Geoffrey Driver v Crown Prosecution Service

“Hi Superintendent Halstead

Further to our discussion on Thursday 17^th March, would you be prepared to issue the following statement to the press ?

‘Lancashire Constabulary has undertaken a thorough investigation into allegations it received from Lancashire County Council and we can confirm that County Councillor Geoff Driver has been completely exonerated. We thank County Councillor Driver for his full co-operation throughout this inquiry.”

“Good afternoon Councillor,

I have held a strategy meeting today with our Corporate Communications department and discussed the content of my briefing with you and your legal representatives last Thursday. I have reiterated to them that as the SIO of Operation Sheridan I have accepted the responsibility for ‘putting the record straight’ in relation to your role within the investigation, the fact that we have established your innocence and also that you have fully cooperated throughout.

The professional advice I have been given, is that Lancashire Constabulary have never actually named, nor confirmed that you were part of the investigation, and I have been reminded that I have taken a strong stance on this by way of policy. Consequently it would be unique for the Constabulary to now proactively make a statement in which we name you, to every monitoring media outlet.

Could I suggest by way of a compromise, that you choose the media platform you feel is most appropriate best deliver the message and you contact them directly, therefore accepting the personal responsibility of publicly naming yourself. I would then, as I suggested I would, make a formal reply to them including the suggested content listed below.

I hope you appreciate the need for caution from the Constabulary perspective and see this as a way of ultimately delivering the same message but in a subtly but importantly different way.”

“Hi Superintendent Halstead,

Thank you for your email. I understand your dilemma and I have therefore sent the attached press release to The Lancashire Telegraph, the Lancashire Evening Post, BBC North West and Radio Lancashire. I would be most grateful if you would respond to any enquiries they make along the lines set out in my email below.”

“PRESS RELEASE BY COUNCILLOR GEOFF DRIVER CBE

I have been informed by Lancashire Constabulary that after their lengthy investigation into allegations made by Lancashire County Council, they are satisfied I am entirely innocent of any wrongdoing.

I am now in discussion with my legal advisers as to the best course of action to take against those individuals who have knowingly made false, malicious and libellous allegations against me and I shall therefore not make any further comment at this time.”

“Tory chief takes legal advice after police probe dropped

Conservative opposition leader is no longer subject to investigation over One Connect”

The application form completed by the police ran to 29 pages with another 27 pages of appendices. D.C. Fishwick was questioned by HHJ Altham for the best part of a day and the transcript of her evidence comprises another 52 pages. It is not easy to summarise this material, presented as it was to the Judge as an impenetrable, discursive mass lacking a discernible sense of order. Understandably, the police are concerned to comply with their duty as to disclosure; but the answer to that obligation does not lie in simply "throwing" material at the Court in the manner in which it was done in this case. We have, though, considered the application to see whether – despite the failures of presentation – it complied with the statutory requirements or whether any of Mr Bowers' grounds of challenge should succeed.

The application identified two offences in connection with which the warrants were sought: conspiracy to pervert the course of public justice contrary to common law ("conspiracy to pervert"); and witness intimidation contrary to the Criminal Justice and Public Order Act 1994 , s.51. In the event, HHJ Altham was not satisfied that there was evidence that witness intimidation had taken place and Mr Bird on behalf of the police did not seek to support the warrant by reference to that offence.

So far as conspiracy to pervert was concerned, the application had to explain the underlying offence whose investigation, it was said, was endangered by the conspiracy. This underlying offence was in essence fraud on and, effectively, corruption in local government – in Mr Bird's phrase what was said to be a case of "jobs for the boys". This underlying police investigation was called "Operation Sheridan". It began in 2013 following an investigation by a firm of solicitors (DAC Beachcroft) of an aborted procurement exercise relating to the potential outsourcing of Lancashire County Council's vehicle fleet to BT. As already mentioned, BT by then had a joint venture with LaCC - OCL. The solicitors' review had been critical of Mr Geoffrey Driver, the Leader of LaCC and Philip Hassall, then Chief Executive of LaCC. The application explained that Operation Sheridan had widened to include alleged criminality within Liverpool City Council and the Merseyside Pension Fund ('MPF'). As we have said, the Claimant was the Chief Executive of LiCC and Mr McElhinney was the Chief Executive Officer of a joint venture, LDL, between BT and LiCC.

As already foreshadowed, the underlying offences under investigation in Operation Sheridan were not the indictable offences relied upon to justify the grant of the search warrants; in simple terms, the essence of the conspiracy to pervert went to conduct threatening the underlying investigation. The flavour of the application appears from the paragraphs which follow.

As the application put it,

Reliance was placed on email traffic and telephone contact between the four suspects. The emails were summarised in Appendix A to the application. One of these emails in 2014 had an attachment of an email exchange between the Claimant and Mr Driver. The subject matter appears to be a dispute between LaCC and the Claimant concerning a relocation allowance which had been paid to the Claimant when he came to work for LaCC and whether he was required to repay it on his departure after a relatively short time (we return to the issue of the relocation fee dispute below). None of the other emails appear to come from the Claimant so far as it is possible to tell from the unredacted parts.”

“FOUR more men are being investigated by police over claims of fraud at Lancashire County Council.

The news was revealed as a file on the five-year ‘Operation Sheridan’ inquiry was sent to the Crown Prosecution Service in London.

In May last year, four men were arrested in connection with the probe and bailed on suspicion of perverting the course of justice and witness intimidation.

They were Cllr Geoff Driver, the leader of Lancashire County Council, the authority’s former Chief Executive Ged Fitzgerald; his successor Phil Halsall; and former One Connect chief executive David McElhinney.

They were not arrested on suspicion of fraud and all four deny any wrongdoing.

Operation Sheridan is an investigation into a £5m tender awarded to One Connect ltd, a joint venture between the council and BT.

The file sent to the CPS today covers the whole scope of the inquiry and the police revealed today that it related to eight men between 56 and 73, not just the four arrested last year.

It is understood that any decision on charging and prosecution is likely to take a considerable period of time.

Cllr Driver said this morning: ‘I have no comment to make’.

A police spokesman said today: ‘In September 2013 Lancashire County Council referred to Lancashire Constabulary some allegations of financial irregularity.

‘An investigation was launched and following a complex and lengthy enquiry a file of evidence has now been submitted to the Crown Prosecution Service for consideration.

‘The investigative bail period has now been suspended as a result of the file being submitted.

‘We have submitted evidence relating to eight individuals. We will not give any further details about those individuals other than to say they are all men aged between 56 and 73.

Cllr Driver, Mr Fitzgerald, Mr Halsall and Mr McElhinney remains (sic) subject to bail conditions but are no longer required to attend police stations on a regular basis.

A CPS spokesman said: ‘We received a file of evidence from Lancashire Police in relation to allegations of fraud.

‘This is a complex file which will now be considered in accordance with the Code for Crown Prosecutors and a decision will be made in due course.’”

“The Code for Crown Prosecutors is a public document, issued by the Director of Public Prosecutions, that sets out the general principles Crown Prosecutors should follow when they make decisions on cases.

Is there enough evidence against the defendant?

When deciding whether there is enough evidence to charge, Crown Prosecutors must consider whether evidence can be used in court and is reliable and credible, and there is no other material that might affect the sufficiency of evidence. Crown Prosecutors must be satisfied there is enough evidence to provide a ‘realistic prospect of conviction’ against each defendant.

Is it in the public interest for the CPS to bring the case to court?

A prosecution will usually take place unless the prosecutor is sure that the public interest factors tending against prosecution outweigh those tending in favour.”

“Dear Mr Graham,

Thank you for your correspondence of 1 May 2019. I apologise for the delay in this response.

A charging file has been referred from the Operation Sheridan investigation team to the CPS for consideration. At this stage I am unable to provide you with any more detail.”

“Dear All,

Firstly, please read below.

This is a topic that grabbed my attention earlier this year after Geoff Driver put in a complaint against me to Lancashire Care NHS Foundation Trust.

This was after I peacefully protested at County Hall regarding the cuts to the Lancashire Health and Well-Being Service.

It could be that Geoff Driver is entirely innocent, as he claims.

The fact is that millions of £’s have already been spent investigating the alleged fraud and witness intimidation.

To my knowledge Geoff is still on bail; this is mainly because the CPS doesn’t have the resource (sic) to get this case to court.

This needs to be resolved either Geoff is innocent or guilty.

We cannot have the leader of Lancashire County Council on bail for fraud and witness intimidation.

If elected, please can you do your part resolving this case once and for all.

Best regards,

Paul Graham”

“I refer to your email of 16 December 2019, and request for the CPS complaints procedure, where you have asked to make a complaint as to the conduct of Julia Graham.

…

I have treated your complaint as one amounting to a Data Protection Act breach, ie details of yourself, and your alleged involvement in Operation Sheridan, being sent to a third party. Due to the nature of your complaint, the matter was referred to the CPS Departmental Security Unit (DSU).

…

The particular breach which was referred was in relation to the response given by Julia Graham to an email from Mr Paul Graham, the Office Manager of Literacy Solutions.

You have stated that she has no right to pass on information regarding your case to a third party and that this would be a serious breach of the Data Protection Act.

In determining whether a matter should be referred thereafter to the Information Commissioners Officer (ICO) (sic), the DSU first need to consider whether or not a breach has occurred in the first instance. Thereafter, on considering the details of each breach on its own facts, a decision is made whether it should be referred to the ICO.

The DSU has concluded, after reviewing this matter, that a breach has occurred, and that the email should not have been sent to Mr Paul Graham.

On considering whether a matter should thereafter be forwarded to the ICO the DSU would need to establish the likelihood, and severity, of the breach and result of risk to a person’s rights and their freedoms. The adverse consequences of a breach needs to be considered and assessed as to how serious or substantial these are.

DSU have carefully considered the breach and, as mentioned above, whilst they are satisfied a breach has occurred, the circumstances in this case do not meet the referral criteria to the ICO.

I would like to assure you, however, that whilst this matter has not been referred to the ICO the breach has been taken extremely seriously. I have spoken directly to the reviewing lawyers dealing with Operation Sheridan and drawn their attention to this issue and have re-enforced the correct procedures which should take place.

Any future correspondence will be handled appropriately in the future.

I can only apologise for the breach occurring in the first instance.

I hope that this letter explains the actions which has taken place and the decision as a result of this complaint.”

Whether the GDPR or the DPA 2018 governs the data protection claim (assuming there had been processing of personal data under either regime);

Whether Ms Graham’s email of 5 June 2019 contained the Claimant’s personal data;

If so, whether the Defendant contravened the GDPR and/or DPA 2018 in sending the email to Mr Graham;

Whether the email contained private information relating to the Claimant, in respect of which he had a reasonable expectation of privacy and if so, whether the sending of the email was a misuse of the Claimant’s private information;

Whether the Claimant should be permitted to bring a claim under the HRA 1998 outside of the 12-month limitation period and if so, whether a HRA 1998 is established;

If the Claimant’s claims, or any of them, are established, the appropriate remedy.

These events generated a considerable amount of media interest both locally and nationally ranging from newspaper articles, online publication, radio and television reports. My involvement and arrest have therefore been in the public domain for some time. There was a judicial review in the High Court brought by one of the suspects, into the lawfulness of search warrants. A number of the articles referred to the file being passed from the police to the Defendants. At no stage was it ever suggested that I was to be charged with any offences. I was extremely concerned about the possibility of being charged. Being a suspect and having been arrested was worrying but I was able to continue with my life and work knowing I was only under investigation and confident that the police would eventually recognise that I had not committed any criminal offence just as they did in March 2016. The fact that the investigation had been ongoing since 2013 and some considerable time had passed since my original arrest, no charges had been brought which confirmed my view that the Police recognised I had not committed any criminal offences. The lengthy delay with no progress also led the public to believe that the matter had concluded and I was concerned that this leak by the CPS would bring it into the public domain again.

It therefore came as a disappointment when I was copied into an email dated 5^th December 2019, which had been sent from Julia Graham … to Paul Graham at an organisation called Literacy Solutions on the 5 June 2019. I have no idea whether they are related.”

The email to Mr Graham was providing him with an update on the progress of Operation Sheridan, which stated that a ‘charging file had been referred from the Operation Sheridan investigation team to the CPS for consideration’. The reference to a ‘charging file’ led me to fear that formal charges were likely to be brought against me.

Although my arrest and the investigation had been published widely in the media there had never been any suggestion that I would be formally charged, and that remains the case. The reference to a ‘charging file’ was a significant development in the investigation. The information had been sent to other Election candidates in the Pendle constituency, who I considered to be political opponents. It was also sent to Jeremy Vine a BBC journalist and another journalist called Inspector Digit.

There has been a lot of interest in the investigation, which has been reported widely in the media, radio and television. I have protested my innocence throughout, both my friends, acquaintances, colleagues and the media. The prospect of being charged and facing a lengthy trial was a significant change and was very worrying and distressing to me and my family. I was ashamed it had come to this and brought to the attention of my political opponents. It was acutely embarrassing. The prospect of this getting out into the wider media and onto national television was terrifying.”

In April 2020 I consulted my GP who prescribed daily medication to relieve the anxiety and depression I was suffering from the original arrest and investigation followed by the CPS leak. After regular consultations, my doctor advises that I still need the medication, which I continue to take.”

“In September 2013 Lancashire County Council referred to Lancashire Constabulary some allegations of financial irregularity.

An investigation was launched and following a complex and lengthy enquiry a file of evidence has now been submitted to the Crown Prosecution Service for consideration.

The investigative bail period has been now been suspended as a result of the file being submitted.”

“I understood this meant a file had gone from the police. It was public knowledge as a consequence of the August 2018 articles that a file had gone to CPS. I understood ‘for consideration’ meant that a charge might be imminent because this was the first time I had seen ‘charging’ as an adjective against the file. This was the first time that had been used. The word ‘for consideration’ was more significant because of the word ‘charging’. Until I saw this I was certainly fairly confident I was not going to be charged when I saw this it eroded my confidence.

It did add something different – it eroded my confidence about not being charged. It was the use of the word ‘charging’ in an email from a Senior Specialist Prosecutor, it suddenly worried me significantly.”

“First, is the information private in the sense that it is in principle protected by article 8? If 'no', that is the end of the case. If 'yes' the second question arises: in all the circumstances, must the interest of the owner of the private information yield to the right of freedom of expression conferred on the publisher by article 10 ?”

“For the purposes of this Part, ‘the law enforcement purposes’ are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.”

“the competent authority which, alone or jointly with others – (a) determines the purposes and means of the processing of personal data, or (b) is the controller by virtue of subsection (2).”

“Where personal data is processed only – (a) for purposes for which it is required by an enactment to be processed, and (b) by means by which it is required by an enactment to be processed, the competent authority on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.”

“’Personal data’ means any information relating to an identified or identifiable living individual (subject to subsection (14)(c))”.

“(3) ‘Identifiable living individual’ means a living individual who can be identified, directly or indirectly, in particular by reference to –

(a) an identifier such as name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.”

“The important issue is whether the data can be related to a living individual, not whether that person can be identified from any particular part of the data.”

“It follows from what I have said that not all information retrieved from a computer search against an individual's name or unique identifier is personal data within the Act. Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated. In short, it is information that affects his privacy, whether in his personal or family life, business or professional capacity. A recent example is that considered by the European Court in Criminal Proceedings against Lindquist, Case C-101/01 (6^th November 2003), in which the Court held, at para. 27, that "personal data" covered the name of a person or identification of him by some other means, for instance by giving his telephone number or information regarding his working conditions or hobbies.”

Mr Pitt-Payne QC, for the University, submitted that the definition of ‘personal data’ consists of two limbs:

i) Whether the data in question "relate to" a living individual and

ii) Whether the individual is identifiable from those data.

This is inherent in the form of the definition in the DPA. I agree, and the point is, in my judgment, even clearer in the definition of "personal data" in the Directive, where the definition is clearly split between two clauses.

Since the DPA is intended to give effect to the Directive, it is convenient to begin with the EU jurisprudence. The expression ‘personal data’ ‘undoubtedly covers the name of a person in conjunction with his telephone details or information about his working conditions or hobbies’ as well as information that a person has been injured and is on half time; (Case C-101/01) Criminal Proceedings against Lindqvist [2004] QB 1014; or his name and address: (Case C-553/07) Rotterdam v Rijkeboer. The same is true of the name, date of birth, nationality, gender, ethnicity, religion and language, relating to a natural person, who is identified by name, although it does not apply to legal analysis: (Joined Cases C-141/12, C-372/12) YS v Minister voor Immigratie. A person's name and salary also amounts to ‘personal data’: (C-465/00) Rechnungshof v Osterreichischer Rundfunk [2003] 3 CMLR 10. An image of a person recorded by a camera is also his personal data: (Case C-212/13) Ryneš v Úrad pro ochranu osobních údaju [2015] 1 WLR 2607 at [22]. Mr Pitt-Payne submitted, and again I agree, that these cases are concerned with the ‘identifiability’ limb of the definition.

The question what amounts to ‘personal data’ has also been considered in a number of domestic cases. The first of significance is Durant v Financial Services Authority [2003] EWCA Civ 1746, [2004] FSR 28. Following unsuccessful litigation against Barclays Bank Mr Durant made a complaint to the FSA. That too was unsuccessful. He then made a SAR with which the FSA partially complied. However, the FSA refused to reveal information in four categories of file, some of which contained references to Mr Durant. The leading judgment was that of Auld LJ. He considered that the question of the scope of the definition of ‘personal data’ turned on the meaning of the phrase "relate to" in the phrase ‘data which relate to a living individual’: see [24]. Thus Auld LJ was not concerned with the question whether Mr Durant could be identified from the data. If his name was mentioned, clearly he could be. What was at issue was whether the data ‘related to’ him. At [27] he referred to the purpose of section 7 as being to enable a data subject to check whether the data controller's processing of his personal data unlawfully infringes his privacy. It was not ‘an automatic key to any information … in which he may be named or involved.’ He also pointed out the focus of the DPA on ready accessibility of information. He concluded at [28]:

Mummery LJ simply agreed with Auld LJ and Buxton LJ began his concurring judgment by saying that he, too, agreed with Auld LJ. In my judgment the view expressed by Auld LJ corresponds closely with the view expressed by Advocate General Sharpston in YS v Minister voor Immigratie at [55]:

Edem v The Information Commissioner [2014] EWCA Civ 92 was another case of a complaint to the FSA. Mr Edem complained that the FSA had inadequately regulated a financial institution. He wanted to know the names of the officials who had dealt with his complaint. He applied for this information under the Freedom of Information Act 2000. The FSA refused to disclose the names on the ground that the names were the ‘personal data’ of the officials in question within the meaning of the definition in the DPA (which was imported into the Freedom of Information Act). At [13] Moses LJ said that there was ample authority that ‘a person's name, in conjunction with job-related information, is their personal data.’ Moses LJ then turned to the question why the FTT had reached a contrary conclusion. They had applied the two ‘notions’ which Auld LJ had described in Durant at [28], but Moses LJ held that they were wrong to do so, adding: ‘There is no reason to do so. The information in this case was plainly concerned with those three individuals.’ He also approved the following statement in the Information Commissioner's Guidance:

Beatson and Underhill LJJ agreed. I do not see any conflict between these two cases. What Mr Edem wanted was a specific piece of information, namely the names of the officials who dealt with his case. The question was whether the three officials were identifiable from these data. Plainly they were. What Mr Durant wanted was any document in which he was mentioned. His error was the submission that the contents of any document in which he was mentioned were, without more, his personal data. It is the context in which these two requests were made that explains the difference in outcome between the two cases (although I observe that in both cases disclosure was refused). I agree with both Mr Pitt-Payne and Mr Milford, for the Information Commissioner, that the fact that in Durant Mr Durant was asking for information about himself, and that in Edem Mr Edem was asking for information about third parties is irrelevant to the definition of ‘personal data’. HHJ Harris QC was wrong to think otherwise.”

  It is fair for Mr Millar to submit that the claim is one that calls for the faithful interpretation and application of a statutory code (construed in the light of the Directive). But the statutory definition of personal data on which he relies, does not provide the answer to the question.  I quote the relevant parts of s 1(1):

‘data’ means information which –

(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose …

‘personal data’ means data which relate to a living individual who can be identified -

(a)   from those data or

(b)   from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller

…

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;”

28.              This wording identifies some criteria, such as “relate to”, and “can be identified from …”, but it contains nothing that assists on the question of how to approach the identification of the data to which those criteria are to be applied.  It certainly does not demonstrate or indicate that where a claimant complains of a document, an item-by-item approach to the contents of that document must be adopted. In those circumstances, the Court must look to the DPA and Directive as a whole for guidance, and may also look to extraneous sources for approaches that have been adopted in other, related contexts.  That is what I did when a similar issue arose in the “de-listing” case, NT1 v Google LLC [2018] EWHC 799 (QB) [2019] QB 344.  The claimant sought an order requiring the defendant to remove from search results returned by using the claimant’s name information contained in newspaper articles and book extracts about an old, rehabilitated criminal conviction. One aspect of the claimant’s case was that the information was inaccurate, contrary to the Fourth Principle.  Mr Tomlinson QC, appearing for the claimant, initially argued that for this purpose that the Court should look, not at the natural and ordinary meaning of a document, but rather at each discrete “item of information”. He moved away from that position in the course of the trial, and I rejected it.

29.              I concluded that the right approach was to look at the articles and book extracts as a whole, and interpret any element of them by reference to the meaning that the ordinary reader would take from that element, read in its full context.  My reasons were set out in detail at [80-84]. It is unnecessary to set them out here. In summary I concluded, and it remains my view, that support for this approach can be found in aspects of the DPA itself, the work of the Article 29 Working Party, domestic authority on the application of the DPA and its predecessor (the Act of 1984), and the logic and common sense to be found in the law of meaning in defamation.”

“It’s important to be aware that information you hold may indirectly identify an individual and therefore can still be personal data. If so, this means that the information is subject to the UK GDPR.”

and further that:

Overview and general duty of controller

This Chapter sets out the six data protection principles as follows -

(a) section 35(1) sets out the first data protection principle (requirement that processing be lawful and fair);

(b) section 36(1) sets out the second data protection principle (requirement that purposes of processing be specified, explicit and legitimate);

(c) section 37 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);

(d) section 38(1) sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);

(e) section 39(1) sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);

(f) section 40 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).

(2) In addition -

(a) each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and

(b) sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing.

(3) The controller in relation to personal data is responsible for, and must be able to demonstrate, compliance with this Chapter.”

The first data protection principle

(1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.

(2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either -

the data subject has given consent to the processing for that purpose, or

(b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority.

(3) In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).

(4) The first case is where -

(a) the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and

(b) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(5) The second case is where—

the processing is strictly necessary for the law enforcement purpose,

the processing meets at least one of the conditions in Schedule 8, and

(c) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(6) The Secretary of State may by regulations amend Schedule 8 -

(a) by adding conditions;

(b) by omitting conditions added by regulations under paragraph (a).

(7) Regulations under subsection (6) are subject to the affirmative resolution procedure.

(8) In this section, ‘sensitive processing’ means -

(a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;

(b) the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;

the processing of data concerning health;

the processing of data concerning an individual’s sex life or sexual orientation.”

The second data protection principle

(1) The second data protection principle is that—

(a) the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and

(b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected.

(2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

(3) Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that -

(a) the controller is authorised by law to process the data for the other purpose, and

the processing is necessary and proportionate to that other purpose.

(4) Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.

…

The sixth data protection principle

The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, ‘appropriate security’ includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).”

“The test of necessity is a strict one, requiring any interference with the subject’s rights to be proportionate to the gravity of the threat to the public interest”.

“8.                  Part 3 of the 2018 Act makes provision about the processing of personal data by competent authorities for “the law enforcement purposes” and implements the European Union’s Law Enforcement Directive (Directive (EU) 2016/680) (“the LED”) (section 1(4)). That Directive is therefore a legitimate aid to the interpretation of the 2018 Act. The law enforcement purposes listed in section 31 include the investigation, detection and prosecution of criminal offences. Chapter 5 of Part 3 deals with the transfer of personal data to third countries or international organisations. Sections 73 to 76 set out the general conditions which apply to such transfers (section 72(1)(a)). The data controller cannot transfer personal data unless three conditions are met (section 73(1)(a)). Condition 3 need not concern us, because Condition 1 was not met and it is arguable that Condition 2 could never be met.

9.                  Condition 1 is that the transfer is necessary for any of the law enforcement purposes (section 73(2)). In Guriev v Community Safety Development (UK) Ltd [2016] EWHC 643 (QB), Warby J held (in the context of restricting the subject’s right of access to his personal data) that: “The test of necessity is a strict one, requiring any interference with the subject’s rights to be proportionate to the gravity of the threat to the public interest” (para 45). The parties agree that the same test applies in this context. This obviously requires the data controller to address his mind to the proportionality of the transfer.”

No one would disagree that the address of each individual's private residence is personal data, and represents an aspect of private and family life, but a residential address is an aspect of private life which may not be very private at all. So, for example, MPs are required to disclose an address when seeking nomination for election. This address is published in the electoral process. Usually it will be the constituency address of the candidate and its publication inevitably diminishes its private nature. Other professions and occupations may require notification of and public access to a residential address. Thus, company directors are required to provide a residential address available to those who search the register of companies. Everyone eligible to vote must have his or her address recorded in the register of electors, full versions of which are available for public scrutiny in local libraries and local government offices. The reality is that an individual who is determined to discover a residential address of an adult law-abiding citizen is likely to be able to do so by one legal means or another, and where the person concerned is the holder of a public office and in the public eye, such an inquiry is likely to be easier.

None of this is intended to suggest that the disclosure of an individual's private address under FOIA does not require justification. In the present case, however, there was a legitimate public interest well capable of providing such justification. Thus, for example, there is evidence which suggests that one MP claimed ACA for a property which did not exist, and yet further evidence may demonstrate that on occasions MPs claiming ACA were letting out the accommodation procured from the ACA allowance.

In essence Mr Giffin's argument was that the justification relied on was not sufficiently weighty to make the disclosure of these addresses necessary in all circumstances. It was common ground that "necessary" within schedule 2 para 6 of the DPA should reflect the meaning attributed to it by the European Court of Human Rights when justifying an interference with a recognised right, namely that there should be a pressing social need and that the interference was both proportionate as to means and fairly balanced as to ends. We note the explanation given by the court in The Sunday Times v United Kingdom (1979) 2 EHRR 245 paragraph 59:

It is clear in this case – and is conceded on behalf of Mr Stone at this stage of the argument – that a condition in Schedule 2 is satisfied: viz. paragraph 5(2) of Schedule 2 ("The processing is necessary… for the purpose of any other functions of a public nature exercised in the public interest by any person"). It is common ground that the word "necessary", as used in the Schedules to the 1998 Act, carries with it the connotations of the European Convention on Human Rights: those include the proposition that a pressing social need is involved and that the measure employed is proportionate to the legitimate aim being pursued.”

“… it is denied that the email of 5 June 2019 contained any personal data of the Claimant, that the Claimant’s personal data was thereby disclosed or that the Defendant acted unlawfully as alleged or at all. If which is denied, the email of 5 June 2019 contained any personal data of the Claimant or involved the processing of the same, such processing was lawful for the legitimate purpose of maintaining public confidence in the investigation and prosecution of alleged criminal offences. The Defendant maintained adequate safeguards including that it did not name the Claimant, it did not otherwise confirm that the charging file that it had received related to him, and it did not disclose any information that was not already in the public domain.”

“… re-enforced the correct procedures which should take place. Any future correspondence will be handled appropriately in the future.”

“Right to respect for private and family life

Everyone has the right to respect for his private and family life, his home and his correspondence.

There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

“Freedom of expression

Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This article shall not prevent states from requiring the licensing of broadcasting, television or cinema enterprises.

The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.”

“First, is the information private in the sense that it is in principle protected by article 8? If 'no', that is the end of the case. If 'yes' the second question arises: in all the circumstances, must the interest of the owner of the private information yield to the right of freedom of expression conferred on the publisher by article 10 ?”

It has at all times been common ground that liability for misuse of private information is determined by applying a two-stage test. Stage one is whether the claimant objectively has a reasonable expectation of privacy in the relevant information. If so, stage two is whether that expectation is outweighed by the publisher’s right to freedom of expression. This involves a balancing exercise between the claimant’s article 8 right to privacy and the publisher’s article 10 right to freedom of expression.”

“35 … The first question is whether there is a reasonable expectation of privacy. This is of course an objective question. The nature of the question was discussed in Campbell v MGN Ltd. Lord Hope emphasised that the reasonable expectation was that of the person who is affected by the publicity. He said, at para 99: "The question is what a reasonable person of ordinary sensibilities would feel if she was placed in the same position as the claimant and faced with the same publicity." We do not detect any difference between Lord Hope's opinion in this regard and the opinions expressed by the other members of the appellate committee.

36. As we see it, the question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case. They include the attributes of the claimant, the nature of the activity in which the claimant was engaged, the place at which it was happening, the nature and purpose of the intrusion, the absence of consent and whether it was known or could be inferred, the effect on the claimant and the circumstances in which and the purposes for which the information came into the hands of the publisher.”

‘... there is potentially an important distinction between information which is made available to a person's circle of
friends or work colleagues and information which is widely published in a newspaper …’

See Lord Browne of Madingley v Associated Newspapers Ltd [2008] QB 103, [61], (Sir Anthony Clarke MR, giving the judgment of the Court), cited by Simon LJ in ZXC (CA), [48].

 If PJS’s case was simply based on confidentiality (or secrecy), then, while I would not characterise his claim for a permanent injunction as hopeless, it would have substantial difficulties. The publication of the story in newspapers in the United States, Canada, and even in Scotland would not, I think, be sufficient of itself to undermine the claim for a permanent injunction on the ground of privacy. However, the consequential publication of the story on websites, in tweets and other forms of social network, coupled with consequential oral communications, has clearly resulted in many people in England and Wales knowing at least some details of the story, including the identity of PJS, and many others knowing how to get access to the story. There are claims that between 20% and 25% of the population know who PJS is, which, it is fair to say, suggests that at least 75% of the population do not know the identity of PJS, and presumably more than 75% do not know much if anything about the details of the story. However, there comes a point where it is simply unrealistic for a court to stop a story being published in a national newspaper on the ground of confidentiality, and, on the current state of the evidence, I would, I think, accept that, if one was solely concerned with confidentiality, that point had indeed been passed in this case.

  However, claims based on respect for privacy and family life do not depend on confidentiality (or secrecy) alone. As Tugendhat J said in Goodwin v News Group Newspapers Ltd [2011] EMLR 27, para 85, “[t]he right to respect for private life embraces more than one concept”. He went on to cite with approval a passage written by Dr Moreham in Law of Privacy and the Media (2nd ed (2011), edited by Warby, Moreham and Christie), in which she summarised “the two core components of the rights to privacy” as “unwanted access to private information and unwanted access to [or intrusion into] one’s … personal space” - what Tugendhat J characterised as “confidentiality” and “intrusion”.

 Tugendhat J then went on to identify a number of cases where “intrusion had been relied on by judges to justify the grant of an injunction despite a significant loss of confidentiality”, namely Blair v Associated Newspapers Ltd (10 March 2000, Morland J), West v BBC (10 June 2002, Ouseley J), McKennitt v Ash [2006] EMLR 10, para 81 (Eady J), X & Y v Persons Unknown [2007] EMLR 290, para 64 (Eady J), JIH v News Group Newspapers Ltd [2011] EMLR 9, paras 58-59 (Tugendhat J), TSE v News Group Newspapers Ltd [2011] EWHC 1308 (QB), paras 29-30 (Tugendhat J) and CTB v News Group Newspapers Ltd [2011] EWHC 1326 (QB), para 23 (Eady J), to which can be added CTB v News Group Newspapers Ltd [2011] EWHC 1334 (QB), para 3 (Tugendhat J), Rocknroll v News Group Newspapers Ltd [2013] EWHC 24 (Ch), para 25 (Briggs J), and H v A (No 2) [2015] EWHC 2630 (Fam), paras 66-69 (MacDonald J).

 Perusal of those decisions establishes that there is a clear, principled and consistent approach at first instance when it comes to balancing the media’s freedom of expression and an individual’s rights in respect of confidentiality and intrusion. There has been not even a hint of disapproval of that approach by the Court of Appeal (although it considered appeals in McKennitt [2008] QB 73 and JIH [2011] 1 WLR 1645). Indeed, unsurprisingly, there has been noargument that we should take the opportunity to overrule or depart from them. Accordingly, it seems to me that it is appropriate for this Court to adhere to the approach in those cases. Not only do they demonstrate a clear and consistent approach, but they are decisions of judges who are highly respected, and, at least in the main, highly experienced in the field of media law and practice; and they were mostly decided at a time when access to the internet was easily available to the great majority of people in the United Kingdom.

The significance of intrusion, as opposed to confidentiality, in these decisions was well explained in the judgment of Eady J in CTB [2011] EWHC 1326 (QB), where he refused an application by a newspaper to vary an interlocutory injunction because of what he referred to as “widespread coverage on the Internet”. At para 24 he said that “[i]t is fairly obvious that wall-to-wall excoriation in national newspapers … is likely to be significantly more intrusive and distressing for those concerned than the availability of information on the Internet or in foreign journals to those, however many, who take the trouble to look it up”. As he went on to say in the next paragraph of his judgment, in a case such as this, “[f]or so long as the court is in a position to prevent some of that intrusion and distress, depending upon the individual circumstances, it may be appropriate to maintain that degree of protection”.

   The same approach was taken by Tugendhat J in a later judgment in the same case, CTB [2011] EWHC 1334 (QB), when refusing a further application to lift the interlocutory injunction after the applicant’s name had been mentioned in the House of Commons. At para 3, having accepted that it was “obvious that if the purpose of this injunction were to preserve a secret, it would have failed in its purpose”, he said that “in so far as its purpose is to prevent intrusion or harassment, it has not failed”. Indeed, he regarded the fact that “tens of thousands of people have named the claimant on the internet” as confirming, rather than undermining, the argument that ‘the claimant and his family need protection from intrusion into their private and family life’.”

“The role of the concept of the ‘public domain’ in misuse of private information has been a matter of much deliberation, culminating in an important ruling of the Supreme Court in PJS v News Group Newspapers Ltd. Even if seemingly private in nature, there will usually be no reasonable expectation of privacy in information that is already in the public domain. This principle has carried over to some extent to the claim for misuse of private information from that for breach of confidence. The determination as to precisely when information will be deemed already to be in the public domain is more nuanced in this new context, however; it is less automatic in the context of privacy than confidentiality of government secrets. The matter will often be a question of degree. There is a qualitative difference, for instance, between information being in the public domain by reason of an individual appearing physically in a public place with the natural exposure to others present that this brings, and the publication of photographs disclosing that information in newspapers or on a social media account with millions of followers, such as to render it universally accessible and, in effect, known. Similarly, the fact that information is known to some people does not mean that wider publication would have no significant effect. Another similar factual scenario arises increasingly often in the context of the reproduction in the mainstream media of personal information published on social networking websites.

At some point, however, it appears to be accepted that the general availability of some given information will preclude the possibility of any reasonable expectation of privacy. For instance, in Mosley v News Group Newspapers Ltd - a case in which the online article containing the offending information had already been viewed several hundred thousand times and a video more than 1.5 million times before the claimant sought an interim injunction—both items were held to be incontrovertibly in the public domain such that no interim order enjoining further publication was available. In contrast, in Weller v Associated Newspapers Ltd , the court was presented with a complaint regarding the publication in a newspaper and online of the unpixellated faces of the children of a well-known musician. Evidence showed that there had previously been an array of publications concerning the children, including some reference to the children in newspaper and other interviews, personal tweets regarding the family (some of which had been picked up and republished by national newspapers), other online publications by different members of the family circle, publication of photographs in a book, and a single modelling appearance of one of the children in a teen magazine. Despite this, Dingemans J concluded that the children retained a reasonable expectation of privacy over publication of photographs showing their faces, “one of the chief attributes of their respective personalities”.

A range of additional factors may influence the determination of whether information is sufficiently in the public domain so as to rule out a claim for misuse of private information. These include whether the information has been published in othe jurisdictions, the extent to which “jigsaw” revelation allows the general public access to new information, the conduct of the publisher, the specificity of any information already in the public domain, and the passage of time.

A further issue with regard to the public domain concerns whether the test should be that information is actually known by a sufficiently large number of people in the given audience, or whether it is enough that it is merely accessible in theory to them. In Spycatcher, Lord Goff suggested a criterion of “general accessibility”. Other judges have approached the matter differently, and concluded that the mere fact that information is generally accessible somewhere in public records or from some other esoteric source will not be enough to disqualify the information from being private. The same point can be made with regard to unheralded publication in an obscure location on the internet. It is submitted that Lord Goff’s concept of “general accessibility” should therefore in this context be understood as meaning ‘being known or readily knowable to a substantial number of people’.”

“First, neither article (8 or 10) has as such precedence over the other. Secondly, where the values under the two articles are in conflict, an intense focus on the comparative importance of the specific rights being claimed in the individual case is necessary. Thirdly, the justifications for interfering with or restricting each right must be taken into account. Finally, the proportionality test must be applied to each.”

“(i) neither article has preference over the other, (ii) where their values are in conflict, what is necessary is an intense focus on the comparative importance of the rights being claimed in the individual case, (iii) the justifications for interfering with or restricting each right must be taken into account and (iv) the proportionality test must be applied: see eg  In re S (A Child) (Identification: Restrictions on Publication) [2005] 1 AC 593, para 17, per Lord Steyn, with whom all other members of the House agreed; McKennitt v Ash [2008] QB 73, para 47, per Buxton LJ, with whom the other members of the court agreed; and Mosley v News Group Newspapers Ltd [2008] EWHC 687 (QB) at [28] per Eady J, describing this as a 'very well established' methodology. The exercise of balancing article 8 and article 10 rights has been described as 'analogous to the exercise of a discretion': AAA v Associated Newspapers Ltd [2013] EWCA Civ 554 at [8].”

“… looking first at the comparative importance of the actual rights being claimed in the individual case; then at the justifications for interfering with or restricting each of those rights; and applying the proportionality test to each.”

It seems to me that on the authorities, and as a matter of general principle, a suspect has a reasonable expectation of privacy in relation to a police investigation, and I so rule. As a general rule it is understandable and justifiable (and reasonable) that a suspect would not wish others to know of the investigation because of the stigma attached. It is, as a general rule, not necessary for anyone outside the investigating force to know, and the consequences of wider knowledge have been made apparent in many cases (see above). If the presumption of innocence were perfectly understood and given effect to, and if the general public was universally capable of adopting a completely open- and broad-minded view of the fact of an investigation so that there was no risk of taint either during the investigation or afterwards (assuming no charge) then the position might be different. But neither of those things is true. The fact of an investigation, as a general rule, will of itself carry some stigma, no matter how often one says it should not. This was acknowledged in Khuja v Times Newspapers Ltd [2017] 3 WLR 351 (the PNM case re-named in the Supreme Court). The trial judge had acknowledged that some members of the public would equate suspicion with guilt, but he considered that members of the public generally would know the difference between those two things (see para 32). Lord Sumption was not so hopeful. He observed:

"Left to myself, I might have been less sanguine than he was about the reaction of the public to the way PNM featured in the trial."

In the same case the minority Justices (Lords Kerr and Wilson) quoted from Cobb J's observations in Rotherham Metropolitan Borough Council v M [2016] 4 WLR 177, with approval.

These judicial remarks demonstrate at least some of the reasons why an accused should at least prima facie have a reasonable expectation of privacy in respect of an investigation. They are particularly appropriate to the type of case referred to there (of which, of course, the present case is an instance) but they are generally applicable, to varying extents, to other types of cases.

That is not to say, and I do not find, that there is an invariable right to privacy. There may be all sorts of reasons why, in a given case, there is no reasonable expectation of privacy, or why an original reasonable expectation is displaced. An example was given by Sir Brian Leveson in the extract quoted above, and others can be readily thought of. But in my view the legitimate expectation is the starting point. I consider that the reasonable person would objectively consider that to be the case.”

“2.39. I would endorse the general views of Commissioner Hogan-Howe and Mr Trotter on this issue [viz the police briefing the press on suspects]. Police forces must weigh very carefully the public interest considerations of taking the media on police operations against Article 8 and Article 6 rights of the individuals who are the subject of such an operation. Forces must also have directly in mind any potential consequential impact on the victims in such cases. More generally, I think that the current guidance in this area needs to be strengthened. For example, I think that it should be made abundantly clear that save in exceptional and clearly identified circumstances (for example, where there may be an immediate risk to the public), the names or identifying details of those who are arrested or suspected of a crime should not be released to the press nor the public.”

“The courts below were correct to hold that, as a legitimate starting point, a person under criminal investigation has, prior to being charged, a reasonable expectation of privacy in respect of information relating to that investigation and that in all the circumstances this is a case in which that applies and there is such an expectation.”

Compensation for contravention of other data protection legislation

(1) A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the GDPR, is entitled to compensation for that damage from the controller or the processor, subject to subsections (2) and (3).

(2 )Under subsection (1)—

(a) a controller involved in processing of personal data is liable for any damage caused by the processing, and

(b) a processor involved in processing of personal data is liable for damage caused by the processing only if the processor -

(i) has not complied with an obligation under the data protection legislation specifically directed at processors, or

(ii) has acted outside, or contrary to, the controller’s lawful instructions.

(3) A controller or processor is not liable as described in subsection (2) if the controller or processor proves that the controller or processor is not in any way responsible for the event giving rise to the damage.

(4) A joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities are determined in an arrangement under section 58 or 104 is only liable as described in subsection (2) if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.

(5) In this section, ‘damage’ includes financial loss and damage not involving financial loss, such as distress.”