In this month’s review, we look at a number of court decision on data protection, Article 8 and privacy and an important decision of the Information Rights First-‐Tier Tribunal (FTT) concerning the fees that can be levied under the Environmental Information Regulations (EIRs).
Damages for Distress under s.13(2) of the DPA
The Court of Appeal has now considered whether a consumer is entitled to damages for distress under the Data Protection Act 1998 s.13(2), as a result of a finance company’s failure to process his data in accordance with the Act. Section 13(2) DPA provides that, in certain circumstances: “An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress.” In the unreported case of Halliday v Creation Consumer Finance Ltd, Mr Halliday sought substantial damages when CCF passed incorrect information about an allegedly unpaid debt to a credit reference agency. At first instance Mr Halliday had been awarded only nominal damages.
In a decision which will be no doubt be carefully considered by finance agencies and consumer advocates alike, the appeal was allowed, and Mr Halliday was awarded £750 in compensation for his distress and frustration at CCF’s breach. Whilst there was no contemporaneous evidence of injury to his feelings or distress, it was important to mark his frustration at C's non-‐compliance with some kind of remedy. The damages awarded to Mr Halliday were set at £750 because of the lack of evidence of more substantial damage (e.g., damage to his reputation or his creditworthiness). Of relevance to future claimants is the fact that the Court of Appeal noted that higher damages might be awarded if there was evidence of a loss of credit or business reputation or contemporaneous evidence of injury to feelings or distress.
The Court of Appeal rejected Mr Halliday’s further argument that he could seek direct enforcement of Article 24 of the Directive C 95/46 (member states must provide for sanctions where data protection rights are infringed). Art.24 of the Directive required the adoption of legislative measures, which the United Kingdom had done by enacting the 1998 Act which contained provisions to implement the Directive. An individual could not directly enforce the provision in private proceedings.
The decision was handed down in an extempore judgment and is to date unreported; it is to be hoped it will be properly reported and referenced.
Information held by the Police
The Court of Appeal has also handed down an important ruling on the powers of the police to collect and retain information of a personal nature relating to members of the public. In the linked cases of Catt v ACPO and T v Commissioner of the Police of the Metropolis  EWCA Civ 192, the Court considered the collection and the indefinite retention of information linking Mr Catt to the activities of a protest group, and the retention of a ‘warning’ letter served on Ms T following an allegation made to the police that she had made a homophobic insult. In both cases, it was held that the police actions of collection and retention of the information amounted to an ‘interference’ with private life under Article 8(1), ECHR. This was despite the fact that in the case of Mr Catt, the police were recording publicly available information. Although to be visible had indeed been the very point of attending the demonstrations, the public authority’s actions in collecting, analysing and retaining information about that conduct fell within the scope of Article 8(1).
Furthermore, the indefinite retention of the information was not justified under Article 8(2). It is apparent that, in reaching their conclusions about justification, the members of the Court of Appeal were not prepared to be unduly deferential towards police views. For example, the claim that knowledge of Mr Catt’s attendance at demonstrations was of ‘intelligence value’ even though he had never been associated with criminal activities was subject to critical analysis, and so too was the assertion that it would be difficult to ‘weed out’ information about individuals who were not of interest from the files on the protest group. In relation to the letter to Ms T recording the allegation of harassment, the Court noted that there was an obvious justification for keeping the letter for a few months, in case a pattern of behaviour amounting to harassment began to emerge; but after a few months had elapsed with no further complaints, such justification was no longer present.
The legality of the police actions were analysed solely under Article 8 rather than the DPA; in both cases, it was accepted that analysis under the DPA would not add materially to the arguments under the ECHR.
Amending Medical Records
It can be difficult to hear of unreported County Court cases concerning data protection, but they are significant as the County Courts have responsibility for adjudicating on many aspects of the DPA regime. Word about the treatment of the important subject of amendments to medical records has reached us courtesy of 39 Essex Street’s Richard Spearman QC, who appeared for a medical practice in a challenge by a patient (“S”) who wanted certain details eradicated from her NHS medical records -‐ a step that her GPs’ practice was not prepared to take.
It was accepted by the District Judge that the retention (i.e., ‘processing’) of the data would cause and continue to cause S substantial distress, thus bringing s.10 DPA into play (“Right to prevent processing likely to cause damage or distress”). However, section 10 and its associated right to prevent processing does not apply if certain conditions are met, including the condition in Paragraph 3 of Schedule 2 of the Act, that: “the processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract”. The Practice argued successfully that its legal obligations included: (a) the legal requirement to provide to the Claimant with medical care; and (b) compliance with the fourth principle of the Data Protection Act, which requires personal data to be accurate and, where necessary, kept up to date. The District Judge accepted that these requirements meant that the disputed processing was ‘necessary’. If a hypothetical GP should, in the future, be consulting with the Claimant in certain circumstances, it would be important for the GP to know about the past history; so the information had to be retained. It was also the case that the processing that the processing was ‘in order to protect the vital interests of the Claimant’, thus meeting the requirements of Paragraph 4 of Schedule 2. It followed that section 10 DPA did not apply.
The judge also accepted a further argument, that even if Section 10 did apply, the processing would not be “unwarranted”, as required by s.10(1)(b), as a result of its purpose. He balanced the distress to the Claimant against the need for accurate and complete information to be held in medical records, and concluded that the latter outweighed the former.
Although at one level the decision represents a straight-‐forward application of the DPA, it is still a useful example of the Court’s treatment of a difficult and sensitive subject, which has the potential to cause much upset and distress to patients.
Fees under the Environmental Information Regulations (“EIRs”).
In Leeds City Council v IC & APPS Claimants (EA/2012/0020-‐21) (judgment of 22 March 2013), the FTT delivered an important decision on the subject of fees chargeable under Regulation 8 of the EIRs. The Regulations permit a charge that does not exceed a “reasonable amount” to be levied. Requestors had asked for the information that Leeds held which would allow them to answer the questions in the relevant property search form issued by the Law Society (the CON29R form). The Council charged the requestors £22.50 to meet their request, which was the fee it levied for its CON29R service. Its costs were calculated on the basis of staff time etc, rather than solely on basis of the costs of disbursements such as photocopying. The most important issue for the FTT was whether the non-‐disbursement costs could properly be the subject of a charge under Reg. 8 EIR.
Despite the breadth of the words “reasonable amount”, the FTT held that such charges could not include provision for the reimbursement of staff costs. There was no authority directly on this point, so the FTT had to look at the principles underlying the Aarhus Convention, the Directive and the EIRs, as well as the only relevant ECJ authority, Case C-‐217/97 Commission v Germany  ECR I-‐5087. This, it decided, led to the conclusion that: “The costs that can be imposed relate to the act of supplying information in order to comply with a request, not to the act of identifying or retrieving or collating the relevant material in the first place”. The FTT had regard to the aim of ensuring public access to information and suggested that an interpretation which permitted charges to include more than disbursement costs would have “significant adverse consequences”. In all, it concluded a public authority may not charge “for the cost of administrative tasks or administrative acts which may include, but are not necessarily limited to, the spent by staff in locating, retrieving or redacting the information requested”.
A number of secondary issues considered by the FTT about the way the charge had been calculated by the Council in this case will be largely irrelevant in future, if charges can be imposed in respect of disbursements only. But the FTT also held that a failure to publish a Schedule of Charges which complied with the requirements of Regulations 8(8) would also lead to the loss of the entitlement to levy a charge under Regulation 8(1). This aspect of the judgment suggests that such Schedules should be reviewed by public authorities for compliance, in case any failings lead to objections to charges sought to be levied.
In Moorehouse v The Information Commissioner EA/2012/0158 (FTT) (Information Rights) (8 March 2013), Mr Moorehouse sought information concerning the Department for Business, Innovation and Skills facilitation of banking and insurance services to Huntington Life Services. The exemptions relied upon by DBIS were ss.21 (information reasonably accessible), s.35(1)(b) ministerial communications) and s.43(2) (prejudice to commercial interests); this reliance was upheld by the IC. The FTT dealt swiftly with the first two exemptions – it agreed with the IC that Parliamentary Questions relating to the provision of banking and insurance services to HLS was accessible to Mr Moorhouse and that the exemption set down in s.35(1) with respect to communications between ministers was engaged, and justified, on the facts.
The FTT went on to consider s.43(2) of FOIA. Section 43(2) is engaged where the disclosure of the information would or would be likely to prejudice the commercial interests of any person. It is a qualified exemption and subject to the public interest test. The FTT agreed with the IC that on balance it was in the public interest to protect HLS’s commercial interests. In so doing, the FT noted that the information sought was potentially valuable to competitors and was only at issue because of HLS’s rather unusual circumstances (which indeed led DBIS to having to facilitate provision of banking and insurance services). The FTT found it significant that HLS’s competitors were not required to release similar commercially sensitive information. E case demonstrates that commercial interests under s.43(2) will be judged in the round, with an emphasis on the relationship between the relevant party and its competitors.