepts that there is a limited legitimate interest in the disclosure of this information, he does not consider that this outweighs these other factors."
[79] The decision does not provide any background to the relevant proceedings in respect of which legal aid was granted and the extent of any public interest in those cases.
[80] In the Commissioner's decision of IC-185709-Q0S3 of 9 November 2022, the complainant had requested information as to the fees paid to two barristers in a case involving an action against the Metropolitan Police.
[81] In respect of those fees the Commissioner found that the MPS was correct to withhold the amounts paid under section 40 of the FOIA.
[82] Consideration of the ICO decision reveals that the determining factor in that case was that whilst the ICO considered there to be a legitimate public interest in disclosure of the amount of legal aid, a balancing exercise was required against the overall value of the legal aid paid in the relevant case. At para 51 the Commissioner states:
"...as the fees for these individuals only form a small part of the overall costs of the appeal, the Commissioner considers that the value of disclosure here is considerably diminished as it in no way reflects the accurate overall cost to the general public."
[83] Finally, in his affidavit Mr Andrews, the Chief Executive of the LSA, refers to decisions taken by the Legal Aid Agency to publish the amount of legal aid funding provided to Shamima Begum in connection with her Special Immigration Appeals Commission proceedings and the decision to publish the amounts of legal aid expenditure in relation to an individual named Michael Weir.
[84] He further refers to the respondent's decision not to disclose to Sean McAteer legal aid paid to an individual in relation to family law proceedings.
Application of the legal principles
[85] These decisions provide a useful guide to the court in determining the issue in this case. Unsurprisingly, each of the parties seek to rely on these decisions in support of their arguments or, alternatively, distinguish them depending on the outcome they seek.
[86] Nonetheless, it seems to the court that common principles emerge from consideration of the decisions. How then should the court approach the issue in this case?
[87] I turn to the first question posed in South Lanarkshire, namely whether there is a legitimate interest being pursued in publishing the data.
[88] On behalf of the applicant, Mr Lavery complains that the aim of the requestors is to make political points against Mr McCord. He says this is clear from what he describes as the pejorative language used by Mr Allister in his FOI request with references made to "yet another judicial review" by "this serial litigator" and to his "dismay" at the generosity of the LSC towards Mr McCord.
[89] It is clear from media material disclosed in the course of these proceedings that Mr Allister and Mr McCord have engaged publicly on this issue. Thus, it is reported in the Irish News on 3 September 2009 under the heading "Raymond McCord hits out at Jim Allister over legal aid row" that the applicant has accused Mr Allister of "arrogance" after the politician criticised him for receiving legal aid for a series of court challenges.
[90] Mr Lavery points out that Mr Allister has made no similar request in respect of any other person, including the other litigants who brought similar challenges to aspects of the Brexit legislation. He submits that the use of Mr McCord's personal data, should it be disclosed, will be for purposes of further public attacks on Mr McCord's character which would not be a "legitimate interest."
[91] It is clear from the media reporting that Mr Allister does not support Mr McCord's actions. His commentary on the legal aid issue is made from the point of view of an elected representative who supported Brexit and his concerns to protect the public purse. I consider that the debate is typical of the wider public discussion about Brexit, often expressed in emotive and robust terms. Indeed, since these proceedings have been issued Mr Allister joined with others in pursuing an unsuccessful claim challenging the outworkings of the Brexit legislation in both the High Court, the Court of Appeal and Supreme Court. Similarly, members of the same political party as Mr Campbell and Ms Lockhart were found to have acted unlawfully by the courts in actions they took in protest against the Protocol/Windsor Framework. Those cases involved significant, but as far as I am aware, undisclosed expenditure of public money by various government departments.
[92] There is no indication, from what I have seen, that Mr Allister has made any improper use of the fact that Mr McCord has been granted legal aid or that it has been used by others to threaten or harm him.
[93] The most important point, in my view, relates to the very public law nature of the proceedings brought by the applicant. He, himself, has averred that these proceedings were brought in the public interest. The applicant has already publicly acknowledged that he was in receipt of legal aid assistance in pursuit of the aforementioned litigation. In those circumstances, it seems to the court that the respondent is entitled to conclude that there is considerable public interest in the fact and extent of provision of funding for public law challenges in general and the public law challenges brought by the applicant in particular. In accordance with the decisions to which I have referred the requested information would inform public debate and provide context, insight and transparency into the operation of the Civil Legal Aid scheme. In my view, there is a legitimate public interest in the openness and accountability of the LSA as a public authority responsible for the expenditure of substantial public funds. It is significant that the respondent is dealing with a request made by elected public representatives. The respondent has limited the information it proposes to disclose to the details of legal aid expenditure in relation to public law cases, but not to the other forms of proceedings including private law and coronial proceedings.
[94] Turning to necessity of disclosure in South Lanarkshire it was accepted that the assessment of the necessity of disclosure meant that an interference with a recognised right required a "pressing social need" and proportionality between the means employed and the ends achieved.
[95] In the court's view the pressing social need arises from the legitimate public interest in disclosing the information as analysed in the above paras. On this issue Mr Lavery relies on the decision in the Halpin case. It is clear from the reasoning of the Upper Tier in that decision that the information sought related to two individual health workers who had no public profile. This is a very different case. It seems to the court, ultimately, that to meet the legitimate interest identified above, disclosure of the data sought is necessary and proportionate, subject to rights and freedoms of the applicant discussed below.
Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or the legitimate interests of the data subject?
[96] This is the crux of the issue to be determined by the court. In doing so the court has to carry out a balancing exercise. In terms of whether the applicant was, in fact, granted legal aid it seems that he can have no expectation of privacy in respect of that issue. The fact that he has received legal aid is already in the public domain. It would also be clear from some of the court orders that were made in relation to rulings on costs.
[97] Turning to the question of disclosure of the amounts paid in respect of each of the public law challenges, the applicant relies on his right to privacy as a "non-public individual", the impact on his health and his expectations that when he sought legal aid the information would not be disclosed.
[98] It is important to consider the status of the applicant. True it is, that he is not an elected politician. He holds no official public role or title. However, his contention that he is a private individual sits uneasily with his own description as a "peace campaigner" and his various interviews with the media including when he challenged the public claims made by Mr Allister about the appropriateness of him being granted legal aid.
[99] In many respects the applicant's position aligns with the doctrine in American libel laws of the "limited-purpose public figure." The doctrine relates to persons who inject themselves into the public controversy regarding a high-profile public issue. Thus, an otherwise private person, who is not an elected official or holds public office, can be regarded for certain purposes as a public figure as it relates to that particular topic. Self-evidently, the applicant has injected himself into the public discourse on a number of high-profile cases which are of obvious and manifest interest to the public. This is particularly so in relation to Brexit litigation.
[100] The applicant raises concerns in relation to a history of viable death threats arising directly from the cases he has brought. He avers that he has been harassed by members of the public on the street and online who refer to his ongoing cases. This includes UVF poster campaigns targeted against him. As a result, he has had to put in place security measures for his own protection. He has been issued with verifiable PM1 forms (Notification of threats to life) by the Police Service of Northern Ireland (PSNI) from loyalist paramilitaries.
[101] The court does not doubt for one minute that these threats have been made and are of real concern to the applicant. However, it seems to the court that they primarily arise from his efforts in relation to the murder of his son by loyalist paramilitaries.
[102] Mr Lavery points to the fact that others involved in Brexit litigation, including Joanna Cherry, Joe Maughn and Gina Millar also received death threats as a result of their involvement in Brexit related litigation.
[103] The applicant has provided medical evidence to the respondent which points to the distress and the impacts on his mental wellbeing should there be disclosure of the sums paid in legal aid. I do not propose to go into the detail of the medical report other than to say that I do not doubt Mr McCord's subjective distress. However, I do not see that there is sufficient evidence to indicate that the publication of the proposed data will increase the potential harm which could be suffered by the applicant. I do not consider that the applicant has established a potential interference with his article 2 and article 3 rights should the data in question be published. The material in support of this submission falls well short of the high threshold required to establish such an interference.
[104] To some extent this has already been touched on by Keegan J in her leave judgment when she looked at the question of anonymity. At para [7] et seq she says:
"[7] In relation to Article 2 I remind myself of the basic principles set out in Osman v The UK [1998] 5 BHRC 293. I have been referred to press reports wherein the applicant has commented publicly on threats upon life due to his pursuit of matters relating to his son's case. That is a matter of public record. In my view there is no nexus between this case and that serious concern and so I do not consider that the high threshold is met as required by law to ground an application for anonymity on the basis of Article 2.
[8] Also, given the long history of litigation taken by this applicant in relation to his son and other issues, it cannot realistically be said at this time that there is an impediment to bringing proceedings without anonymity. The applicant is a public campaigner and so any application grounded on Article 6 is in my view highly incongruous and flawed.
[9] The only possible basis for an application is Article 8 of the Convention which is a qualified right. I have read the evidence presented by the applicant regarding his distress which he relates to these proceedings. I have also read a letter from a counsellor. I accept that some distress from publicity will be occasioned. However, I must also bear in mind that this applicant has publicly stated that he has been in receipt of legal aid in relation to some of his cases. As such it seems to me that applying a balance, the public interest in this issue outweighs the distress which will be experienced by the applicant. It follows that anonymisation is unsustainable."
[105] It seems to the court that this reasoning is also relevant in considering the assertion of a breach, or potential breach, of the applicant's article 2 and 3 rights.
[106] I accept that the disclosure of the actual figures involved does, come within the ambit of the applicant's article 8 rights, but I consider that any such interference is justified when I conduct the relevant balancing exercise. The interference is in accordance with law for a legitimate purpose and is proportionate. I note that in the review that was carried out on behalf of the respondent, the reviewer asked herself whether the objective of providing informed public debate could be achieved by a lesser means, such as the publication of official statistics, or the publication of a global figure relating to Mr McCord's litigation. Her opinion was that:
"In line with authority I do not believe that the first option is sufficient. In relation to the second, an uninformed global figure might provoke more rather than less debate."
[107] In considering this matter, I have had regard to all the correspondence and to the affidavit evidence served by Mr Andrews on behalf of the respondent.
[108] From that correspondence it is clear that the respondent has expressly referred itself to the ICO's section 40 guidance. The respondent has asked the right questions and, in the court's view, for the reasons set out above, has come to a lawful conclusion.
Sections 41 and 42 of the FOIA Act
[109] The applicant also raises a potential exemption under section 41. I consider that the section 41 exemption is not engaged as the Civil Legal Services (Disclosure of Information) (Regulations (Northern Ireland) 2015 specifically permits the release of personal data relating to civil legal aid provided it is in accordance with the laws of Northern Ireland. As should be apparent from the discussion set out above the proposed processing in the court's view would be in line with the laws of Northern Ireland and so this exemption is not in play.
[110] Relying on section 42 of the FOIA the applicant contends that the information sought is protected by professional legal privilege. In this regard the applicant relies on two cases from the 19th Century in the Torton v Barbour [1874] LR 17 Eq329 and Chant v Browne [1852] 9 Hare 790. Those cases determined that legal professional privilege attaches to bills of costs between solicitors and clients.
[111] The applicant also relies on the ICO decision IC-185709-Q053 of 9 November 2022 discussed above. It will be recalled in that case the ICO decided that two barristers had legitimate expectation that their fees would not be disclosed and, accordingly, disclosure of requested information would be unlawful. In carrying out the balancing exercise in that case, the ICO concluded:
"As the fees to these individuals only form a small part of the overall cost of the appeal, the Commissioner considers that the value of disclosure here is considerably diminished as it in no way reflects the accurate overall cost to the general public."
[112] In any event, this application is not brought by the legal representatives of the applicant. Indeed, they have disavowed any reliance on their rights as data subjects. The concern in the Commissioner's case was that a partial presentation of the extent of legal aid provision for counsel would provide a misleading picture of the overall extent of legal aid provision. As discussed earlier, this is in contrast in the instant case where the respondent has decided to release the accurate total cost to the public legal aid fund of the public law litigation pursued by the applicant.
[113] Turning to the cases quoted, both these decisions predate the modern law of information protection by over a century. Neither decision is on point because the issues related to whether the content of the Bill of Costs being a record of the work performed in relation to the cases was privileged. I agree with Mr McGleenan's submissions that those decisions are not authority for the proposition that the amounts paid on foot of legal aid certificates are privileged and this has clearly not been the approach adopted by the ICO and the courts in previous cases as is clear from the review set out above.
Conclusion
[114] I conclude that the decision of the respondent is in accordance with the law of Northern Ireland. The information has been sought by elected representatives pursuant to a statutory regime that is intended to provide freedom of information. The request by Mr Allister and others is made in the context of his view on the appropriateness of an individual bringing cases in relation to important public law issues with the assistance of legal aid and the fact that other, in his view, more meritorious cases, do not receive legal aid. I agree with Mr Andrews' assessment that this is within the realm of legitimate public comment by an elected representative who is seeking to highlight what he considers the inappropriate use of the legal aid fund to support litigation.
[115] The release of the proposed data will ensure transparency in relation to the disbursement of public monies by the LSA in public law challenges said to have been brought in the public interest. There are no private interests in play in such litigation and in carrying out the balancing exercise it seems to the court that the applicant cannot complain of any breach of privacy in respect of his pursuit of high‑profile public interest litigation in circumstances where he himself has commented publicly on the issues. Ultimately, the provision of the information to elected representatives will serve to further inform public discourse about the operation of the legal aid scheme. Disclosure of the information will augment and assist the public's understanding of the legal aid system and how it operates in such cases. Disclosure is in the interests of public transparency.
[116] In the court's view, disclosure is in accordance with the law of Northern Ireland, meets the requirements of articles 5 and 6 of GDPR in that the proposed disclosure is lawful, fair and transparent and in accordance with article 6(1)(f) of GDPR.
[117] Judicial review is, therefore, refused.
BAILII: