Shepherd v The Information Commissioner

The principal issue in this case is whether s. 55 of the Data Protection Act 1998 (“the DPA 1998”) imposes a legal or evidential burden of proof on a defendant; and, if the former, whether the outcome is compatible with article 6 of the Convention. Although similar issues have arisen in other statutory contexts, this is the first occasion on which the point has arisen in this court. The DPA 1998 has been repealed by the Data Protection Act 2018 (“the DPA 2018”), but we have been asked by the Information Commissioner to provide appropriate guidance on the new provisions.

On 28^th March 2018 in St Albans Crown Court Paul Shepherd was convicted of three counts of unlawfully obtaining personal data contrary to section 55 of the DPA 1998. He was fined a total of £600 and ordered to pay the victim surcharge of £60 and prosecution costs of £3,500.

Mr Shepherd’s application for leave to appeal against conviction has been referred by the Registrar to the full Court. In the light of the written submissions we had received, for which we are grateful, we granted leave at the outset of the hearing.

At the conclusion of the oral argument we stated that the appeal would be allowed with reasons to follow. Given that we have concluded that s.55(2) imposes no more than an evidential burden and that Ms Rachel Spearing for the Information Commissioner did not seek to uphold the conviction if that were the true position, it is unnecessary for us to address all the arguments that have been raised. We add that we refused an application by Ms Spearing for a retrial.

For almost ten years the appellant worked as a development co-ordinator for

Following the termination, the Council commissioned a safeguarding investigation. The appellant contends that this was to improve its negotiating position with BVMO. The investigation was carried out by the Council’s Local Authority Designated Officer, Ms Jo Moses, and in due course she prepared a confidential report. The appellant and GG were its main subjects.

The report was leaked to the appellant who in January 2016 disclosed it by email to 83 individuals, namely councillors, members of an Islington-based safeguarding agency, and the local MP. The appellant has not disputed these essential facts. He says that he was justified in doing this because he had serious concerns about the Council’s use of its safeguarding powers to terminate its agreement with BVMO as well as suspicions about its true motivation. In particular, the appellant had been investigated by the Independent Safeguarding Authority in 2012 and it had determined that he was not a risk to children. The appellant understood that that was the end of the matter and that there could be no basis for any determination to the effect that he did pose such a risk.

Count 1 of the Indictment alleged that personal data contained in the safeguarding report and disclosed by the appellant in January 2016 included information relating to an “unnamed female”, who was the complainant in the sexual assault proceedings brought against him in 2007 following events which allegedly took place in 2004. Counts 2 and 3 related to the personal data of two of the appellant’s colleagues, JB and AS.

The prosecution case was that the “data subjects” for the purposes of these counts were, respectively, the “unnamed female”, JB and AS. These named individuals were criticised in the report in relation to child protection and safeguarding issues. One of the agreed facts was that the Council did not know and never did know the identity of the “unnamed female”, and – at least on one interpretation of the document placed before the jury - that the view was taken by it that there was insufficient information contained in the report to identify her.

The appellant relied at trial on the defences set out in s. 55(2)(b), (c) and (d) of the DPA 1998. In short, he contended that he acted in the reasonable belief that he had the right in law to disclose the data in the report; that he acted in the reasonable belief that he would have had the consent of the Council if the latter had known of all the circumstances; and, that in these particular circumstances the disclosure was justified as being in the public interest.

According to the Defence Statement, the appellant reasonably believed that he had the legal right to effect these disclosures because the report contained data relating primarily to him and his close colleagues as well as information already in the public domain, the individuals to whom the email was sent were those who would be legally entitled to view the report in any event, and the report had already been sufficiently anonymised for circulation to a committee of elected residents in the community. Moreover, against the backdrop of the difficult relationship between BVMO and the

For the purposes of s1(1) of the DPA 1998, the “data controller” was the Council, the “data subjects” were the “unnamed female”, JB and AS respectively, and the appellant’s disclosure of the report amounted to “processing”.

S.1(1) also defined “personal data” as follows: ““personal data” means data which relate to a living individual who can be identified—

S.55 provided in material part:

“Unlawful obtaining etc. of personal data

(1)

A person must not knowingly or recklessly, without the consent of the data controller—

(a)

obtain or disclose personal data or the information contained in personal data, or

(b)

procure the disclosure to another person of the information contained in personal data.

(2)

Subsection (1) does not apply to a person who shows— (a) that the obtaining, disclosing or procuring—

(i)

was necessary for the purpose of preventing or detecting crime, or

(ii)

was required or authorised by or under any enactment, by any rule of law or by the order of a court,

(b)

that he acted in the reasonable belief that he had in law the right to obtain or disclose the data or information or, as the case may be, to procure the disclosure of the information to the other person,

(c)

that he acted in the reasonable belief that he would have had the consent of the data controller if the data controller had known of the obtaining, disclosing or procuring and the circumstances of it, or

(d)

that in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest.

(3)

A person who contravenes subsection (1) is guilty of an offence.”

The offence under s.55(3) is punishable on trial by indictment by unlimited fine: see s.60(2)(b).

In relation to Counts 2 and 3, the appellant did not dispute that he had knowingly disclosed personal data without the consent of the Council. As regards Count 1, he denied that he disclosed the personal data of the “unnamed female” because there was no means of identifying her from the report or from other information provided in the appellant’s email.

The appellant’s case in connection with s.55(2)(b), (c) and (d) was that (i) as a matter of statutory construction, these subparagraphs cast no more than an evidential burden on him, and (ii) if the subsection did impose a legal burden, it is an unjustifiable incursion into the presumption of innocence, thereby violating article 6(2) of the Convention, and thus should be “read down” so as to import only an evidential burden.

The appellant submitted that there was no case to answer on Count 1. In a brief ruling the judge concluded that there was an arguable case to go before the jury on the footing that this was personal data as defined: “it may not be a strong case so far as that is concerned but nevertheless one has to look at the fact that this was circulated to 83 people”. Given our conclusion on the issue of statutory construction, it is unnecessary to explore this further.

The judge gave a separate ruling on the two issues arising in connection with s.55(2). He upheld Ms Spearing’s argument that the subsection conferred a legal burden on the defence. He held that “as a matter of plain language” the statutory wording does not define the limits of the offence but carves out an exception to it: i.e. “the offence is committed unless the defendant is within that exception provided by the defences being shown”. As for the suggested need to “read down” the subsection so as to attain an evidential burden, the judge held that this was a regulatory statute operating in a sphere which was not truly criminal, and that the ingredients of the defence were substantially within the defendant’s knowledge such that he should assume the burden of proving them.

The judge’s summing-up on the s.55(2) issue was adapted from written directions provided by Green J (as he then was) to the jury at Southwark Crown Court in July

Ms Emma Collins for the appellant makes no separate complaint about the judge’s summing-up, and in our view she was right not to do so. The judge fairly summed up the evidence and the appellant’s various defences, and also gave the standard good character direction to which he was clearly entitled.

In well-crafted and impressive submissions, Ms Collins contended in support of her first ground of appeal that the application of ordinary principles of statutory construction did not lead to the conclusion that s.55(2) imposed a legal burden. In particular, she drew attention to its somewhat unusual wording – “sub-section (1) does not apply to a person who shows” – and its contrast with other provisions in the DPA 1998 which, by applying what she called an “archetypal formula”, clearly do confer a legal burden. This formula is either “it is a defence to prove that” (s.47(3)), or “it shall be a defence for a person charged with an offence … to show that”

In oral argument Ms Collins explained why s.55(2) was worded differently from ss.21(3), 24(5) and 47(3). Whereas s.55(2) was addressed to the world at large, the provisions conferring a legal burden of proof were directed to those who carried out functions or owed obligations under the schema of the DPA 1998: in particular, data controllers or those served with enforcement notices. The policy of the law was more onerous in cases of this type.

As for a need to “read down” the subsection to ensure a Convention-compliant outcome, Ms Collins referred to the list of considerations and factors identified in a trio of decisions of the House of Lords: R v Lambert [2002] 2 AC 545 (at paras 34 and 88), R v Johnstone [2003] 1 WLR 1736 (at paras 45-53) and Sheldrake v DPP [2005] 1 AC 264 (at para 21).

Given that we have accepted Ms Collins’ submissions on the point of statutory construction, it is unnecessary to dwell on the arguments which bear on questions of necessity and proportionality. However, we do mention these because there is a degree of interplay here, particularly in the light of Ms Collins’ contention that an evidential burden satisfies the purposes, policies and objects of the DPA 1998 far more readily than a legal burden. In support of her essential argument that the imposition of a legal burden is neither necessary nor proportionate, Ms Collins submitted that:

In riposte, Ms Spearing contended that the issue of statutory construction had been determined against the appellant by the decision of the Court of Appeal in R v S and of the House of Lords in Johnstone. There is no material difference, she submitted, between language such as “it is a defence for a person charged with an offence … to show that” (e.g. s.92(5) of the Trade Marks Act 1994) and the wording of s.55(2). Further, to the extent that the appellant’s case drew on any distinction between the constituent elements of the offence itself and matters which were germane to the statutory defences, Ms Spearing pointed out that the real question had to be one of substance rather than of technicality: see Lambert, per Lord Steyn at para 35 and Lord Hutton at para 185.

Ms Spearing did not accept the distinction sought to be drawn between data controllers and the general public. The appellant was in control of these data at the material time, took a deliberate decision to disseminate the report, and must have appreciated that private matters were being divulged.

Ms Spearing further submitted that the difference between s.47, for example, and s.55 is that the former provision is concerned with what she called “instructive action” to specified individuals.

As for the suggested need to “read down” the provision to attain conformity with article 6, Ms Spearing drew attention to the decision of the Supreme Court in R (Catt) v Association of Chief Officers of England & Wales [2015] AC 1065, and the observations of Lord Sumption, at para 8, that the DPA 1998 and the Directive have the objective of providing a high level of protection of personal data and the right to privacy. Ms Spearing referred to a number of the recitals and substantive provisions of the Directive.

In support of her submission that the reverse legal burden was both justifiable and proportionate, Ms Spearing relied on the following cumulative considerations:

There is no decided case which directly assists on the correct approach to s.55(2) of the DPA 1998, and we have derived limited assistance from the jurisprudence decided in different statutory contexts. We gain no assistance from an analysis of the Recitals to the Directive. It is true that the policy at EU level is to afford a high degree of protection to personal data, giving priority to article 8 of the Convention over article 10, but this factor cannot sufficiently discriminate between legal and evidential burdens of proof in a criminal context not expressly envisaged by the Directive at all.

We have noted the views of two academic commentators that s.55(2) imposes merely an evidential burden: see Peter Carey, Data Protection: A Practical Guide to UK and EU Law (4^th edn., 2015) and Rosemary Jay, Data Protection Law and Practice (4^th edn., 2012). However, these authors do not appear specifically to have addressed the contrary arguments.

The correct construction of s.55(2) of the DPA 1998 must turn primarily on a close linguistic analysis of the provision. This is a criminal statute which must be narrowly interpreted in the interests of a defendant, and the fact that the consequences may not be at the higher range of seriousness does not dilute this principle, the full contours of which were expounded by this court in R v S:

“In our judgment, having regard to the authorities and, indeed, to general principle, as a matter of English law it is open to Parliament to provide that, in criminal proceedings in a given context, a legal (persuasive) burden be imposed upon an accused; but, if that is to be so, that is to be regarded as an exceptional course and sufficiently clear language is required. Ultimately, however, all depends on an interpretation of the particular statutory provision in question.” (ibid., at para 17)

The language of s.55(2) has not been replicated in any other statutory provision to the knowledge of this constitution of the court, and basic internet searches have also drawn a nil return. The wording may be described as something of a hybrid: it does not clearly and obviously fall within any familiar compartment. The principal ingredients of the offence are contained in s.55(1) read in conjunction with subsection (3): for the actus reus, what is required is proof to the criminal standard of the disclosure of personal data without the consent of the data controller; and for the mens rea, proof that this was done knowingly or recklessly. This is couched in the negative because it is a duty not to act in this way.

The wording of s.55(2) is of course key. This is not expressed in the passive voice (pace Ms Collins), but the sound point that she was making was that as a matter of ordinary language the offence is not constituted – because s.55(1) is disapplied – in a situation where the defendant shows any of (a)-(d). In our view, this is not expressed in terms of a defence, or of an exemption or qualification which may bear similar features (see, the example, the decision of the Divisional Court in DDP v Wright [2010] QB 224). Instead, this is a situation where an essential component of the offence does not exist if any of (a)-(d) is shown.

In our judgment, a number of matters flow from this.

First, if the provision under scrutiny does not create a defence to what would otherwise be the fully constituted offence, it is much less likely that Parliament intended to impose a legal burden of proof on the defendant. Such a burden is more readily applicable to defences properly so called because, as Ms Collins put it in argument, in the situation obtaining under s.55(2) it cannot be rightly incumbent on the appellant to prove part of the offence with which he is charged.

Secondly, Parliament has selected the wording of s.55(2) and by so doing has abjured the familiar or classic wording of criminal statutes (“it is a defence to prove that …”) which, as has been pointed out, was used elsewhere in the same statute.

Thirdly, the matters set out in subparagraphs (a)-(d) of the subsection are not always constituent elements of the offence (cf. subsection (1)): they only come into play if a defendant raises them. Put in this way, it is much more likely that Parliament intended to impose an evidential burden. “Shows”, in this context, is to be treated as a synonym for “raises”, indicating that it is for the defendant to raise a specified matter and then for the Information Commissioner to disprove it to the criminal standard. As Lord Slynn explained in Lambert, at para 17 (ibid., page 563G/H):

“It is not enough that the defendant in seeking to establish the evidential burden should merely mouth the words of the section. The defendant must still establish that the evidential burden has been satisfied.”

Fourthly, the verb “shows”, taken in isolation, will usually be taken as a synonym for “proves”. However, as Ms Collins rightly points out, the whole of the relevant clause must be considered.

Fifthly, it is relevant, albeit not determinative, that this is not an archetypal regulatory offence involving strict liability. Mens rea is an essential element of the offence, which suggests that Parliament did not have it in mind to impose criminal consequences unless a defendant proved to the probabilistic standard facts and matters which, in the main, can be judged objectively.

Sixthly, the important distinction which we have drawn between constituent elements of the offence on the one hand and the ingredients of a defence on the other has not been undermined by the speeches of Lords Steyn and Hutton in Lambert. We think that Ms Spearing has misunderstood the paragraphs which she has mentioned. These were directed to the issue of proportionality, not that of statutory construction.

Seventhly, as was pointed out in R v S (at para 12), there is a strong policy reason disfavouring legal burdens of proof: a risk that an accused may be convicted where a reasonable doubt may exist. This is a factor which has some weight in the overall balance, but it is very much last in the list.

We accept Ms Collins’ explanation for the difference between s.55(2) and ss.21(3), 24(5) and 47(3). To be added to the mix is s.56(3) which shares the unusual terminology of s.55(2). This later subsection is concerned with purely objective factors which do not depend on the defendant’s state of mind. The fact that the legislature has chosen one form of words on three occasions, and a different (and, as we have said, atypical) formulation on two, is a strong indicator that the intention of Parliament was to achieve different legal results.

An examination of subparagraphs (a)-(d) of section 55(2) shows that two of these provisions do not depend on the defendant’s state of mind at all, whereas the other two require consideration of his reasonable belief. In these latter two instances the defendant must of course show that he did believe the facts set out, but beyond that the issue is of the reasonableness of that belief. These are matters which can readily be investigated before a jury without placing the prosecution at any disadvantage. Furthermore, despite these slight differences across subparagraphs (a)-(d), a consistent approach is required. It would be surprising if, in a case where only subparagraph (d) were relied on, the defendant would have to prove that he acted in the public interest.

Approaching the question of statutory construction as we have done thus far without reference to authority has led us to the clear conclusion that s.55(2) imposes no more than an evidential burden. In our judgment, relevant jurisprudence does not lead us to a different conclusion; rather, it tends to support the conclusion we have reached.

In R v Davies [2003] ICR 586, this court rejected the submission that s.40 of the Health and Safety at Work etc. Act 1974 conferred only an evidential burden. This was in the context of an offence of strict liability where the language of the provision creating the defence was clear: “it shall be for the accused to prove … that”. The court also addressed the argument that this provision should be “read down” to achieve the same result. In rejecting that submission, the court held that it was relevant that the appellant, an employer, had chosen to operate in a regulated sphere of activity. In our judgment, it cannot be fairly said that the appellant in the instant case made that choice: he was not a data controller, nor was he someone who, to use Ms Spearing’s term, was the target of instructive action. He was closer to being the employee mentioned at para 27 of the decision in Davies to whom no reverse onus applied under the 1974 Act.

It is convenient at this stage to mention Lord Sumption’s observations at para 8 of Catt to the effect that the DPA imposes an intensive regulatory regime. That, of course, cannot be disputed, but we reiterate that the appellant did not choose to operate in this regulated sphere and he therefore cannot be taken to have accepted the regulatory controls which accompanied that activity: see Davies, at para 25.

In R v S issue was whether s.92(5) of the Trade Marks Act 1994 imposed a legal burden which was justifiable. This subsection provided:

“(5)

It is a defence for a person charged with an offence under this section to show that he believed on reasonable grounds that the use of the sign in the manner in which it was used, or was to be used, was not an infringement of the registered trade mark.” This was in the context of an offence of strict liability: see s.92(1).

Davis J (as he then was) giving the judgment of the court concluded that s.92(5) on its true construction did impose a legal burden of proof because, for amongst other reasons, the language of the statute was clear and the verb “shows” did in this context have to be interpreted as synonymous with “proves”. We have already pointed out that in the instant case the verb “shows” does not appear in isolation but is located in the unorthodox wording of s.55(2).

It is also noteworthy that the Trade Marks Act 1994 occupies a regulatory arena which is closer, albeit not wholly within, the sort of regulatory sphere which this court considered in Davies. People undertaking commercial activities will tend to know the limitations and restrictions that apply, and it is entirely reasonable for ignorance of these to be established by them on the balance of probabilities.

The court in R v S was able to distinguish its previous decision in R v Johnstone where the contrary argument was not raised. The prosecution did argue the point when R v Johnstone reached the House of Lords, where the reasoning of R v S was unanimously affirmed:

“46.

In the events which have happened this issue does not call for decision in the present case. But the House should not leave the law on this point in its present state, with differing views expressed by the Court of Appeal. I shall, therefore, state my views as shortly as may be. First, I entertain no doubt that, unless this interpretation is incompatible with article 6(2) of the Convention, section 92(5) should be interpreted as imposing on the accused person the burden of proving the relevant facts on the balance of probability. Unless he proves these facts he does not make good the defence provided by section 92(5). The contrary interpretation of section 92(5) involves substantial rewriting of the subsection. It would not be sufficient to read the subsection as meaning that it is a defence for a person charged to raise an issue on the facts in question. That would not be sufficient, because raising an issue does not provide the person charged with a defence. It provides him with a defence only if, he having raised an issue, the prosecution then fails to disprove the relevant facts beyond reasonable doubt. I do not believe section 92(5) can be so read. I do not believe that is what Parliament intended.” (ibid., at 1749B-E, per Lord Nicholls of Birkenhead)

The stark difference between the wording of s.92(5) of the Trade Mark Act 1994 and of s.55(2) of the DPA 1998 is evident. Although this can only be a forensic point, it is to be noted that in s.170 of the DPA 2018 the Parliamentary draftsperson, perhaps responsive to public concerns about “blagging”, phone hacking and data protection breaches generally, has selected the archetypal wording of a reverse onus provision:

“170 Unlawful obtaining etc of personal data

(1)

It is an offence for a person knowingly or recklessly—

(a)

to obtain or disclose personal data without the consent of the controller,

(b)

to procure the disclosure of personal data to another person without the consent of the controller, or

(c)

after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.

(2)

It is a defence for a person charged with an offence under subsection (1) to prove that the obtaining, disclosing, procuring or retaining—

(a)

was necessary for the purposes of preventing or detecting crime,

(b)

was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or

(c)

in the particular circumstances, was justified as being in the public interest.”

The defence no longer engages the reasonable belief of the person charged: the factors which may be relied on are purely objective. According to para 490 of the Explanatory Notes:

“… As worded, the section places a legal burden on the defendant to prove the relevant defences on the balance of probabilities.”

It is unnecessary to comment on the formulation “as worded”, and too much should not be read into it. It is sufficient to say that we agree with the opinion that the new section imposes a legal burden of proof on the defendant. We express no view on whether s.170(2) is compatible with the defendant’s article 6 rights.

Finally, our attention was drawn to the decision of this court in R v K(M) [2018] 2 Cr. App. R. 14, where the relevant provision was held to confer an evidential burden. However, the context of K(M), a human trafficking case,was so far removed from that of the DPA 1998 that we can derive no real assistance from it.

Given our conclusion on the issue of statutory construction, we need not address the appellant’s remaining arguments and grounds. The appeal must be allowed and the convictions quashed.