Cooper v National Crime Agency

Before the court are two appeals which arise out of the same subject matter. In each case the appellant is Mr Cooper and the respondent is the National Crime Agency, which stands in the shoes of his former employer, the Serious Organised Crime Agency. The Serious Organised Crime Agency existed until 7 October 2013, when it was replaced by the National Crime Agency. For convenience I will refer to the respondent as “SOCA”. Mr Cooper was employed by SOCA, initially as an intelligence officer and latterly as a continuous improvement officer. The appeals arise out of the circumstances in which Mr Cooper came to be dismissed by SOCA in 2012.

The first appeal is from a decision of the Employment Appeal Tribunal (HHJ Eady QC) (“the EAT”). The EAT partly dismissed and partly allowed an appeal by Mr

However, on reading the ET’s decision, the EAT was not confident that the ET had given proper consideration to a significant aspect of Mr Cooper’s case before reaching the overall conclusion that he had been fairly dismissed. The EAT therefore decided to remit the case to the same ET judge to ensure that this was done. SOCA crossappeals against the order remitting the case to the ET: it contends that in fact it does sufficiently appear from the ET’s reasoning that this aspect of the case had been properly considered by it.

The second appeal is from a judgment of HHJ Dight CBE sitting in the Central London County Court. The judge dismissed a claim by Mr Cooper against SOCA for damages for unlawful processing of sensitive personal data in relation to him, contrary to his rights under the Data Protection Act 1998 (“the DPA”), in the context of its decision to dismiss him. The sensitive personal data in question comprised materials received by SOCA from Sussex police in relation to the incident in Hove on 7 April 2012. Judge Dight held that there were a number of justifications for the processing of the data by SOCA which were available to SOCA under the DPA relating to its contractual rights as employer and its public functions as a law enforcement agency.

Mr Cooper, who was born in 1960, is a former warrant officer, cryptologist and intelligence specialist, who served in the Royal Navy between 1977 and 2004. In

The employment contract included the following terms:

In order to work for SOCA, Mr Cooper had to have security clearance which was kept up to date. This was for obvious reasons relating to the access which he might have to highly confidential information about investigations in respect of serious organised crime.

Part 2 of the Police Reform Act 2002 (“the PRA 2002”) sets out procedures for dealing with complaints about and misconduct by police officers and established the Independent Police Complaints Commission (“the IPCC”). SOCA was not a police force subject to Part 2 of the PRA 2002. However, SOCPA 2005 amended the PRA 2002 to insert a new section 26A which imposed a duty on SOCA to enter into an agreement with the IPCC to establish and maintain procedures corresponding or similar to those provided for by Part 2 of the PRA 2002 in relation to SOCA’s staff. The IPCC and SOCA duly made a written agreement dated 31 March 2006 as required by section 26A (“the IPCC Agreement”). SOCA’s Misconduct and Discipline Policy was adopted pursuant to this agreement.

In a section of this judgment below I set out the relevant statutory provisions and policies which established the legislative and policy environment in which SOCA conducted its affairs. The relevant policies are the Misconduct and Discipline Policy, a Security Clearance Policy and a so-called Revelation Policy governing the sharing of information about misconduct by SOCA employees with other police forces and prosecuting authorities.

Pursuant to the employment contract and, in particular, the Security Clearance Policy, Mr Cooper had an obligation to report to SOCA, as his employer, if he was arrested or became subject to any criminal proceedings.

On the evening of Saturday, 7 April 2012, Mr Cooper was drinking with a friend in the Slug and Lettuce public house in Hove. According to Mr Cooper, as explained in his defence to criminal charges eventually brought against him, he had drunk a lot and had approached women in a manner which led to him causing offence, with the result that he was punched by a man who was accompanying them.

Police officers of Sussex Police attended an incident outside the public house, involving Mr Cooper. Mr Cooper was abusive to the police and was arrested for being drunk and disorderly. He was handcuffed and placed in a police van. While being transported to Brighton police station he fell into the well of the compartment at the back of the van and while sprawled on the floor he kicked a female police officer in the leg. I should mention here that Mr Cooper’s case was that his behaviour outside the public house was the consequence of being punched, which had such an effect that his behaviour was outside his control, and that the kick had been accidental, due to him trying to get back on his seat while he was handcuffed and the van was in motion.

A contemporaneous custody record was drawn up at the police station, which recorded “poor behaviour” on the part of Mr Cooper in the custody suite before being taken to the cells for the night. There was also CCTV footage of Mr Cooper in the custody suite. A transcript was made of an interview with Mr Cooper on the following day, 8 April 2012. Shortly afterwards, statements were taken from three police officers who had been involved. An incident report was also completed by the police. Like HHJ Dight, I refer to these materials together as the Brighton custody material.

In his interview on 8 April, Mr Cooper was apologetic. He told the police he was employed by SOCA. In due course he was charged with being drunk and disorderly and with assaulting a police officer, in relation to the kick to the female police officer’s leg.

Mr Cooper was released on police bail after his interview. He promptly telephoned his line manager at SOCA to self-report his arrest and to explain what had happened. The Sussex Police also telephoned SOCA to inform it that one of its employees, Mr Cooper, had been arrested. On 10 April, SOCA sent an email to the Sussex Police to ask for relevant documents and CCTV footage. An investigator for SOCA, Mr Mark Kerr, emailed Sussex Police on 19 April to ask to see the transcript of Mr Cooper’s interview as well.

On 10 April SOCA indicated to Sussex Police that it was considering whether to proceed in relation to the incident by way of a conduct investigation. In a reply from Sussex Police that day, the substance of the contents of the custody record was sent to SOCA. Mr David Phillips, a manager in the Conduct Unit of SOCA, was informed. He considered that it was necessary to investigate the incident for four reasons: to determine whether there should be internal disciplinary action; to determine whether

It was for Mr Phillips to decide whether Mr Cooper’s behaviour constituted a “recordable conduct matter” for IPCC purposes. HHJ Dight found that on or about 11 April Mr Phillips considered the available information and concluded that Mr Cooper’s behaviour did constitute a “recordable conduct matter”: [74]. This has some relevance to the legal analysis below, as certain specified obligations to investigate arose at that point.

On 19 April, Mr Kerr was instructed to undertake an investigation into the allegations regarding Mr Cooper’s conduct. On 23 April Sussex Police sent SOCA the incident report. Mr Kerr followed up on SOCA’s requests for material with an email sent to Sussex Police in late April.

Sussex Police pulled together the requested materials, in the form of the Brighton custody material. On 4 May 2012 Mr Kerr, for SOCA, collected the Brighton custody material from Sussex Police.

On 6 May 2012 Mr Cooper complied with the terms of his bail by attending Crowhurst police station. He declined to accept a community disposal in relation to the matters alleged against him and so was charged with the offences of being drunk and disorderly in a public place and of assaulting a police officer.

Thereafter, Mr Kerr made use of the Brighton custody material in the course of his own investigation. In due course, it was decided that the matter could be dealt with appropriately by way of disciplinary proceedings against Mr Cooper, and that it was unnecessary to refer the matter to the IPCC. The Brighton custody material was then used by SOCA’s disciplinary panel in considering a charge of gross misconduct against Mr Cooper in respect of his behaviour, resulting in his dismissal with effect from 11 October 2012. He was notified of that decision by letter dated 17 October 2012. That material was used again by SOCA’s appeal panel in considering Mr Cooper’s appeal against dismissal in December 2012, which was dismissed by letter dated 17 December 2012.

It is common ground that SOCA is a data controller for the purposes of the DPA; that the Brighton custody material (and the substance of the custody record and the incident report provided by Sussex Police in advance of 4 May 2012) comprised sensitive personal data of Mr Cooper (since it consisted of information “as to the commission or alleged commission by him of any offence”: section 2(g) of the DPA); and that the use of those materials by SOCA, acting in particular by Mr Phillips, Mr Kerr, the disciplinary panel and the disciplinary appeal panel, constituted “processing” of those data within the wide definition of that term in section 1(1) of the DPA.

The criminal proceedings against Mr Cooper proceeded rather slowly. SOCA decided to proceed with the disciplinary charges against him without waiting for the criminal process to be concluded first. SOCA decided to proceed despite objections by Mr Cooper that by reason of the Revelation Policy and arrangements between SOCA and Sussex Police, as a fellow law enforcement agency, information given by him in answering the disciplinary charges against him would be likely to be passed by SOCA to Sussex Police and the prosecuting authorities. The ET in its decision found that this was indeed the case: ET decision at [19]-[20]. By reason of concern that this might happen, Mr Cooper received legal advice that he should not attend the disciplinary hearings held by SOCA.

On 25 May 2012 Mr Cooper appeared in the Magistrates’ Court and pleaded not guilty to the charges against him. Mr Kerr attended the hearing. When asked to explain the gist of his defence, Mr Cooper said that on 7 April he had been the victim of a “mass attack” and of the actions of “over-zealous” police officers.

By this stage, Mr Cooper was off sick from work. Mr Kerr arranged to go to his home on 17 August 2012 to interview him. However, by reason of the legal advice he had received, Mr Cooper declined to answer any questions about his behaviour on 7 April. When Mr Kerr asked him if he wished to comment on whether he had brought discredit on SOCA, he offered no reply. He did, however, volunteer that he had been attacked by someone else and that he had acted as he had and said “a few bad things” because of being attacked and because he felt the incident was not being investigated by the police.

On 20 August 2012, Mr Kerr completed his investigation report. In it he reviewed the Brighton custody material. He concluded that disciplinary charges should be brought against Mr Cooper on the basis that he may have committed a criminal offence and may have behaved in a manner not expected of a SOCA officer, whether on or off duty. SOCA instituted disciplinary proceedings against Mr Cooper on the grounds identified by Mr Kerr. A disciplinary hearing was arranged and Mr Cooper was informed of his right to be accompanied at the hearing.

Mr Cooper was sent a pack of the material to be referred to at the hearing, incorporating materials from the Brighton custody material. He did not complain about the inclusion of any of this material in the pack. However, he did ask for the disciplinary hearing to be deferred until after his criminal trial, which was at that time listed for 14 November 2012, so as to allow him to participate fully in the disciplinary hearing without fear of prejudicing his defence in the criminal proceedings. That request was refused by SOCA, on the basis that the disciplinary process was concerned with his general conduct and an alleged breach of SOCA’s standards of behaviour, and that findings in that process and in the criminal proceedings would not necessarily have an impact the one on the other.

The disciplinary hearing took place on 11 October 2012. Mr Cooper chose not to attend, but did not give advance notice of this. He did not arrange to be represented. He submitted no written representations. The disciplinary panel considered the materials in the disciplinary pack and viewed the CCTV footage. It decided that the disciplinary charge was made out and that Mr Cooper should be dismissed for gross misconduct. Mr Cooper was notified of this decision by a letter from SOCA dated 17 October 2012, dismissing him with effect from 11 October with eight weeks’ pay in lieu of notice.

SOCA’s disciplinary rules allowed for an appeal by way of review (rather than rehearing). Mr Cooper submitted a notice of appeal, complaining procedural irregularities, improper conduct and bias, in breach of Article 6 of ECHR and the common law concept of natural justice, particularly in view of the matter being under consideration in the criminal proceedings. No complaint was made of any alleged breach of the DPA. SOCA gave Mr Cooper notice of a hearing before an appeal panel arranged for 6 December 2012, and made it clear that this panel would again consider the materials in the disciplinary pack. Again, Mr Cooper made no objection to this. Prior to the appeal hearing, he informed SOCA that his criminal trial had now been adjourned to 28 May 2013.

The appeal panel duly convened on 6 December. Mr Cooper did not attend the hearing, but arranged for his trade union representative, Mr Tully, to attend on his behalf. At the outset Mr Tully applied for a postponement of the hearing on the grounds that the criminal trial should go first, since otherwise Mr Cooper would be denied a fair hearing. The appeal panel refused that application, noting that SOCA’s relevant disciplinary Operating Procedure stated that internal disciplinary proceedings can usually be conducted prior to the conclusion of a parallel criminal case.

In the substantive part of the appeal hearing, the appeal panel examined the issues and Mr Cooper’s grounds of appeal in considerable detail. Mr Tully stated that, in addition to the grounds of appeal, Mr Cooper had a concern about the legal gateways which had enabled the evidence against him to be collected and relied upon at the first instance hearing. No mention was made of the DPA or the duties under it. The concern was vague and unspecific, and the appeal panel sought clarification, specifically asking if any allegation was being made whether there had been anything improper about the gathering of the evidence. Mr Tully said that Mr Cooper “would just like peace of mind that it was gathered correctly” and specifically confirmed that Mr Cooper was not alleging that the investigating officer had done anything illegal or inappropriate, but was merely seeking reassurance that what he did was legal and appropriate. The appeal panel asked Mr Kerr about this, who stated that the investigation had proceeded in an entirely conventional way, it being standard practice for information to be provided by a police force in cases of this kind, as had happened here. Mr Kerr stated that there were no data protection issues in relation to what had occurred. The appeal panel gave Mr Tully an opportunity to ask Mr Kerr questions about his investigation, and in doing so Mr Tully made no suggestion that Mr Kerr was unqualified to provide assurances on these points, nor was Mr Kerr’s account challenged in any relevant manner. Before the appeal panel retired to consider its decision it gave Mr Tully a further opportunity to raise anything which had not already been considered in the hearing, but there was nothing more he wished to add; he made no suggestion that any point arose as to the legality or appropriateness of reliance on the Brighton custody material in the disciplinary proceedings, nor that there was any need for the panel to obtain legal advice about that.

The appeal panel dismissed Mr Cooper’s appeal. He was notified of its decision by letter dated 17 December 2012. On 9 January 2013, he brought his claim in the ET. In his form ET1, he complained of unfair dismissal on the basis that the disciplinary proceedings had proceeded while he had been unwell; that he was concerned at the fact that Sussex Police had released to SOCA all the evidence against him in support of the criminal allegation, which had then been used as the basis of the SOCA investigation and disciplinary process, “and I challenge why this confidential information, which remains sub judice, about me has been released, without my permission and before this evidence has been tested and a decision reached”; that the existence of the criminal proceedings put him in a difficult position in responding to the disciplinary charges against him; and the sanction imposed had been too severe. No allegation was made of breach of the DPA by SOCA in its investigation and its conduct of the disciplinary proceedings.

On 15 October 2013 the Magistrates’ Court heard the evidence against Mr Cooper on both the criminal charges against him, which in substance reflected what was in the Brighton custody material. Mr Kerr attended that hearing and noted the evidence. Mr Cooper was convicted on both charges and was fined. He appealed to the Crown Court.

On 14 January 2015 Lewes Crown Court reheard the case. The evidence for the prosecution again reflected what was in the Brighton custody material. On this occasion, Mr Cooper called a medical expert to say that his uncooperative conduct in relation to the police, his abuse of them and the appearance he gave of being drunk and unsteady could have been caused by the head injury Mr Cooper said he had received by being punched. Mr Kerr again attended the hearing and noted the evidence. In a detailed oral judgment given by HHJ Hayward, the Crown Court allowed the appeal and quashed the convictions. This was not a ringing vindication of

A considerable time later, on 18 November 2015, Mr Cooper issued his claim form in the County Court against both Sussex Police and SOCA, now complaining of breach of duty under the DPA on the part of both organisations. As against SOCA he claimed compensation of £880,000 in relation to this loss of employment and damage to his future prospects of employment.

At the hearing before the ET in January 2016, Mr Cooper was represented by Ms Dehon (who was also his junior counsel in the EAT, in the County Court and before us). On 9 February 2016 the ET sent its decision to the parties.

The ET reviewed the employment contract and relevant SOCA policies, including the SOCA Code and its Misconduct and Disciplinary Policy, identifying that there were obligations on Mr Cooper to maintain at all time the highest professional and ethical standards; never to behave in a manner likely to bring discredit on SOCA; to behave properly in all aspects of life and act professionally; and to act with fairness and impartiality, respecting the rights of the public, colleagues and partners and treating everyone with respect and courtesy and being expected to exercise tolerance and selfcontrol. I interpose that SOCA had an obvious and important interest in maintaining high standards of conduct on the part of its employees both inside and outside work, so as to promote public confidence in it as a law enforcement agency and to ensure that its employees were not exposed to the risk of threats or blackmail which might jeopardise the secrecy of information held within the organisation. This much was not in issue on this appeal.

The ET found that Mr Cooper was dismissed by reason of his conduct, as examined in the disciplinary proceedings. It said that there was and could be no challenge to the proposition that SOCA had reasonable grounds for its belief that Mr Cooper had engaged in the conduct alleged against him, and it held that dismissal fell within the band of reasonable responses available to SOCA as his employer (and, indeed, Ms Dehon had not argued to the contrary).

Mr Cooper’s case as presented at the hearing in the ET was based on three procedural points: (i) SOCA unfairly based the disciplinary case on the Brighton custody material which had been improperly passed to it by Sussex Police, in breach of their duties under the DPA, which SOCA had improperly received and used, in breach of its duties under the DPA; (ii) SOCA acted unreasonably in refusing to postpone the disciplinary hearings on grounds of Mr Cooper’s ill-health; and (iii) SOCA acted unreasonably in refusing to postpone the disciplinary appeal in light of the legal

As to point (i), the ET noted at [58] that Ms Dehon had made “the startling assertion” that the practice of police forces sharing information concerning arrests of SOCA staff with SOCA “is necessarily and inherently a breach of the [DPA] and, on that account, any consequential dismissal is unfair”. The ET also noted that Ms Dehon’s detailed submissions on the DPA were not included in any skeleton argument (and I observe also that they had not been pleaded in any amendment to the claim as set out in the ET1 form); and went on to say that anyway it was not appropriate for the ET to engage with them, because they were not relevant to the case before it. This was because arguments based on the DPA had not been relied upon at either stage of the disciplinary process. The ET examined the transcript of the disciplinary appeal hearing and found that Mr Tully had not raised any equivalent argument on behalf of Mr Cooper based on the DPA at that hearing. In the circumstances, the appeal panel had made a proper inquiry of Mr Kerr about the propriety of the acquisition and use of the Brighton custody material for SOCA’s disciplinary process and had been entitled to be satisfied with his assurances, which had not been challenged. The ET found that there was no merit in Mr Cooper’s new DPA point because his case in the disciplinary proceedings leading to his dismissal did not rely upon it and the appeal panel was offered no arguable legal basis for finding any merit in it.

As to point (ii) (postponement on sickness grounds), the ET gave reasons for rejecting this complaint by Mr Cooper. This ruling is not in issue before us.

Finally, at [61]-[65] the ET also rejected Mr Cooper’s case based on point (iii). It referred to Harris v Courage (Eastern) Ltd [1982] ICR 530, CA, for approval at p. 532D-F of certain observations of Slynn J in the EAT to the effect that there is no hard and fast rule that once an employee has been charged with a criminal offence an employer cannot dismiss him if the employee is advised to say nothing until the trial in the criminal proceedings; whether it is reasonable for the employer to proceed with internal disciplinary proceedings arising out of the same circumstances will depend on the particular facts of the case; and in that regard, “There may be cases where fairness requires that the employer should wait”. At [65] the ET held that it was properly open to SOCA to refuse the request for the internal disciplinary proceedings to be adjourned; the disciplinary case embraced the whole of Mr Cooper’s conduct on the night of 7 April 2012 and was much wider than the specific criminal charges; acquittal on the criminal charges would not be material to the outcome on the disciplinary case; SOCA was entitled to conclude that the evidence of Mr Cooper’s misconduct was compelling; and SOCA was also entitled to have regard to the undesirability of significant delay in sorting out Mr Cooper’s employment position (and having to continue suspending him on full pay) pending resolution of the criminal case many months in the future.

The appeal before the EAT proceeded on grounds which raised two points: (i) that the

The EAT dismissed the grounds of appeal in relation to the first point. It held that the ET had approached the question of fairness in the right way, by inquiring whether

However, the EAT allowed the appeal in relation to the second point: [43]-[47]. HHJ Eady QC was troubled by the failure of the ET in the relevant part of its decision at [61]-[65] (and in particular, in the critical part of its reasoning at [65]), to make express reference to the information-sharing practice between SOCA and the police, that is to say, to the likelihood that SOCA would pass back to Sussex Police information which it obtained from Mr Cooper in the course of him responding to the disciplinary charges against him, as found by the ET at para. [20] of its decision. This was of concern to the judge because it had been raised as a particular point of complaint at various stages in SOCA’s investigatory and disciplinary process by Mr Cooper and by Mr Tully on his behalf. HHJ Eady QC gave careful consideration to whether it could be said that the ET’s reasoning implicitly took this point into account, even though it did not make express reference to it at [65]. However, she concluded at [47] that she simply could not be sure that the ET had brought this point into consideration when it reached its conclusion at [65] that SOCA had proceeded in a fair manner, and therefore on that basis alone she allowed the appeal. She made an order for the case to be remitted to the same ET judge to consider the point further. SOCA cross-appeals to this court in relation to this part of the EAT’s decision.

Mr Cooper’s claim in the County Court relying on the DPA was brought against both Sussex Police and SOCA. The claim against Sussex Police was settled. A claim against SOCA for misfeasance in public office was struck out, but Mr Cooper’s claim against SOCA under the DPA for unlawful processing of his personal data proceeded to a hearing before HHJ Dight in the County Court.

In relation to that claim, SOCA submitted that it was entitled and legally required to investigate the incident on the night of 7 April 2012 and that its processing of the personal data of Mr Cooper contained in the Brighton custody material was justified under the DPA on one or more of a number of bases set out in that Act. Since the personal data were sensitive personal data, SOCA needed to be able to rely on at least one condition set out in Schedule 2 to the DPA and also on at least one condition set out in Schedule 3 to the DPA: see the first data protection principle set out at para. 1 of Schedule 1 to the DPA. SOCA submitted that Schedule 2 and Schedule 3 conditions were satisfied as follows: that by clause 24.2 of the employment contract and/or by agreeing to be bound by relevant SOCA policies under clause 3.2 of the employment contract Mr Cooper had consented to the processing of the Brighton custody material by SOCA for the purposes of its investigation of the incident and its disciplinary proceedings (under para. 1 of Schedule 2 DPA and para. 1 of Schedule 3 DPA); that such processing was necessary for the performance of the employment contract (para. 2(a) of Schedule 2 DPA); that such processing was necessary for compliance with legal obligations to which SOCA was subject (being obligations other than an obligation imposed by contract) (para. 3 of Schedule 2 DPA); that such processing was necessary for the exercise by SOCA of its functions conferred by or under an enactment (para. 5(b) of Schedule 2 DPA and para. 7(1)(b) of Schedule 3 DPA) or for the exercise of other functions of a public nature (para. 5(d) of Schedule 2 DPA); that such processing was necessary for the purposes of legitimate interests pursued by SOCA (para. 6(1) of Schedule 2 DPA); that such processing was necessary for the purposes of exercising or performing a right or obligation conferred or imposed by law on SOCA in connection with employment (para. 2(1) of Schedule 3 DPA); that such processing was necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings) – in that regard, SOCA’s case was that its internal disciplinary proceedings were the relevant legal proceedings - or was otherwise necessary for the purpose of establishing, exercising or defending legal rights (para. 6(a) and (c) respectively of Schedule 3 DPA). SOCA also contended that it had the benefit of the limited exemption contained in section 35(2) of the DPA, from the non-disclosure provisions of the DPA (as defined in section 27 of the DPA), for the same reasons as applied in respect of para. 6(a) and (c) of Schedule 3 DPA.

Mr Cooper submitted that SOCA could not rely on any of these conditions in Schedules 2 and 3 DPA, and that therefore the processing by SOCA of his sensitive personal data in the Brighton custody material was in violation of SOCA’s obligation under section 4(4) of the DPA to comply with the first data protection principle as set out in para. 1 of Schedule 1 to the DPA. He also submitted that in processing those data, and quite apart from the conditions in Schedule 2 DPA and Schedule 3 DPA, SOCA failed to act “fairly” and hence, again, in breach of the first data protection principle.

Mr Cooper further submitted that SOCA acted in breach of its obligation under section 4(4) of the DPA to comply with the second data protection principle, as set out in para. 2 of Schedule 1 DPA, in that his personal data in the Brighton custody material had been obtained by Sussex Police for one or more specified purposes (in particular, for the purposes of keeping an accurate record of events in relation to his arrest and custody and for prosecuting criminal proceedings against him), and that the further processing of those data by SOCA in the course of its investigation and disciplinary process was “in [a] manner incompatible with that purpose or those purposes”.

There was debate before HHJ Dight regarding the meaning of the term “necessary” as used in these statutory provisions. The judge followed the approach set out by Green J in Hussain v Sandwell Metropolitan Borough Council [2017] EWHC 1641, that the requirement is one of reasonable necessity (Hussain at [230]): see County Court judgment at [121].

As regards compliance with the first data protection principle, HHJ Dight upheld the submissions of SOCA on each point of its contention that it was able to satisfy the specified conditions under Schedule 2 DPA and also under Schedule 3 DPA as set out above (he ruled against SOCA in relation to a further contention that it was able to rely upon condition 5 in Schedule 3 DPA, and it is not necessary to say any more about that). The judge also held that there was no significant additional and distinct complaint of unfair processing contrary to that principle (County Court judgment, [158]). Accordingly, Mr Cooper’s claim in respect of breach of the first data protection principle failed.

HHJ Dight also held that SOCA had not acted in breach of the second data protection principle, since what was in issue under that principle was the purpose or purposes of SOCA in obtaining and using the Brighton custody material, and not the purposes of Sussex Police in generating the personal data in that material in the first place: see County Court judgment at [160]. The purposes of SOCA in obtaining and using the data for its investigation and disciplinary proceedings were specified and lawful in the requisite sense.

The judge also held, for the same reasons he had given in respect of para. 6(a) and (c) of Schedule 3 DPA, that SOCA had the benefit of the limited exemption in section 35(2) DPA, although in view of his principal conclusions in relation to the first and second data protection principles this ruling was not of any great consequence.

HHJ Dight gave a further reason for dismissing Mr Cooper’s claim for damages. The judge found that Mr Cooper’s claim failed for reasons of causation: [163]-[166]. If SOCA had not made use of the Brighton custody material, it would still have been the case that Mr Cooper would have informed SOCA of the charges against him (as he was obliged to do under the employment contract) and SOCA would have investigated what had happened. Mr Kerr would have sought to interview the police officers involved in the incident and Sussex Police would have cooperated by allowing them to be interviewed. They would have provided Mr Kerr with the substance of the information contained in the Brighton custody material and there would have been no legal impediment to SOCA acting on that information in the same way, as it would in fact have done. In any event, Mr Kerr would have attended the hearings in the Magistrates’ Court and the Crown Court, as in fact he did, and would have noted all the evidence given against Mr Cooper on both those occasions. Again, this would have provided Mr Kerr with the substance of the information contained in the Brighton custody material and SOCA could and would have acted upon that information in the same way, by deciding to dismiss Mr Cooper.

Mr Cooper appeals to this court against HHJ Dight’s judgment on a number of grounds: (1) the judge misapplied the first data protection principle in a number of respects (we were given a list of ten respects); (2) the judge misapplied the second data protection principle; (3) the judge failed properly to deal with another aspect of

I address the position as at the material time in 2012 and 2013. Part 2 of the PRA 2002 established the IPCC and set out a regime for the handling of complaints against and misconduct by persons serving with the police, providing for a division of responsibilities between local forces and the IPCC. Within Part 2, section 13 provided that Schedule 3 to the PRA 2002 (which makes provision for the handling of complaints and conduct matters and for the carrying out of investigations) should have effect and section 12(2) defined “conduct matter” as follows:

“In this Part ‘conduct matter’ means … any matter which is not and has not been the subject of a complaint but in the case of which there is an indication (whether from the circumstances or otherwise) that a person serving with the police may have –

(a)

committed a criminal office; or

(b)

behaved in a manner which would justify the bringing of disciplinary proceedings.”

Section 29 made further provision for the interpretation of Part 2. It stated that “‘recordable conduct matter’ means … (a) a conduct matter that is required to be recorded by the appropriate authority under paragraph 10 or 11 of Schedule 3 or has been so recorded …”.

Part 2 of Schedule 3 to the PRA 2002 was concerned with the handling of conduct matters. Paragraphs 11 and 12 of that Part provided so far as relevant as follows:

“11 Recording etc. of conduct matters in other cases

(1)

Where—

The Police (Complaints and Misconduct) Regulations 2004 (“the 2004 Regulations”) were promulgated pursuant to the PRA 2002. Regulation 5(1) specified conduct falling within para. 11(2)(c) of Schedule 3 to the PRA 2002 and hence to be treated as a “recordable conduct matter” for the purposes of Schedule 3, including at regulation 5(1)(f) “conduct whose gravity or other exceptional circumstances make it appropriate to record the matter in which the conduct is involved.” It was on the basis of this provision that SOCA on 11 April 2012, after its initial assessment of the information it had received about Mr Cooper’s conduct, treated his conduct as a recordable conduct matter.

SOCA was not a police force, so its staff did not qualify as persons serving with the police as defined in section 12(7) of the PRA; hence Part 2 of the PRA as enacted had no direct application in relation to SOCA and its staff. The same is true, as it seems to me, of Schedule 3 to the PRA, which again is predicated on there being a complaint or conduct matter or a death or serious injury matter in relation to a person serving with the police. Also, the duties created by Schedule 3 are, apart from those imposed on the

However, section 26A(1) of the PRA, as inserted into Part 2 of the PRA by SOCPA

Pursuant to section 26A, on 31 March 2006 the IPCC and SOCA entered into the IPCC Agreement. Recital 3 to the Agreement stated:

“The Parties to this Agreement intend that any complaint about the conduct of a member of the Staff of SOCA made on or after 1 April 2006, any conduct matters involving such a person and any death or serious injury matter following contact with such a person coming to the attention of the appropriate authority on or after that date should be dealt with in accordance with the relevant provisions of Part 2 of Schedule 3 to the Police Reform Act 2002.”

Clause 1(2) of the IPCC Agreement set out various definitions. It provided that

“complaint” and “conduct matter” were to be construed in accordance with sections 12 and 29 of the PRA and that “misconduct policy” meant the SOCA Misconduct and Discipline Policy.

Clause 2(2) of the IPCC Agreement stated:

“A conduct matter coming to the attention of the appropriate authority [as defined in clause 1(2)] in relation to the conduct of a member of the staff of SOCA shall be treated as if it had come to the attention of the authority under paragraph 10 or 11 of Schedule 3 to the 2002 Act and as if the provisions of Part 2 of the Act dealing with conduct matters applied to it, and accordingly in those provisions-

(a)

a reference to a chief officer shall be treated as a reference to the Director General, and

(b)

a reference to a police authority shall be treated as a reference to SOCA”.

Clause 2(1) and (3), respectively, made similar provision to incorporate the statutory provisions in respect of complaints and death or serious injury matters in relation to members of the staff of SOCA. Clause 2(4) provided that the 2004 Regulations should be treated as applying to complaints and conduct matters involving the staff of SOCA.

Clause 5(1) of the IPCC Agreement provided that “SOCA will ensure that all reports, complaints and allegations about the conduct of a member of staff of SOCA are dealt with in accordance with the misconduct policy”.

SOCA was established by section 1 of SOCPA 2005. Section 2 stated that SOCA had the functions of preventing and detecting serious crime and contributing to its reduction and the mitigation of its consequences. Section 3(1) provided that SOCA has the function of gathering, storing, analysing and disseminating information relevant to the prevention, detection, investigation or prosecution of offences. Section 5 conferred general powers on SOCA; subsection (3) provided that despite the references to serious organised crime in section 2(1), SOCA could carry on activities in relation to other crime if they were carried on for the purposes of any of the functions conferred on SOCA by section 2 or 3. Section 32 provided that information obtained by SOCA in connection with the exercise of any of its functions could be used by it in connection with the exercise of any of its other functions.

SOCA’s Misconduct and Discipline Policy, referred to in the IPCC Agreement and the employment contract, made provision in relation to notification and investigation of conduct issues. Paragraph 3.1 stated that all employees had a responsibility to report any matter to the Conduct Unit which may result in them being subject to any alleged misconduct or discipline issues and that they were required to engage and participate in all actions taken under the policy. Paragraph 3.2 stated that line management would contact SOCA’s Security Department should concerns arise regarding the potential security implications of a discipline or misconduct issue. Paragraph 3.4 set out the functions of the Conduct Unit, which included acting as a central point of receipt for all misconduct and discipline allegations, managing all allegations of misconduct, initiating and arranging an appropriate investigation into the allegations and ensuring that investigations were carried out in an appropriate and timely manner proportionate to the allegation. Paragraph 6.3 provided that where a matter had been referred to the Conduct Unit, “an investigation proportionate to the seriousness of the allegation will be carried out by an Investigating Officer appointed by the [Conduct Unit] to establish the facts”. In the present case, Mr Phillips was the relevant officer in the Conduct Unit and Mr Kerr was the appointed Investigating Officer.

SOCA also had in place a number of other policies of which Mr Cooper had been notified in accordance with clause 3.2 of the employment contract. These included SOCA’s Security Clearance Policy and the Revelation Policy.

The Security Clearance Policy stated that all security cleared personnel within SOCA were subject to being monitored to confirm their ongoing suitability to access sensitive information (para. 1); that “These checks are essential to protect SOCA’s legitimate interests and are required by the Government Security Policy Framework” (para. 1); and that the security vetting process was continuous and that staff had an obligation to maintain their clearance including the reporting of changes to personal circumstances (para. 2); and defined change of personal circumstances to include arrests and being subject to criminal proceedings and investigations (para. 5.2).

The Revelation Policy was concerned with disclosure to prosecuting authorities of information about misconduct and criminal proceedings regarding SOCA staff called as witnesses in prosecutions of third party defendants which might have a bearing on the credibility of such witnesses and hence be disclosable under the CPIA 1996. Paragraph 4.1 reminded staff of the duty upon them to reveal such matters and para.

SOCA became a data controller in respect of the Brighton custody material (and some of the information in that material which was provided by Sussex Police in advance of 4 May 2012) when it came into SOCA’s possession. As I have said, the information so provided constituted sensitive personal data of Mr Cooper. Under section 4(4) of the DPA, and subject to section 27(1), it was the duty of SOCA as data controller to comply with the data protection principles. Section 13(1) provides a right to compensation for an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of the DPA.

Part IV of the DPA sets out a series of exemptions from obligations under the Act. Section 27(3)-(4) provides a definition of “the non-disclosure provisions” for the purposes of that Part, which include “the first data protection principle, except to the extent to which it requires compliance with the conditions in Schedules 2 and 3” and the second data protection principle.

Section 35(2) provides:

“Personal data are exempt from the non-disclosure provisions where the disclosure is necessary-

(a)

for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) …

Or is otherwise necessary for the purposes of establishing, exercising or defending legal rights.”

Part I of Schedule I to the DPA sets out the data protection principles. The first and second data protection principles are stated as follows:

“1.

Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –

Part II of Schedule I to the DPA sets out provisions relating to the interpretation of the data protection principles. Paragraph 2 provides in relation to the first data protection principle in relevant part as follows:

“(1)

… for the purposes of the first principle data are not to be treated as processed fairly unless –

(a)

in the case of data obtained from the data subject, the data controller ensures so far as practicable that the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3), and

(b)

In any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3).

2.

In sub-paragraph (1)(b) ‘the relevant time’ means – (a) the time when the data controller first processes the data …

3.

The information referred to in sub-paragraph (1) is as follows, namely –

(a)

the identity of the data controller, …

(c)

the purpose or purposes for which the data are intended to be processed, and

(d)

any further information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair.”

In relation to the second data protection principle, paragraphs 5 and 6 of Part II of Schedule I to the DPA provide as follows:

“5.

The purpose of purposes for which personal data are obtained may in particular be specified-

(a)

in a notice given for the purposes of paragraph 2 by the data controller to the data subject, or

(b)

in a notification given to the [Information Commissioner] under Part III of this Act.

6.

In determining whether any disclosure of personal data is compatible with the purpose or purposes for which the data were obtained, regard is to be had to the purpose or purposes for which the personal data are intended to be processed by any person to whom they are disclosed.”

Schedule 2 to the DPA sets out the first set of conditions referred to in the first data protection principle, including the following:

“1.

The data subject has given his consent to the processing.

2.

The processing is necessary –

(a)

for the performance of a contract to which the data subject is a party, …

3.

The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

…

5.

The processing is necessary –

…

(b)

for the exercise of any functions conferred on any person by or under any enactment,

…

(d)

for the exercise of any other functions of a public nature exercised in the public interest by any person.

6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. …”

Schedule 3 to the DPA sets out the second set of conditions referred to in the first data protection principle as relevant to processing of sensitive personal data, including the following:

“1.

The data subject has given his explicit consent to the processing of the personal data.

2(1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.

…

6.

The processing –

(a)

is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

…

(c)

is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

7(1) The processing is necessary –

…

(b)

for the exercise of any functions conferred on any person by or under an enactment …”

The DPA is the United Kingdom’s legal instrument which implements Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“the Directive”). Although we were taken to certain provisions in the Directive to see how they tied in with the provisions in the DPA it is not necessary to set them out here, because it was not suggested that any provision of the DPA was inconsistent with the provisions of the Directive in any material respect. In my opinion, no assistance in resolving the particular issues before us is to be derived from the terms of the Directive itself.

As at the material time in this case, the Information Commissioner’s Office had issued a Data Sharing Code of Practice dated May 2011 (“the Code of Practice”). The Code of Practice provided guidance on, among other things, the consent conditions at condition 1 in Schedule 2 DPA and at condition 1 in Schedule 3 DPA. The guidance referred to the definition of consent in the Directive (“any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”) and stated (p. 15),

“There must therefore be some form of active communication where the individual knowingly indicates consent … If you are going to rely on consent as your condition you must be sure that individuals know precisely what data sharing they are consenting to and its implications for them. They must also have genuine control over whether or not the data sharing takes place. …”

It is important to emphasise that in respect of the DPA this court is only concerned with Mr Cooper’s claim against SOCA, and not with his claim against Sussex Police. It is the lawfulness of the processing by SOCA of his personal data as reflected in the Brighton custody material which is in issue.

On this appeal, the right of SOCA to require high standards of conduct of its employees on and off duty is not in doubt. In Mr Cooper’s case, that was made clear by the employment contract and the various SOCA policies referred to above; and in recognition of this he himself very properly informed SOCA that he had been arrested on the night of 7 April 2012. Since Mr Cooper also properly informed Sussex Police that he worked for SOCA, Sussex Police also acted correctly in contacting SOCA to alert them to this, since it might obviously raise issues about his suitability to be a

In this context, it is in my view entirely unsurprising that when SOCA was provided by Sussex Police with the information which is in issue in these proceedings, SOCA should wish to use it to get to the bottom of what had happened on the night of 7 April 2012. It needed to do that in order to assess whether what Mr Cooper had done was of a seriousness which merited further action being taken against him (either by reference of his case to the IPCC or by instituting disciplinary proceedings) or whether it might affect his security clearance.

In my judgment, there is no merit in this appeal and HHJ Dight was right to dismiss Mr Cooper’s claim for the reasons he gave. That is subject to one point on which I consider the judge was in error; but in the overall context of his judgment this error was immaterial.

The present case is closely similar to Laverty v Police Service for Northern Ireland [2015] NICA 75, and the points of distinction urged on us by Mr Coppel do not stand up to scrutiny. In Laverty, the Police Service for Northern Ireland (“PSNI”) received personal data of Mr Laverty, one of its officers, from the Irish police in respect of an incident in Eire in which Mr Laverty had been involved. In the event, Mr Laverty was not prosecuted in Eire, but the PSNI used the personal data it had received about the incident as the foundation for an investigation which led to disciplinary proceedings against Mr Laverty on charges that whilst off duty he behaved in a manner that was likely to bring discredit upon the PSNI and that he had failed to notify the Chief Constable of the PSNI that he was the subject of a criminal investigation by the Irish police. As a result of those disciplinary proceedings, Mr Laverty was dismissed. The Northern Ireland Court of Appeal held that the processing of these personal data of Mr Laverty by the PSNI was justified and lawful under the DPA. Mr Coppel emphasises that the disciplinary proceedings in Laverty were governed by a statutory instrument, rather than by an employment contract as in this case. However, as appears below, I do not regard that as a significant point of difference from this case.

By virtue of section 4(4) of the DPA, SOCA was obliged to act in conformity with the data protection principles. That obligation was qualified somewhat if the exemption in section 35(2) of the DPA applied, as the judge held it did. However, since I consider

The issues which arise in relation to the first data protection principle are whether the relevant sensitive personal data of Mr Cooper in this case were processed by SOCA in circumstances where (i) at least one of the conditions in Schedule 2 DPA was met; (ii) at least one of the conditions in Schedule 3 DPA was also met; and (iii) the processing was conducted “fairly”, within the meaning of paragraph 1 of Part I of Schedule 1 DPA (there was no separate issue based on the word “lawfully” which also appears in that paragraph). Since the processing cannot be regarded as fair and lawful under the first data protection principle unless it complies with at least one condition in Schedule 2 DPA and with at least one condition in Schedule 3 DPA, it is appropriate first to address issues (i) and (ii), which involve focused questions turning on the terms of particular conditions in those Schedules, before turning to the general question in issue (iii). As the drafting of the first data protection principle makes clear, the obligation of “fair” processing under that principle is wider than simply being able to show that there has been compliance with conditions under Schedule 2 DPA and Schedule 3 DPA, so I will refer to the wider or back-stop question of fairness under issue (iii) as involving an obligation of “overarching fairness”.

In my judgment, HHJ Dight was right to find that the processing of the relevant data by SOCA was in compliance with each of condition 1 (consent of the data subject, i.e. Mr Cooper); condition 2(a) (necessary for the performance of a contract to which the data subject is a party, i.e. the employment contract); condition 3 (necessary for compliance with legal obligations to which the data controller – i.e. SOCA – is subject, other than an obligation imposed by contract); condition 5(b) (necessary for the exercise of functions conferred on SOCA by or under any enactment); condition 5(d) (necessary for the exercise of other functions of a public nature exercised in the public interest by SOCA); and condition 6(1) (necessary for the purposes of legitimate interests pursued by SOCA, the data controller). I address each of these in turn below.

Before doing so I will first consider a general submission made by Mr Coppel regarding the meaning of the word “necessary” as used in some of these conditions. Mr Coppel submitted that HHJ Dight had adopted too lax an interpretation of that word in his analysis (in particular, at [121]-[122]), where he followed the approach set out by Green J (as he then was) in Hussain v Sandwell Metropolitan Borough Council [2017] EWHC 1641; [2018] PTSR 142 at [230]). In that paragraph Green J said:

“… The test of necessity in the conditions means more than desirable but less than indispensable or absolutely necessary: see e.g. Goldsmith International Business School v Information Comr [2014] UKUT 563 (AAC) at [37]. A test of reasonable necessity should be applied: see the Goldsmith International Business School case, para. [38]. This test implies that the council [the data controller in that case] has an appropriate margin of appreciation. The parties agreed that the power had to be exercised proportionately. …”

The propositions set out by Green J, taken from the Goldsmith International Business School case, are in fact, as the Upper Tribunal (Administrative Appeals Chamber) made clear in its decision, a summary of the law derived from other authorities, including in particular the judgment of the Divisional Court in Corporate Officer of the House of Commons v Information Commissioner [2008] EWHC 1084 (Admin), in particular at [43]; Farrand v Information Commissioner [2014] UKUT 310 (AAC), in particular at [26]-[27]; and South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55; [2013] 1 WLR 2421, in particular at [27]. Mr Coppel did not take us to the judgments in these cases to try to demonstrate that the

This Court itself pointed out that the Supreme Court addressed this issue in the South Lanarkshire case, in which the relevant European authorities were reviewed. Baroness Hale of Richmond DPSC delivered the judgment of the court. In that case, the local authority was arguing that the Information Commissioner had been in error in adopting a proportionality approach to the term “necessary”, rather than giving it what might arguably be said to be its stricter natural and ordinary meaning. That argument was rejected by the Supreme Court. Baroness Hale noted with evident approval at

The proposition advanced by Advocate General Poiares Maduro referred to (point 47 in his opinion in the Huber case), and set out by Baroness Hale at [22], was as follows:

“The concept of necessity has a long history in Community law and is well established as part of the proportionality test. It means that the authority adopting a measure which interferes with a right protected by Community law in order to achieve a legitimate aim must demonstrate that the measure is the least restrictive for the achievement of this aim.”

Although Mr Cooper did indicate in his claim form that his claim included issues under the Human Rights Act 1998, his particulars of claim did not plead that the processing in this case involved any interference with his right to respect for his private life under Article 8 of the European Convention on Human Rights, as protected under the 1998 Act. However, Baroness Hale’s guidance regarding the meaning of the word “necessary” applies regardless of this.

Mr Coppel submitted that the County Court should have proceeded on the footing that Mr Cooper had invoked his rights under Article 8 even though not pleaded, on the grounds that he had invoked the Directive and the DPA which implements it, which were promulgated to protect rights to privacy under Article 8. However, it was not incumbent on the court to do this. Although protection of Article 8 rights is one of the general inspirations for the Directive, it does not follow that Article 8 rights are engaged or interfered with in every case covered by the Directive and the Act. If Article 8 rights are to be relied upon, it is necessary for the claimant to plead and make out a case to that effect. But this would, in the event, have added little or nothing to this aspect of Mr Cooper’s case.

Mr Coppel also submitted that HHJ Dight’s reasoning in respect of the causation issue showed that SOCA could not satisfy the relevant necessity test. According to Mr Coppel, SOCA did not need to process the data reflected in the Brighton custody material since it could simply have attended the two trials to obtain the information it needed in a public forum. I do not accept this submission.

As soon as SOCA learned about the events of the night of 7 April 2012, it had an urgent need to get as full a picture as possible of what had happened. That was for several reasons, including to ascertain the gravity of what had occurred in order to decide whether the case needed to be treated as a recordable conduct matter and notified to the IPCC or otherwise made the subject of disciplinary proceedings; to find out the extent of any reputational damage to SOCA as a major law enforcement agency and take appropriate steps as promptly as possible to address or repair such damage (e.g. by instituting disciplinary proceedings); to see if further evidence about the events in question needed to be gathered at a time while memories remained fresh; and to ascertain the extent to which Mr Cooper’s security profile had been put in jeopardy by his behaviour. None of these objectives could be adequately addressed by waiting to find out what information might be forthcoming in a prosecution. A trial might be months away, whereas SOCA needed to act promptly to promote these objectives. A full trial might never take place if the charges were dropped for some reason, if Mr Cooper agreed to a community resolution or if he entered a plea of guilty. Moreover, there was no guarantee that the full available relevant information about Mr Cooper’s behaviour would eventually be introduced as evidence as part of the prosecution case against him. Accordingly, if there was a legitimate reason by reference to the various relevant conditions in Schedule 2 DPA and Schedule 3 DPA for SOCA to investigate what had happened, it was plainly “necessary” in the requisite sense for it to process Mr Cooper’s data as reflected in the Brighton custody material at the time and in the manner that it did.

I turn next to discuss the relevant conditions in Schedule 2 DPA.

Condition 1 (consent to processing): HHJ Dight construed clause 24.2 of the employment contract as meaning that Mr Cooper had agreed to the processing of his personal data by SOCA in the manner which occurred, since he had agreed in that clause to SOCA processing his personal data and sensitive personal data in order to, amongst other things, “ensure SOCA’s compliance with existing policies and legislation” (i.e. including SOCA’s Misconduct and Discipline Policy and Security Clearance Policy and the Revelation Policy and SOCA’s obligations under the IPCC Agreement and section 26A of the PRA 2002) and “carry out reviews of [his] performance”. Mr Coppel submits that the judge’s interpretation of clause 24.2 was erroneous, on the grounds that clause 24.1 is limited to giving consent for the processing of personal data and sensitive personal data provided by Mr Cooper himself to SOCA, and since clause 24.2 begins with the words “In particular you agree …” it is to be construed as being likewise limited to processing of personal data and sensitive personal data provided by Mr Cooper himself, and as not extending to cover such data about him as might be provided by third parties such as Sussex Police.

In my judgment, HHJ Dight’s interpretation of clause 24.2 was correct. On that basis he was right to hold that condition 1 in Schedule 2 DPA was satisfied.

Although clause 24.2 begins with the words “In particular …”, which could refer back to what was covered in clause 24.1, the subject matter dealt with in clause 24.2 makes it very clear in my view that this was not the intention. The particular purposes for processing listed in clause 24.2 obviously are likely each critically to depend upon use/processing of personal data of Mr Cooper supplied by third parties, and could not be effectively carried out if limited only to information supplied personally by him - e.g. where accurate information had to be provided to HM Revenue and Customs, or the Contributions Agency or in a reference to a future employer, or used in disciplinary proceedings or to check security clearance or for the purposes of disclosure under SOCA’s policies, or used for the purposes of reviewing Mr Cooper’s performance under the employment contract. Moreover, clause 22.2 of the employment contract makes it clear that SOCA will not terminate employment “unless it has followed its own internal policies and procedures”, including in particular in cases of “an act or omission of gross misconduct”. Clause 24.2 must be read conformably with that obligation upon SOCA. Obviously, such cases could not be dealt with properly purely by reference to information supplied by the allegedly offending employee himself, and without reference to information about his conduct supplied by others. Accordingly, in context, the true construction of the words “In particular …” at the beginning of clause 24.2 is simply as a reference to the general subject of clause 24 (see the heading of the clause: “Data Protection”) rather than to provide an unnecessary explanation in relation to the consent given in clause 24.1, which is already in clear terms.

In his reply, Mr Coppel advanced a further argument in support of his proposed interpretation of the employment contract, based on the extract from the Information Commissioner’s Code of Practice as quoted above. According to Mr Coppel, the Code of Practice has the effect that, if there is any ambiguity about the consent allegedly given by a data subject, that must be resolved in favour of the data subject by concluding that no consent for processing has been given.

I do not agree. The data controller needs to know what its obligations are under the DPA, so the notion of consent in condition 1 is an objective one, which depends on the outward manifestation of consent by the data subject. In a case where a data subject has given consent by the terms of a contract, if there is some initial doubt about what he has agreed to which can be resolved by the usual processes of contractual interpretation, the data subject will be taken to have given consent if that is the true interpretation of the contract. That is the position here. In any event, in the present case I do not consider that there is any ambiguity or genuine uncertainty about the meaning of clause 24.2 when the full context is taken into account.

Condition 2(a) (the processing is necessary for the performance of a contract to which the data subject is a party): In my view, HHJ Dight was right to find that this condition was satisfied as well. Mr Cooper, the data subject, was a party to the employment contract, and had agreed under that contract to be bound by the SOCA policies referred to above. Due and effective implementation of those policies required the processing which occurred, by way of examination of all available relevant information about what had occurred. Moreover, under clause 22.2 of the employment contract, SOCA was bound to follow its Misconduct and Discipline Policy before terminating Mr Cooper’s employment on grounds of gross misconduct,

Condition 3 (the processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract): In my view, HHJ Dight was right to find that this condition was satisfied as well. SOCA, the data controller, was subject to legal obligations arising apart from contract to conduct a thorough investigation of what had occurred and, in the course of the disciplinary proceedings against Mr Cooper which it decided were necessary, to secure and deploy relevant evidence provided to it by Sussex Police. In my view, the relevant legal obligations arose in three ways. First, the SOCA policies referred to above created legitimate expectations binding in public law in the usual way requiring that they be implemented, such binding expectations being enforceable by any third party with an interest and standing to sue (such as an affected member of the public or, in relation to compliance with the Security Clearance Policy, the Government agencies which had issued the Government Security Policy Framework to which it related). Secondly, in carrying out its functions in the public interest (including the management of its staff so as to secure continuing public respect for it as a law enforcement agency and maintenance of proper security standards), SOCA was subject to the usual public law obligations to have regard to relevant matters, including all information available to it relevant to carrying out those functions, and, as necessary, to carry out reasonable investigations to obtain relevant information (see Secretary of State for Education and Science v Tameside MBC [1977] AC 1014, 1065A-B per Lord Diplock). Thirdly, SOCA had obligations under the IPCC Agreement to determine whether Mr Cooper’s conduct was a recordable conduct matter or not, and to act in accordance with the Misconduct and Discipline Policy where it determined that a disciplinary sanction might be appropriate. True it is that these last obligations arose most directly under a contract (the IPCC Agreement), but that contract was entered into pursuant to the obligation upon SOCA under section 26A(1) of the PRA 2002 to enter into such an agreement to establish and maintain relevant disciplinary procedures in relation to its staff, and in my view section 26A(1) has independent statutory legal force implicitly to require SOCA to maintain such an agreement in place and to comply with it. In an appropriate case it seems likely that, even though they would be a stranger to the IPCC Agreement, a victim of misconduct by a member of SOCA’s staff could bring judicial review proceedings against SOCA to require it to comply with the IPCC Agreement, relying on the obligation imposed under section 26A for this purpose.

Condition 5(b) (the processing is necessary for the exercise of any functions conferred on any person by or under any enactment): In my view, HHJ Dight was right to find that this condition was satisfied as well. The word “functions” in this context is of wide ambit. In the case of a public body like SOCA, it covers actions taken to comply with any statutory duty or actions taken in order to exercise any statutory power. Under SOCPA 2005, SOCA was created as a law enforcement agency and by implication from that statute it had all the powers necessary to function effectively as such, including powers to adopt and implement relevant policies and to engage staff and manage them in an appropriate way. SOCA’s processing of Mr Cooper’s personal data in this case was clearly necessary for the due implementation of its relevant policies and for the due management of Mr Cooper as a member of its staff, and hence was necessary for its exercise of such functions conferred on it by or under that

Mr Coppel attempted to meet these points by arguing that, as soon as Mr Kerr made his report on 20 August 2012 recommending that, rather than referring Mr Cooper’s case to the IPCC, SOCA should institute its own disciplinary proceedings against him, the case fell outside any statutory function of SOCA and became a pure matter of contract between SOCA and Mr Cooper. This was the principal basis on which Mr Coppel sought to distinguish the Laverty case.

In my view, this contention is misconceived. SOCA’s statutory functions in relation to the handling of misconduct allegations against one of its employees referred to above continued throughout. A public body may carry out its statutory functions by entering into contracts with persons and then implementing those contracts – the two are not mutually exclusive in the way Mr Coppel sought to suggest. The making of a contract does not mean that a public body ceases to have statutory functions in respect of the subject matter covered by the contract. In fact, public bodies very often carry out aspects of their statutory functions by making and implementing contracts in this way.

Condition 5(d) (the processing is necessary for the exercise of any other functions of a public nature exercised in the public interest by any person): In my view, HHJ Dight was right to find that this condition was satisfied as well. Again, the word “functions” is of wide ambit, referring to any lawful activity carried on by a person. Leaving aside SOCA’s functions under statute, it also had obligations under clauses 2(2) and 5(1) of the IPCC Agreement: first, to investigate whether Mr Cooper’s conduct of which it had notice from both Mr Cooper and the Sussex Police (and which plainly fell within the definition of “conduct matter” in section 12 of the PRA 2002) should be treated as a recordable matter as defined in the PRA 2002 (i.e., in particular, as falling within para. 11(2) of Schedule 3 to the PRA 2002); secondly, to deal with that conduct matter “as if the provisions of Part 2 of the [PRA 2002] dealing with conduct matters applied to it” (clause 2(2) – those provisions include section 13 of the PRA 2002, which in turn states that Schedule 3 to that Act shall have effect); and thirdly, to deal with Mr Cooper’s misconduct in accordance with SOCA’s Misconduct and Discipline Policy (clause 5.1).

The first of these obligations meant that SOCA had to assess the information it received from Mr Cooper and the Sussex Police (including the Brighton custody material) to see whether the conduct matter of which it had notice fell within para. 11(2) of Schedule 3 to the PRA 2002 and hence should be recorded in accordance with the duty in para. 11(1) of the Schedule and thereafter treated as a “recordable conduct matter” for the purposes of the PRA 2002 (as incorporated into the IPCC Agreement). Mr Phillips of SOCA determined at an early stage, on 11 April 2012, that it did constitute a recordable conduct matter. Although the judge found it unnecessary to decide the point, it is clear in light of the submissions made to us that Mr Phillips was entitled to make that assessment.

Acting in compliance with para. 11(3) of Schedule 3 to the PRA 2002 (as incorporated into the IPCC Agreement), SOCA decided that this recordable conduct matter was not one which it was appropriate to refer to the IPCC, but that instead it was appropriate to deal with it by way of bringing disciplinary proceedings against Mr Cooper. SOCA was clearly entitled to make that assessment: sub-para. (b) of that provision, as so incorporated, provided that SOCA “may deal with the matter in such other manner … as it may determine”.

Paragraph 12(2)-(4) of Schedule 3 to the PRA 2002 (as so incorporated) imposed obligations on SOCA, acting by its Director General, to take all such steps as appeared appropriate for obtaining and preserving evidence in relation to a recordable conduct matter. This included the Brighton custody material. This obligation was obviously imposed so that such evidence could be used as appropriate in any such disciplinary proceedings by SOCA itself or which might be pursued by the IPCC. The use/processing of the information in the Brighton custody material was necessary for the proper prosecution of the disciplinary proceedings against Mr Cooper.

Also, by virtue of clause 5.1 of the IPCC Agreement, SOCA was obliged to deal with the misconduct of Mr Cooper in accordance with its Misconduct and Discipline Policy, by taking such disciplinary action against him as it judged to be appropriate. Again, the use/processing of the information in the Brighton custody material was necessary for this purpose.

These were functions of a public nature exercised by SOCA in the public interest. Police and the staff of law enforcement agencies such as SOCA exercise the power of the state and it is in the public interest that they are subject to proper, effective and transparent controls, including a disciplinary regime. Part 2 of the PRA 2002 was enacted to ensure that such controls were in place in relation to the ordinary police. In my view, the functions of a chief constable under that Part in relation to officers in his police force are functions of a public nature and the exercise of those functions to ensure that high standards of conduct are observed by the police (with appropriate sanctions being imposed if they are not) is plainly in the public interest: see also the Laverty judgment, at [49]. In R (Commissioner of Police of the Metropolis) v Independent Police Complaints Commission [2015] EWCA Civ 1248 at [34] and following, Vos LJ explained that an important object of the PRA 2002, including the regime in Part 2, was to secure that public confidence in the police and in the disciplinary procedures in respect of the police was maintained. Section 26A of the PRA 2002 required SOCA and the IPCC to put in place an equivalent regime for SOCA staff, for the same reasons.

Condition 6(1) (the processing is necessary for the purposes of legitimate interests pursued by the data controller): Again, I consider that HHJ Dight was right to find that this condition was met. That is for reasons similar to those set out above. SOCA had legitimate interests: (a) to ensure that it maintained high standards of conduct on the part of its staff in order to maintain public confidence in it as a law enforcement agency (including by taking appropriate disciplinary action against staff who failed to meet such standards), (b) to comply with its obligations under the IPCC Agreement in order to promote the public interest in the transparent and effective determination of allegations of misconduct against its employees, and (c) to investigate alleged misconduct by its employees in order to determine whether their security status had been undermined. In Mr Cooper’s notice of appeal it is said that the judge failed to take properly into account the legitimate interests of Mr Cooper in the form of the right to privacy, the right to a fair trial, the right to be presumed innocent, and his interests in keeping a “Chinese wall” between the criminal and disciplinary investigations. Mr Coppel did not develop these points in his oral submissions to us. None of them was part of Mr Cooper’s pleaded case in respect of the DPA. There

In any event, in my view there is nothing of any substance or merit in Mr Coppel’s points in the notice of appeal on this issue. Mr Cooper had misbehaved in public places and in his dealings with other law enforcement officials. SOCA had a clear and compelling legitimate interest in using/processing the personal data in the way it did, in the public interest (and also with Mr Cooper’s consent). That interest outweighed the points of concern on the part of Mr Cooper raised in the notice of appeal, with the result that it could not be said that the processing by SOCA was unwarranted or in any way disproportionate by reason of prejudice to the rights, freedoms or legitimate interests of Mr Cooper.

Condition 1 (explicit consent to the processing): HHJ Dight was right to find that this condition was satisfied. That is for the same reasons as given above in respect of condition 1 in Schedule 2 DPA. Mr Cooper gave his explicit consent to the relevant processing of his personal data in this case by his agreement to clause 24.2 in the employment contract.

Condition 2(1) (the processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment): HHJ Dight was also right to find that this condition was satisfied. For reasons already set out above, SOCA, the data controller, had both rights conferred and obligations imposed by law under section 26A of the PRA 2002, under general public law, under the IPCC Agreement and under the employment contract itself to exercise its rights under the employment contract and the associated SOCA policies to investigate Mr Cooper’s conduct on the night of 7 April 2012 and then to institute and prosecute disciplinary proceedings against him. The exercise of these rights and the performance of these obligations were in connection with Mr Cooper’s employment. The use/processing of the sensitive personal data of Mr Cooper, in particular as contained in the Brighton custody material, was necessary for the proper carrying out of these purposes.

As appears from what I have said above, certain of the relevant rights and obligations were imposed by law by sources other than the employment contract and the IPCC Agreement. Mr Coppel contends that rights or obligations arising under a contract, including the employment contract and the IPCC Agreement, cannot qualify as rights or obligations “conferred or imposed by law” within the meaning of condition 2(1). This argument does not address the other obligations I have referred to, and does not, therefore, need to be decided in this case. But in any event I can see forceful arguments for the contrary proposition. Where a contract is entered into by the parties factually making an agreement, it could be said to be the law which either gives legal force to what is agreed or which refuses to give it legal force (as e.g. under the doctrine of restraint of trade or if the agreement is illegal). Accordingly it might well be apt to describe the (enforceable) rights and obligations which arise under a contract as being “conferred or imposed by law”. As I say, however, the point does not need to be decided for the purposes of this appeal.

Condition 6(a) (the processing is necessary for the purpose of, or in connection with, any legal proceedings, including prospective legal proceedings): The judge held that the disciplinary proceedings against Mr Cooper constituted legal proceedings or prospective legal proceedings for the purposes of this provision: [131]. I do not agree. In my view, “legal proceedings” in this context means proceedings before a court or tribunal of law and does not cover domestic disciplinary proceedings. In the event, Ms Evans QC for SOCA did not seek to defend this holding by the judge. She did try to argue that it was possible that if Mr Cooper was dismissed as a result of disciplinary proceedings he would bring claims in the ET, so the processing of the data prior to and in the course of the disciplinary proceedings should be regarded as being processing for the purpose of, or in connection with, those possible future claims, which constituted “prospective legal proceedings”. However, this was not pleaded; the argument was not raised before the judge and formed no part of his reasoning; there was no respondent’s notice to introduce this new argument on appeal; and we did not give permission for it to be introduced. It is unnecessary to say anything more about it.

The finding of the judge in relation to condition 6(a) is, therefore, the one point on which I consider that he was in error. However, it was an immaterial error, as there were several other conditions in Schedule 3 DPA which were satisfied.

Condition 6(c) (the processing is necessary for the purposes of establishing, exercising or defending legal rights): In my view, HHJ Dight was right to find that this condition was satisfied. When SOCA was first notified by both Mr Cooper and Sussex Police about the incident on 7 April 2012 it was necessary for it to investigate, including by reviewing such of Mr Cooper’s sensitive personal data as were made available by Sussex Police, in order to establish whether the IPCC had legal rights under the IPCC Agreement to require SOCA to consider taking action against Mr Cooper or to refer his case to the IPCC, and in order to establish whether anyone else (such as a victim of his conduct or central Government) might have legal rights by way of legitimate expectations under relevant SOCA policies or general public law to require SOCA to take action in relation to Mr Cooper’s conduct. Such use/processing of Mr Cooper’s data was also necessary as the first step in SOCA establishing whether it had a right under the employment contract to dismiss Mr Cooper and in exercising that right. After the first notification about Mr Cooper’s involvement in the incident it was determined that Mr Cooper’s conduct warranted further investigation and, later, that it warranted disciplinary proceedings being taken against him. The use/processing of his data in these later stages was necessary for the proper and effective examination of his conduct in order to establish whether SOCA had a right under the employment contract to dismiss him and to exercise that right. It was also necessary at that stage to establish whether others, such as a victim, the IPCC or central Government, had legal rights to require SOCA to proceed against Mr Cooper by way of investigation, disciplinary proceedings and dismissal.

Condition 7(1)(b) (the processing is necessary for the exercise of any functions conferred on any person by or under any enactment): For the same reasons as have been given in relation to condition 5(b) in Schedule 2 DPA, HHJ Dight was right to find that this condition was satisfied.

On Mr Cooper’s pleaded case, there was no properly particularised discrete argument that SOCA was in breach of the overarching fairness obligation in the first data protection principle. The judge was right so to hold at [158]. On this point, all that was pleaded by Mr Cooper was that “the Claimant’s personal data was [sic] not processed fairly (as set out in Part II of Schedule 1 to the DPA)” (para. 41(1)(a) of the Particulars of Claim, repeated at para. 99(1)(a)). No application was made to the judge or to us to amend this pleading so as to particularise properly the case to be advanced in respect of overarching fairness as a matter distinct from compliance with the conditions in Schedules 2 and 3 DPA. The judge was right to dismiss this part of Mr Cooper’s case on the grounds that it was not properly pleaded. The judge was also right to hold at [158] that in any event no breach of this obligation was made out on the evidence.

On the appeal, Mr Coppel sought to argue for the first time that the overarching fairness obligation was breached with reference to paras. 2(1)(b) and 2(3) of Part II of Schedule 1 to the DPA, set out above. He complained that SOCA had not provided Mr Cooper with the information set out in para. 2(3) upon the initial receipt of his personal data and then the Brighton custody material from Sussex Police. This complaint was not pleaded and accordingly there was no examination at trial or in the evidence of when and in what circumstances Mr Cooper was made aware that SOCA had received his personal data and was making use of them. It is not open to Mr Coppel to raise this argument on this appeal. I would add that it is clear that Mr Cooper was on any view on notice at an early stage that SOCA had received personal data of his from Sussex Police and that it was using those data for the purposes of investigation and then the bringing of disciplinary proceedings against him. Further, even if there had been any breach of these provisions, it could not be said that the losses for which Mr Cooper claims compensation followed from such breach. With full knowledge that SOCA was in possession of the relevant personal data and was making use of them for disciplinary purposes, which was an entirely lawful form of processing of those data, Mr Cooper was not in a position to stop that from happening.

Finally in relation to Ground (1), it is convenient at this point to deal with the application of section 35(2) of the DPA. Before the judge, SOCA submitted that it had the benefit of the limited exemption in section 35(2) in relation to “the non-disclosure provisions” in the DPA (as defined in section 27), because the disclosure of Mr Cooper’s personal data to and by the various persons within SOCA who made use of them for the purposes of investigating his conduct and bringing and considering the disciplinary charges against him was necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings) (section 35(2)(a)) and because it was “necessary for the purposes of establishing, exercising or defending legal rights (see the closing words of section 35(2)). The judge accepted both submissions.

The points here are similar to those in relation to condition 6(a) and (c) in Schedule 3 DPA, which I have considered above. For the reasons given above, in my view the judge was in error in holding that section 35(2)(a) was applicable. However, he was right to hold that section 35(2) applied on the basis of SOCA’s further submission under section 35(2).

We did not hear detailed submissions about the impact of section 35(2). However, I should say that in my view its effect in this case is limited. The application of section 35(2), read with section 27(3) and (4), means that Mr Cooper cannot rely on any argument under the first data protection principle against disclosure based on the overarching obligation of fairness (he can only rely on the obligation on SOCA under that principle to comply with at least one of the conditions in Schedule 2 DPA and at least one of the conditions in Schedule 3 DPA; as to which, see the discussion above) and also he cannot rely on any argument for an obligation against disclosure based on the second data protection principle. But both these data protection principles are only disapplied “to the extent to which they are inconsistent with the disclosure in question” (see section 27(3)); they are not disapplied in relation to processing which consists in an individual making use of personal data himself, as distinct from disclosing it to others. In the present case, the main thrust of Mr Cooper’s case is that various individuals within SOCA should not have taken action against him based on their use of his personal data (for instance, Mr Kerr should not have used them to carry out his investigation and compile his report of 20 August 2012; the disciplinary panels should not have used them as evidence against Mr Cooper in the disciplinary proceedings). In my view, the exemption in section 35(2) does not provide SOCA with a distinct defence in relation to these aspects of Mr Cooper’s claim.

The second data protection principle is set out above. Mr Cooper’s case is that his personal data as reflected in the Brighton custody material were obtained by Sussex Police for the purposes of his arrest and for due enforcement of the criminal law, and not for the purpose of being used in domestic disciplinary proceedings against him by his employer, SOCA. Therefore, says Mr Coppel, SOCA acted in breach of the second data protection principle by using/processing Mr Cooper’s personal data for its disciplinary purposes, which were incompatible with the purposes for which Sussex Police obtained those data.

HHJ Dight did not accept this submission and nor do I. As the judge said at [160], the second data protection principle requires one to look at the obtaining of the personal data by the relevant data controller, i.e. SOCA, rather than at the circumstances in which they were initially obtained by a third party, Sussex Police.

In my view, the structure of the DPA and the nature of Mr Cooper’s claim makes it clear that this is the proper analysis. The basic obligation of SOCA on which Mr Cooper relies for his claim is that in section 4(4) of the Act, which states that it is “the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller”. The data controller against which Mr Cooper brings his claim, complaining that it has breached this obligation, is SOCA. For the purposes of Mr Cooper’s claim, the obligations set out in the first and second data protection principles are those of SOCA, and fall to be construed in the light of that. The second data protection principle is an instruction to SOCA as the relevant data controller that it, SOCA, shall only obtain personal data for purposes specified by it, SOCA.

This construction of the second data principle is supported by the guidance as to its interpretation in paras. 5 and 6 of Part II of Schedule 1 DPA. Paragraph 5 explains that the purpose or purposes for which personal data are obtained may be specified in

This interpretation is also supported by practical considerations. A person who comes into possession of personal data of an individual, and hence becomes a data controller in respect of it, where those data were originally gathered by another person, might have no knowledge of the circumstances in which and original purposes for which that other person gathered the information in the first place (one could imagine, for example, someone passing on information to the police anonymously with no clues as to how or why the information had originally been collected). It makes no sense to say that the person who simply receives the information, thereby becoming a data controller in respect of it, is to be subject to obligations the content of which he cannot know, which is the logic of Mr Coppel’s submission. It should also be observed that the relevant protection for the individual data subject in another sort of case - where the person who gathers his personal data gives an assurance that they will only be used for one purpose, but then in breach of that assurance passes them to another person, who knows of the assurance but nonetheless uses the data for a different and incompatible purposes – lies not in the second data protection principle as it applies to the person receiving the information, but rather in condition 6(1) in Schedule 2 DPA, discussed above, which requires the rights of the data subject to be properly balanced by the receiving person against any legitimate interest it may have in processing the data.

This ground of appeal is concerned with SOCA passing information back to Sussex Police, rather than with how it itself made use of Mr Cooper’s personal data in the disciplinary process, and thus has a completely different focus from the other grounds of appeal. It could not be said that the passing of information by SOCA to the police had any bearing on the conduct or outcome of SOCA’s disciplinary proceedings against Mr Cooper, so it is unclear to me how alleged breach of the DPA by SOCA passing information to the police could have any causative effect in relation to the losses and compensation claimed by Mr Cooper as against SOCA.

Be that as it may, the reason why in my view this ground of appeal cannot succeed is that this claim by Mr Cooper was not properly particularised by him in his pleadings, as HHJ Dight correctly held at [161]. The relevant paragraphs in the particulars of claim are paras. 42 and 104, which are unparticularised. Accordingly, SOCA was not in a position fairly to meet this case, and the judge was right to dismiss it. When we asked Mr Coppel what information he said SOCA should not have passed to the police, he referred us to a schedule of unused material produced by Sussex Police for the criminal proceedings against Mr Cooper. That schedule and the material referred

I should also mention that there are in fact proper statutory bases on which SOCA was entitled (under sections 3(1) and 5(3) of SOCPA 2005) and indeed potentially obliged (under the Revelation Policy and the CPIA 1996) to pass information to the Sussex Police, which could if relevant be shared with the prosecutors and, as appropriate, passed to Mr Cooper’s defence team. For example, as the judge observed, the fact that SOCA mentioned to Sussex Police that Mr Cooper had a black eye was positively helpful to his case in defending the criminal proceedings, in that it tended to support his evidence that he had been hit by another person. In the absence of examination of this part of Mr Cooper’s case, by reason of the want of proper pleaded particularity in relation to it, I see no reason to suppose that the passage of information by SOCA to the Sussex Police involved any breach of the DPA.

Mr Coppel submits that HHJ Dight was not entitled to make the findings he did as to the absence of causation between the alleged breaches of the DPA and the losses in terms of loss by Mr Cooper of his job and in respect of his future employment prospects for which he claimed compensation.

I would dismiss this ground of appeal as well. At [164] the judge gave two sound reasons why SOCA would still have proceeded with disciplinary proceedings against Mr Cooper with the same outcome of dismissal, even if it had made no use of the information passed to it by Sussex Police. It should be remembered that Mr Cooper had himself, very properly, informed SOCA that he had been arrested, as he was obliged to do. It was therefore inevitable that SOCA would have sought to investigate the circumstances in which that occurred.

The first way in which the judge found SOCA would have done so, thereby obtaining in substance the same information as it in fact used in its disciplinary process, was by the simple expedient of interviewing the relevant police officers, whom the judge found would have been co-operative and helpful. The judge was plainly entitled to draw that inference on the evidence available to him. Indeed, it would have been extraordinary if the police officers had refused to co-operate with a fellow law enforcement agency in a case of this kind.

The second way in which the judge found SOCA would have done so, again thereby obtaining in substance the same information as it in fact used in its disciplinary process, was by the further simple expedient of sending someone to listen to the evidence given in the Magistrates’ Court and then the Crown Court, as Mr Kerr did in fact do. Although Mr Cooper was acquitted in the Crown Court, the evidence confirmed that his behaviour had been far below that which SOCA was entitled to expect of its staff. Although acquitted, SOCA would still have been entitled to take disciplinary action against him and to dismiss him, as the judge found it would have done. This again was a finding which the judge was entitled to make on the evidence.

The focus of the submissions which Mr Coppel made on the appeal are that the ET and the EAT erred in failing to grapple with Mr Cooper’s case that SOCA had been in breach of the DPA in using the Brighton custody material against him in the disciplinary proceedings which led to his dismissal, and erred in holding that SOCA’s appeal panel was entitled to proceed on the assumption that it had been lawful for Sussex Police to pass that material to SOCA. These points are related.

I would dismiss this appeal. There was no error by the ET or the EAT in relation to their examination of the way in which SOCA’s disciplinary panels dealt with the circumstances under which the Brighton custody material came into the possession of SOCA. Before the first panel, Mr Cooper raised no complaint regarding the way in which that material came into SOCA’s hands. Before the appeal panel, his trade union representative (Mr Tully) mentioned that Mr Cooper had a concern about that, and the appeal panel conducted a proper examination of that concern by, first, clarifying whether Mr Tully was actually making an allegation that the way in which SOCA obtained the material and made use of it in its investigation leading to the disciplinary proceedings was unlawful (and determining that he was not making such an allegation) and, secondly, nonetheless making inquiry of Mr Kerr to obtain confirmation that he was not aware of any unlawfulness in what had been done. The appeal panel’s inquiries were reasonable in the circumstances, as the ET was entitled to hold. I agree with the EAT’s reasoning. On the basis that the appeal panel had made reasonable inquiry in relation to any issue concerning the lawfulness of what had been done and had satisfied itself that it did not need to take the matter further, the ET and the EAT were right to hold that it was unnecessary to go into the detailed merits of any argument based on the DPA.

Mr Murray presented the submissions for SOCA on its cross-appeal. He contends that the EAT was in error in holding that the case should be remitted to the ET to consider whether there was a special reason in Mr Cooper’s case why SOCA, as employer, should have delayed hearing the disciplinary proceedings until after the criminal proceedings had come to an end, by reason of the particular risk that SOCA might send information from the disciplinary process back to Sussex Police which might then be used against Mr Cooper in the criminal proceedings. Mr Murray submits that the EAT should have found that it was implicit in the ET’s reasoning that it had taken that point into consideration in reaching its conclusion that the dismissal process was fair.

I do not accept Mr Murray’s submission. The EAT was right in its interpretation of the decision of the ET and in saying that one cannot be confident that the ET had properly factored this particular aspect of Mr Cooper’s case into its conclusion at para. [65]. The correctness of the EAT’s interpretation of para. [65] of the ET decision is reinforced by para. [19] of the ET’s decision, in which the ET specifically said that the subject of the practice of SOCA of passing to a local police force information about any employee who has been charged with an offence by that force “did not appear to be directly relevant since the Claimant’s challenge, as explained above, was to [SOCA] placing reliance on the police evidence, not the other way round …”. Since the ET judge did not regard this issue as relevant to the claim – a point on which he was in error, since it did sufficiently appear from Mr Cooper’s claim that he was complaining about the risk of SOCA passing information from the disciplinary process back to the police for possible use in the criminal proceedings – it

Accordingly, I would hold that the order of the EAT requiring remission of the case to the ET for consideration of this aspect of Mr Cooper’s claim should stand.

For the reasons I have given, I would dismiss Mr Cooper’s appeal in relation to the County Court judge; I would dismiss his appeal in relation to the EAT’s decision; and I would dismiss SOCA’s cross-appeal in relation to the EAT’s decision.

I agree.

I also agree.