Bilgi Edinme Sürecinde Kişisel Verilerin Geçici Korunması

Neutral Citation No: [2020] NIQB 17

Judgment: approved by the Court for handing down

(subject to editorial corrections)*

Delivered: 24/02/2020

IN THE HIGH COURT OF JUSTICE IN NORTHERN IRELAND ________ QUEEN'S BENCH DIVISION (JUDICIAL REVIEW) ________ IN THE MATTER OF AN APPLICATION BY RAYMOND McCORD FOR LEAVE TO APPLY FOR JUDICIAL REVIEW AND IN THE MATTER OF A DECISION BY THE LEGAL SERVICES AGENCY FOR NORTHERN IRELAND ________

KEEGAN J

Introduction

This is an application for judicial review which is dated 14 February 2020. The applicant seeks relief against the proposed respondent the Legal Services Agency ("the LSA") in relation to two decisions of 5 and 12 February 2020;

(a) To release or publish on 17 February 2020 the applicant's personal data (to wit, a list of the applicant's legal aid certificates and all payments made thereunder) under the Freedom of Information Act 2000 before the Information Commissioner has had the necessary time to investigate, consider and determine a complaint made by the applicant to release the said personal data; and/or

(b) The decision to release the personal data at any time at all.

Upon receipt of the papers on 14 February 2020 I heard the parties on an emergency basis. On that date I adjourned the proceedings until 17 February 2020 on the basis that an undertaking was given by the proposed respondent not to release information in the meantime. That undertaking pertains pending this judgment.

This was a leave hearing in which both parties presented all relevant documents. I also received a bundle of authorities and legislation. Mr Lavery QC appeared on behalf of the applicant and Mr Humphreys QC and Mr Summers BL on behalf of the proposed respondent. I have considered their oral and written submissions.

The point at issue

The hearing condensed into whether or not I should grant interim relief and leave for judicial review. An application was made for anonymity on the basis of an Amended Order 53 which I received just prior to 17 February supported by an unsworn affidavit from the applicant. Midway during the hearing an application was also made by Mr Lavery QC for reporting restrictions. I will deal with these matters in turn starting with the preliminary applications for anonymity and reporting restriction.

Anonymity and Reporting Restrictions

I appreciate that this application came in as an emergency however I am surprised by the relaxed way in these matters were presented. It was only when I pointed out that no anonymity application was contained in the original papers that the position was regularised. The application for reporting restrictions was raised ad hoc mid-proceedings with no identifiable basis or legal submissions in support. In any event I find no substance in either application for the following reasons.

The law in relation to anonymity is comprehensively dealt with by McCloskey J in A Police Officer, Re Judicial Review [2012] NIQB 3. Of course any application of this nature involves a departure from open justice. Where arguments are made regarding Convention rights the court must apply careful consideration to the facts. I have done so given Article 2, Article 6 and Article 8 of the European Convention on Human Rights ("the Convention") was raised by the applicant.

In relation to Article 2 I remind myself of the basic principles set out in Osman v The UK [1998] 5 BHRC 293. I have been referred to press reports wherein the applicant has commented publicly on threats upon life due to his pursuit of matters relating to his son's case. That is a matter of public record. In my view there is no nexus between this case and that serious concern and so I do not consider that the high threshold is met as required by law to ground an application for anonymity on the basis of Article 2.

Also, given the long history of litigation taken by this applicant in relation to his son and other issues, it cannot realistically be said at this time that there is an impediment to bringing proceedings without anonymity. The applicant is a public campaigner and so any application grounded on Article 6 is in my view highly incongruous and flawed.

The only possible basis for an application is Article 8 of the Convention which is a qualified right. I have read the evidence presented by the applicant regarding his distress which he relates to these proceedings. I have also read a letter from a counsellor. I accept that some distress from publicity will be occasioned. However, I must also bear in mind that this applicant has publicly stated that he has been in receipt of legal aid in relation to some of his cases. As such it seems to me that applying a balance, the public interest in this issue outweighs the distress which will be experienced by the applicant. It follows that anonymisation is unsustainable.

I was also asked to impose reporting restrictions under my inherent jurisdiction. The principle of open justice applies, see: A v BBC [2014] UKSC 25. However, it is not absolute. In Re A Police Officer which I have referred to above, McCloskey J stated that "an issue of this kind falls to be determined, there is no true lis inter partes and the court should approach the matter in the round, forming an evaluative judgment that is as fully informed as possible in the circumstances."

In A v BBC the Supreme Court stated that it is impossible to enumerate all contingencies where the court may impose some restrictions upon open justice. Often, the administration of justice is a weighty factor which can provide the foundation for some restriction. That factor is not drawn in aid in this case. At the moment, on the basis of what I have heard, I cannot see that any reporting restriction would be justified or proportionate. Of course, media are usually put on notice if such an application is to be pursued but that has not happened here. Accordingly, I am not minded to impose reporting restrictions given the importance of open justice in a case such as this, particularly given the course I intend to take and as I have not needed to detail any sensitive personal matters.

The substance of the case

The backdrop to this case is the Data Protection Act 2018 read in liaison with the General Data Protection Regulation 95/46/EC ("the GDPR Regulation") and the Freedom of Information Act 2000. Various freedom of information requests were made in the autumn of 2019 by elected representatives Mr Jim Allister, Mr Gregory Campbell and Ms Carla Lockhart, regarding the extent of the applicant's legal aid payments. Mr Allister's request was the most extensive. The LSA responded to these requests and informed the applicant who clearly objected to release of the relevant information. I will not set out the entire correspondence train, however it is apparent the LSA decided in favour of release, confirmed in an internal review. The applicant reiterated his objection following the review.

In the final core decision making correspondence of 5 February 2020 the LSA referred the applicant to previous correspondence of 18 November 2019 and the 25 November 2019. The LSA noted the subsequent submissions made and pointed out that the review upheld the original decision save for a decision to withhold information in respect of two cases. The review decision was made available to the applicant. The LSA then concluded by informing the applicant that the information will be published on 17 February 2020. The pre-cursor to this correspondence is that of 18 November 2019 which sets out the rationale for publication through processing of data in some detail and which sets out the consideration of the various arguments made by the applicant including an argument made as to whether or not any of the exemptions applied under the legislation ,particularly section 40 (Personal Information), section 41 (Information provided in confidence), section 42 (Legal Professional Privilege), section 31(1)(c) (Law Enforcement – Administration of Justice). The correspondence also states whilst the applicant did not specifically address section 38 (Health and Safety) that has been addressed by the LSA. Again, the response to this is set out in detail. I need not deal with these arguments in any great detail for the purposes of this leave hearing.

What is important to note is that in the concluding pages of the decision letter the LSA states that:

"The Agency is also of the view that the indication that Mr McCord will seek an urgent injunction to prevent publication is misplaced, as Mr McCord has a statutory remedy. If Mr McCord believes that the Agency's final reply is not in accordance with the Freedom of Information Act 2000 he may ask for an internal review within two calendar months of the date of the Agency's final response. If you request a review you should do so in writing stating the reasons.

If following an internal review Mr McCord remains dissatisfied he may make a complaint to the Information Commissioner and ask him to investigate whether the DOJ has complied with the terms of FOIA."

The LSA provided contact details of the Information Commissioner ("ICO").

Further correspondence followed but of particular note is an e-mail exchange immediately prior to these proceedings. Specifically, the applicant's solicitor emailed the proposed respondent on 11 February stating as follows:

"We refer to your review decision of 5 February 2020. We write to advise that our client wishes to make a complaint to the Information Commissioner, subject to an undertaking from you that you will not release any information whatsoever until the Information Commissioner makes a decision in respect of our client's complaint. Please provide us with the undertaking sought by close of business 12 February 2020, otherwise we have instructions to seek urgent injunctive relief without any further notice to you."

This e-mail was replied to by e-mail of 12 February 2020 in which the LSA stated as follows:

"I note that, further to my review decision of 5 February, Mr McCord intends to exercise his right to complain to the Information Commissioner. You have requested that an undertaking be provided that no information whatsoever be released until a decision has been made by the Information Commissioner in respect of Mr McCord's complaint. I write to advise that no such undertaking is to be provided. This matter has been carefully considered and I can confirm the position is, as previously set out, that the information will be released on 17 February in accordance with the review decision."

A further important piece of information is contained in an e-mail from the ICO to the applicant's solicitor dated 13 February 2020. This states as follows:

"Reference our telephone conversation this morning regarding the above, many thanks for sending me through correspondence and submissions for consideration. As you are aware, these contain a voluminous amount of information, which will take some weeks to read through and provide a view regarding the proposed disclosure of personal data and consideration of exemptions under FOIA as well as consideration of the Data Protection Act 2018 and the General Data Protection Regulation 2018 GDPR.

Please keep me updated with developments regarding this and in the meantime I will give the matter consideration and form a preliminary view as to what action, if any, the Commissioner can take in such an instance."

The above has all led to a position where the Information Commissioner has a complaint before it which is under consideration. The court is effectively being asked to assume a supervisory role in addition to this and to provide some interim relief pending adjudication. This application therefore throws up some interesting issues which must be examined in the context of the statutory scheme.

Legal framework

In terms of the legal provisions governing the LSA, I have been referred to the Access to Justice (Northern Ireland) Order 2003 Article 32(3) which states that:

"(3) Paragraph (1) does not prevent the disclosure of information for any purpose with the consent of the individual in connection with whose case it was furnished and, where he did not furnish it himself, with that of the person or body who did."

In addition, I have been referred to the Civil Legal Services (Disclosure of Information) Regulations (Northern Ireland) 2015. Regulation 3 refers to the restriction of disclosure of information:

"3.—(1) This regulation applies to information which is furnished—

(a) to the Department or any court, tribunal or other person or body on whom functions are imposed or conferred by or under Articles 12A to 20A of the Order, and

(b) in connection with the case of an individual seeking or receiving civil legal aid services funded by the Department.

(2) Information as described in paragraph (1) may be disclosed—

(a) in accordance with the law of Northern Ireland or a court order;"

Counsel helpfully provided a circular which the LSA have dealing with issues of the processing of personal data. This refers to the obligations which pertain under data protection legislation and it is this which forms the focus of this case. As in the case of South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 the inter-relationship between the Data Protection Act 2018 and the Freedom of Information Act 2000 is uncontroversial in this case. It is accepted that information is absolutely exempt from disclosure under Freedom of Information if it constitutes personal data and disclosure would contravene any of the data protection principles.

Also, both parties accepted that the information in question was personal data as defined in the legislative scheme. This concession echoes the Information Commissioner decisions I have been referred to. The thrust of those decisions is that information regarding legal aid is personal data given that it is an indication of personal financial circumstances. So that is not the issue. Rather, the issue is that the LSA say that the processing accords with the Data Protection Act 2018 and the data processing principles and so it is lawful, transparent and fair as it is in accordance with those.

Chapter 2 of the Data Protection Act 2018 contains the Data Protection principles which are drawn from the GDPR Regulation and of common meaning. Article 5 of the GDPR Regulation sets out the principles relating to processing of personal data as follows:

"1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency');

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ('purpose limitation');

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy');

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation');

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality')."

Article 6 of the GDPR sets out the provisions regarding lawfulness of processing. In this case Article 6(1)(f) is relied upon by the LSA as the basis for processing the data:

"1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks."

That outcome has obviously depended upon a balancing exercise between the individual rights in this case of the data subject, Mr McCord, and the general public interest at play. The analysis was upheld on internal review and is now subject of complaint to the ICO. The GDPR Regulation upon which the Data Protection Act 2018 is based provides a comprehensive overview of the legislative scheme which Mr Lavery has taken me through. I do not intend to recite every provision for the purposes of this leave ruling. Suffice to say that it is clear from the comprehensive preamble to the Regulation that the protection of personal data is the underlying rationale for the Regulation. This is clear from the recitals which I have been referred to, for example:

"(39) Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principal of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used … in particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed.

(50) The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected.

(60) The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes.

(69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject."

This brings me to the role of the supervisory authority under the legislative scheme, in this jurisdiction the Information Commissioner. There are comprehensive powers set out in Article 58 of the GDPR Regulation. Part I deals with investigative powers, Part II with corrective powers which are wide ranging including at Article 58(2)(f) a power to impose temporary or definitive limitation including a ban on processing. The recitals also explain the role of the supervisory authority, for example:

"(117) The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure."

(142) Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of personal data to lodge a complaint on his or her behalf with a supervisory authority, exercise the right to a judicial remedy on behalf of data subjects or, if provided for in Member State law, exercise the right to receive compensation on behalf of data subjects.

(145) For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers."

I have also been referred to section 167 of the Data Protection Act. It is entitled "Compliance Orders" and, in particular, it states as follows:

"167 Compliance orders

(1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation.

(2) A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—