This judgment was handed down remotely at 10.30am on 09 May 2023 by circulation to the parties or their representatives by e-mail and by release to the National Archives.
Mrs Justice Farbey :
Introduction
- By a claim form issued on 25 June 2021, the claimant challenges the refusal of each defendant to provide him with his personal data. He seeks relief for breach of the subject access provisions of the Data Protection Act 2018 ("DPA 2018") and the United Kingdom General Data Protection Regulation ("UK GDPR"). The first defendant is a provider of transcription services. It provides transcripts of court hearings pursuant to a Framework Agreement with the Lord Chancellor relating to the provision of court reporting and transcription services ("the Framework Agreement"). The second defendant is a High Court Master and a Costs Judge.
- The claimant has made a subject access request ("SAR") to each defendant under the UK GDPR and DPA 2018 for the supply of the personal data they hold (respectively) about him. The requests have their origins in other, longstanding litigation in the High Court. The details of that other litigation are not relevant to the legal issues that I must determine and will not be rehearsed in this judgment.
- The claimant is distressed by some of the personal background that overlaps the present claim and the other litigation. Repetition of the background – whether in court hearings or outside court - causes him renewed distress. In order to protect his privacy rights, reporting restrictions are in place in relation to these proceedings and in relation to the other litigation.
- In refusing to provide personal data to the claimant, each defendant relied on the statutory exemption under para 14 of Part 2 of Schedule 2 to the DPA 2018 ("para 14"). The exemption enables personal data to be withheld from an individual if (among other things) it is processed by an individual or court acting in a judicial capacity or if its disclosure would be likely to prejudice judicial independence ("the judicial exemption"). Counsel's researches have revealed that the judicial exemption has not been the subject of previous High Court or appellate authority.
- The determination of the present claim raises four main issues:
i. Issue 1: Scope of the judicial exemption: As a matter of law, were either or both of the defendants entitled to withhold some or the entirety of the claimant's personal data on the basis of the judicial exemption?
Having heard legal argument on behalf of all parties on the interpretation of the judicial exemption, I announced my decision during the course of the hearing that that there was no legal bar to the defendants' withholding the claimant's personal data on the basis of the judicial exemption.
ii. Issue 2: Procedure for consideration of whether the judicial exemption applies: In order for the court to determine whether the withheld personal data are (as a matter of fact) covered by the judicial exemption, does the court have power to consider the withheld material in closed session (i.e. in the absence of the claimant and his legal representatives)?
Having heard legal submissions on behalf of all parties, I announced my decision during the course of the hearing that the court has such a power.
iii. Issue 3: Application of the judicial exemption to the facts of the case: As a matter of fact, were some or all of the withheld personal data covered by the judicial exemption?
Having held open and closed sessions, I announced my decision during the course of the hearing that the claimant was not entitled to any disclosure and that the entirety of the withheld data fell within the judicial exemption.
iv. Issue 4: Did the second defendant reply to the SAR in time? Is the claimant entitled to a remedy on the grounds that the second defendant's reply to his SAR was not made within the requisite one month of receipt of the SAR? In the present case, the reply was made more than one month after the claimant's letter was received at the Royal Courts of Justice to which it was posted but less than one month after the second defendant received it.
Having heard submissions from all parties, I reserved my decision on this issue.
- This judgment contains (i) the reasons for my decisions on Issues 1-3; and (ii) my decision and reasons on Issue 4 and other, remaining issues.
Factual background
- I am satisfied of the following facts on the balance of probabilities. The claimant is an individual. He brought a number of claims in the High Court against a government department. The claims were heard together. The claimant had mixed success so that the trial judge made a costs order in his favour but also costs orders against him. All the costs were to be the subject of detailed assessment by a Costs Judge. The second defendant was allocated as the Costs Judge and the costs proceedings commenced. There were a number of interim hearings.
- During the course of the costs proceedings, in March 2021, the claimant lodged with the Judicial Conduct Investigations Office ("JCIO") a complaint of judicial misconduct against the second defendant. The complaint made a number of different allegations. It was dismissed in its entirety in April 2021. I have been told that the claimant has made a complaint to the Judicial Appointments and Conduct Ombudsman ("JACO") challenging JCIO's handling of his case.
- By a judgment given in April 2021, the second defendant assessed the claimant's costs at only a very small fraction of the very substantial costs that he had claimed. She went on to reduce the assessed costs by 70% on the grounds of the claimant's conduct of the litigation (see CPR 44.11).
Request for data from the second defendant
- By letter to the second defendant dated 28 April 2021, the claimant made a SAR in the following terms:
"1. Please supply the personal data you hold about me, which I am entitled to receive under data protection law. …
3. In undertaking your search please consider the information about me going back to March 2018 to include communications with
(a) the judiciary (including those responsible for training, supervision and conduct of the judiciary (such as the Senior Costs Judge and JCIO))
(b) the administrators of the Courts (including the Ministry of Justice and its agency of HMCTS)
(c) authorised Transcription Companies
4. Material held includes
(i) my 'special category' personal data (in particular health);
(ii) matters relating to my anonymity and security of my personal data;
(iii) administrative matters for HMCTS (in particular the issuing of applications; requests for transcripts; and responding to correspondence); and
(iv) my professional and business interests (including research)."
- The second defendant has disclosed a copy of the envelope in which the SAR was sent. The claimant has in correspondence with the second defendant's solicitor and at para 38 of his witness statement complained that he has not had sight of the original envelope. I heard no persuasive submissions about why the copy would not be faithful to the original document. I have no reason to suppose that the copy I have seen was not a true copy. It shows that the SAR was sent by special delivery post on 28 April 2021. The claimant's case – admitted in the second defendant's defence – is that the letter was delivered to the Royal Courts of Justice and signed for on 30 April 2021. The copy of the envelope shows that it was date stamped as received by the Senior Courts Costs Office on 7 May 2021. The second defendant endorsed the envelope by hand to show that she had opened the envelope on 13 May 2021.
- In the absence of any reply to the SAR, the claimant on 2 June 2021 sent a letter before claim to the second defendant in which he contended that there had been non-compliance with the SAR within the requisite timeframe of one month or at all.
- On 3 June 2021, the claimant received a reply to his SAR in a letter dated 26 May 2021 from the Knowledge and Information Liaison Officer ("KILO") of the London Regional Support Unit within Her Majesty's Courts and Tribunals Service ("HMCTS"). The reply states (so far as relevant to the issues before me):
"Your request has been handled under the UK General Data Protection Regulation (the Regulation) and the Data Protection Act 2018 (the DPA).
This response has been prepared on behalf of [the second defendant].
The information you request is exempt from the right to access personal data under Article 15 of the Regulation….
Personal data relating to you held by [the second defendant], processed while [she] was acting in a judicial capacity, are … exempt from the article 15 right.
Information relating to you processed by the second defendant while not acting in a judicial capacity is exempt under Schedule 2, paragraph 16(1), (2) and (3) of the DPA.
Schedule 2 paragraph 16…and Article 5 of the GDPR…do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information."
- The second defendant relied, therefore, on the judicial exemption (para 14) and on the exemption relating to third party data (para 16 of Schedule 2 to the DPA 2018). The letter went on to advise the claimant of routes for complaint if he was dissatisfied with the way his SAR had been handled. I need not set out the details.
- The second defendant did not reply to the letter before claim. The claimant did not send any further pre-claim correspondence to deal with the KILO reply.
Request for data from the first defendant
- By letter to the first defendant dated 13 May 2021, the claimant requested that he be supplied with the personal data held about him. He referred to three hearings and specifically requested data held by the first defendant in relation to his requests for transcripts of those hearings. Two of the transcript requests related to the other proceedings that I have mentioned above. I do not know anything about the proceedings in which the third transcript request was made. The claimant also specifically requested that he be provided with information contained in:
"(a) any internal communications involving the Transcription Agency including anything provided to anyone advising the Transcription Agency; and
(b) any external communications including anything with [the second defendant]; the Senior Courts Costs Office; the Court Reporting and Transcription Unit…; and HMCTS/the Ministry of Justice generally."
- By letter to the claimant dated 28 May 2021, the first defendant responded. The response dealt with the transcript request forms (known as EX107 forms) for three hearings. In relation to Parts A-D of the three forms, the first defendant refused to provide the claimant with a copy on the grounds that he had himself completed them. In relation to Part E, which had in each case been completed by the court, the first defendant confirmed that the claimant could not be identified. In other words, Part E of the forms contained no "personal data" and so there was nothing to disclose.
- As to communications about the transcripts, the second defendant confirmed that there was in relation to one transcript no communication not already in the claimant's possession from which he could be identified. In relation to the other transcripts, the only communications from which the claimant could be identified were two emails from the second defendant. The first defendant refused to disclose those emails on the grounds of the judicial exemption, maintaining that the second defendant had processed the data in the emails in a judicial capacity. In addition, information relating to the claimant processed by the second defendant when she was not acting in a judicial capacity was exempt from disclosure by statute because it would involve disclosing information relating to a third party who could be identified from the information.
- The letter concluded by providing the following information:
"The Transcription Agency do not disclose any of your data to any other third party other than the Ministry of Justice under our contractual obligations with them.
The Transcription Agency retain your personal data, in line with our contract with the Ministry of Justice, for a period as defined by the Ministry of Justice and do not transfer any data whatsoever to a third country or any internal organisations. You have the right to request that we erase or restrict the data held or request that we hold your data for a specific period of time - we would need to receive the approval of the Ministry of Justice prior to making any changes to this arrangement.
The Transcription Agency is accredited with Cyber Essentials and ISO 27001. All data is processed in line with the requirements of these standards as well as the current data protection legislation."
- Nothing that I have read or heard causes me to doubt the accuracy of what the letter says.
- By letter before claim to the first defendant dated 4 June 2021, the claimant contended that there had been non-compliance with his SAR. He stated that:
"the processing of transcript requests are [sic] administrative and in respect of such administrative processes [the second defendant] was not acting in a judicial capacity (Part E of Form EX107 is for completion by administrative staff)."
He made the point that the statutory exemption in relation to data relating to third parties is not a blanket excuse for withholding data. He sought a copy of the contract between the first defendant and HMCTS on which the first defendant relied.
- By letter dated 18 June 2021, the first defendant responded in considerable detail to the letter before claim. The response stated (among other things):
"14. We have already confirmed that all data is processed in accordance with the high standards of ISO 27001. More specifically integrity and confidentiality measures include –
• All transcribers have individual password protected folders where they access their allocated work. Master Logs are kept of transcribers who work on the file and would have had access. This provides a secure audit trail.
• Completed transcripts uploaded to central server SFTP. Password known only to top management. Access to these transcripts restricted only to authorised staff on a 'need to know' basis.
• Transcripts requiring approval by the court/judge emailed to the court (standard process). Mailbox passwords known only by top management. Access to that mailbox only by authorised staff.
• Kaspersky installed on all computers and monitored daily for threats.
• Admin staff – individual log in to access the system – password updates every 30 days – regular review as to access rights.
• Server – access to work folders/orders is by authorised personnel only on a 'need to know' basis.
• Onsite Server – physically locked and secured within server room. This is a secure room at the heart of the building with access via locked doors by authorised staff only. The secure room has both internal and exterior access monitored 24/7 by CCTV monitoring.
• Onsite and offsite back-ups of all data is conducted daily. The offsite data storage is in a secure data centre with appropriate security measures and protocols. For extra resilience the data back up is replicated in an additional offsite data centre. Data centre staff cannot access any individual data files.
• Court transcripts are only deleted under instructions from HMCTS (except for court audios which can be removed from the system with certain time periods). For example, the original audio for the hearing dated 03.05.19 referred to in your SAR was destroyed by our contractor, ShredStation, on 26.03.21. (ShredStation collection number 215684).
• All building exit and entry points are secured by CCTV and access is via intercom and coded entry system.
15. Upon receipt of your Subject Access Request 13.05.21 we contacted the Contracts and Performance Team at HMCTS by telephone to advise we had received a SAR. This was a courtesy call and no personal information was revealed at all – no names, no references to personal information whatsoever, simply that we had received a SAR and to enquire if they needed any contractual involvement. As it was a SAR rather than a FOI, there was no contractual requirement that they be involved further."
- Nothing that I have read or heard causes me to doubt the accuracy of what the letter says.
The claim and the course of the proceedings
- By a claim form issued on 25 June 2021, the claimant commenced the present proceedings in the Liverpool County Court. On the same day, the claimant applied to the second defendant to recuse herself from any further involvement in the costs proceedings. On 12 July 2021, the second defendant refused the recusal application.
- The claimant relies on Amended Particulars of Claim ("APOC") dated 7 October 2021. Having set out the factual background, the law and some of the guidance that he claims is relevant, the claimant set out his claims in Section D:
"24. The Claimant contends that both the 1st and 2nd Defendants have failed to comply with the Claimant's SARs (set out above) in accordance with the provisions (referred to above).
25. In particular the failure to follow the 3 step procedure referred to in the ICO detailed guidance (the 'Gaskin procedure') required before asserting the exemption is in breach of the Defendants' obligations to the Claimant.
26. In respect of the 2nd Defendant it is asserted that:
(a) The 2nd Defendant's response was not provided within a month; and
(b) There was no consideration of the data which was held before asserting the exemptions. In effect there has been a disregard of what was (or ought to have been knowingly) required of the 2nd Defendant (especially having regard to 'Data Protection - The Responsibilities of the Judiciary' in which it is made clear that the 2nd Defendant is responsible for approving of the response).
27. The Claimant seeks the following relief:
(a) Declarations that the Defendants have not complied with their obligations to the Claimant in respect of the Claimant's SARs. Such declarations to include:
(i) In respect of both Defendants that they have withheld data that ought to have been provided to the Claimant
(ii) That both Defendants have failed to process the Claimant's SARs by undertaking the required procedure (the Gaskin procedure) before asserting the Protection of the rights of others exemption.
(iii) In respect of the 2nd Defendant that the response was not provided within the required timescale
(b) The following Mandatory relief:
(i) A mandatory injunction compelling the Defendants to comply with the Claimant's SARs by undertaking the 'Gaskin procedure'; and/or
(ii) A compliance Order under section 167 of the Data Protection Act 2018
(c) Such further and or other relief and remedies as may be appropriate.
(d) Costs."
- The claimant does not seek compensation. In his skeleton argument, Mr David S Boyle on behalf of the claimant seeks an order that the defendants comply with their obligations under the UK GDPR and the DPA 2018. He states that that "will entail declarations that the Defendants are not entitled to, or have not proven, exemptions and the making of compliance orders."
- On 3 November 2021, the second defendant entered a defence to the claim against her. On 5 November 2021, the first defendant entered a defence to the claim against it.
- The disclosure process was undertaken pursuant to CPR Part 31. On 23 February 2022, the second defendant supplied a list of the sort of documents she held about the claimant by way of standard disclosure pursuant to CPR 31.6. She refused to permit the claimant to inspect the documents, relying on the judicial exemption. On 25 February 2022, the claimant supplied his standard disclosure list. On 25 March 2022, the first defendant supplied its list and was willing to provide the claimant with some of the documents including a copy of the Framework Agreement redacted for confidentiality and relevance. On 2 August 2022, the first defendant supplemented its disclosure list.
- The claim was the subject of extensive and lengthy case management in the County Court until, on 15 June 2022, it was transferred to the High Court. At a hearing before the second defendant on 13 September 2022, the claimant again applied to the second defendant to recuse herself from the costs proceedings. In an ex tempore judgment, the second defendant dismissed the application.
- On 15 December 2022, I held a pre-trial review and made case management directions for the three-day hearing of the claim.
Sources of evidence about the judicial exemption
- At the hearing, the claimant relied on a witness statement dated 8 April 2022. Neither of the defendants wished to cross-examine him and so he did not give oral evidence. The first defendant relied on the witness statement of its Operations Manager, Ms Natalie Goodson, dated 8 April 2022. She gave oral evidence in accordance with her witness statement and was cross-examined by Mr Boyle. By email from the Government Legal Department ("GLD") dated 8 April 2022, the second defendant indicated that she would not be serving any witness evidence. The email stated:
"Our case is supported entirely by the parties' disclosure and the applicable law referred to within our Defence."
- During the course of the pre-trial review, I was supplied with a bundle of the material that the first defendant had withheld from the claimant. This "closed" bundle has not been provided either to the claimant or to the second defendant. I was subsequently supplied with closed bundles from the second defendant containing the material which she had withheld from the claimant. Her closed bundles have not been provided to the claimant or to the first defendant.
- As to the procedure for the court's consideration of the closed material, the claimant confirmed at the pre-trial review that he did not seek the appointment of a special advocate or the imposition of a confidentiality ring. I considered the material in closed sessions from which the claimant and the public were excluded.
- After the trial had concluded, the second defendant (at her suggestion and with no objection from the claimant) filed and served a "Closed Material Contents Confirmation Statement" dated 27 January 2023 supported by a statement of truth. The Confirmation Statement says:
"At paragraph 3 of Farbey J's Order [made in relation to the pre-trial review], I was ordered to file a closed bundle containing all of the Claimant's personal data in my possession or control which I held at the date of the subject access request of 28 April 2021. I confirm I have complied with the requirements of paragraph 3 of the Court's Order by conducting a reasonable and proportionate search for all material falling within scope of the subject access request and providing that material to the Court through my solicitors. Some of the material provided to the Court arguably does not contain the Claimant's personal data. However, I have erred on the side of over- inclusiveness."
- There was no reason for the first defendant to file a similar statement because any queries about the extent of the first defendant's search for material relating to the claimant's SAR could be dealt with in Mr Boyle's cross-examination of Ms Goodson. At any rate, I was not asked to direct that such a statement be filed.
Key legislation
The right to request personal data
- The UK GDPR and the DPA 2018 together contain the framework for data protection law in the UK, replacing the Data Protection Act 1998 ("DPA 1998") in its entirety. They give rights to data subjects. It is not in dispute that the claimant is a data subject. The rights attach to "personal data" which means "any information relating to an identified or identifiable living individual" (DPA 2018, section 3(2)).
- Article 15 of the UK GDPR provides a right of access to personal data and states in so far as relevant:
"(1) The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data …
(3) The controller shall provide a copy of the personal data undergoing processing. …
(4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others."
- The right of access to personal data lies against a "data controller" who "alone or jointly with others, determines the purposes and means of the processing of personal data" (UK GDPR, article 4(7); see also DPA 2018, section 6(1)). The right of access does not lie against a "data processor" who "processes personal data on behalf of the controller" (UK GDPR, article 4(8); see also DPA 2018, section 32).
- A data controller is under a duty to provide information to a data subject on action taken on a SAR without undue delay and "in any event within one month of receipt of the request", subject to provisions for extension of time on which I have not heard argument (UK GDPR, article 12(3)).
Special category data
- Article 9(1) of the UK GDPR and section 10 of the DPA 2018 make special provision for certain categories of data – for example, health and employment data – which are particularly sensitive.
- As noted by the Editors of the White Book (para 3G-9.4, Vol 2, 2022):
"Known under DPA 1998 s.2 as sensitive personal data, art.9(1) UK GDPR creates a new and expanded list of special category personal data to which additional protections from and restrictions on processing apply. The types of special category data are mostly the same as under the previous regime, save that biometric data has been added in a reflection of developing technology…
Special category data is identified in the UK GDPR because it requires a higher measure of protection: the processing of it is more intrusive and the data is likely to be more private; see, e.g. the CJEU's reasoning in Opinion 1/15 at para.141. The restrictions on its processing must, accordingly, be construed restrictively."
The judicial exemption
- The right of access to personal data is subject to various exemptions at Schedules 2, 3 and 4 to the DPA 2018. Para 6 of Part 2 of Schedule 2 provides:
"In this Part of this Schedule, 'the listed GDPR provisions' means the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
…
(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers)…"
- Para 14 provides a judicial exemption in the following terms:
"Judicial appointments, judicial independence and judicial proceedings
…
(2) The listed GDPR provisions do not apply to personal data processed by—
(a) an individual acting in a judicial capacity, or
(b) a court or tribunal acting in its judicial capacity.
(3) As regards personal data not falling within sub-paragraph (1) or (2), the listed GDPR provisions do not apply to the extent that the application of those provisions would be likely to prejudice judicial independence or judicial proceedings."
The right to bring civil proceedings
- Article 79(1) of the UK GDPR provides:
"Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with [the Information Commissioner] pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation."
- A data subject who wishes to enforce his or her rights under the UK GDPR or the DPA 2018 may bring a civil claim under section 167 of the DPA 2018 which provides:
"167 Compliance orders
(1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation.
(2) A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—
(a) to take steps specified in the order, or
(b) to refrain from taking steps specified in the order.
(3) The order may, in relation to each step, specify the time at which, or the period within which, it must be taken.
(4) In subsection (1)—
(a) the reference to an application by a data subject includes an application made in exercise of the right under Article 79(1) of the [UK GDPR] (right to an effective remedy against a controller or processor);
(b) the reference to the data protection legislation does not include Part 4 of this Act or regulations made under that Part.
(5) In relation to a joint controller in respect of the processing of personal data to which Part 3 applies whose responsibilities are determined in an arrangement under section 58, a court may only make an order under this section if the controller is responsible for compliance with the provision of the data protection legislation that is contravened."
- In relation to the grant of relief, the Editors of the White Book note (at para 3G-44):
"Section 167(2) gives the court a remedial discretion. That discretion must be exercised to further the purpose of the legislation, and the starting point is that where a breach has been established, compliance should be ordered…see: Ittihadieh v 5-11 Cheyne Gardens RTM Co Ltd [2017] EWCA Civ 121; [2018] QB 256."
- In cases where the claim challenges the non-disclosure of data because the controller has applied an exemption, it may be necessary for the court to consider the documents that are said to be exempt. Under the now repealed DPA 1998, section 15(2) permitted the court to consider the data and to determine whether an exemption applied in the absence of the claimant and his or her legal representatives:
"(2) For the purpose of determining any question whether an applicant…is entitled to the information which he seeks (including any question whether any relevant data are exempt from that section by virtue of Part IV) a court may require the information constituting any data processed by or on behalf of the data controller and any information as to the logic involved in any decision-taking as mentioned in section 7(1)(d) to be made available for its own inspection but shall not, pending the determination of that question in the applicant's favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery…or otherwise."
- There is no equivalent provision in section 167 of the DPA 2018 or elsewhere. The White Book comments (at para 3G-44) that there is "no explained reason" for the decision not to replicate section 15(2) of the DPA 1998 in the DPA 2018. It is a lacuna.
Burden and standard of proof
- The burden lies on a data controller to prove to the civil standard that one of the exemptions provided for under the DPA 2018 applies (Roberts v Nottinghamshire Healthcare NHS Trust [2008] EWHC 1934 (QB), [2009] PTSR 415, para 12). Where an exemption is invoked on the grounds that disclosure of personal data would "be likely to prejudice" a public interest protected by an exemption, the burden of proof is satisfied if the data controller relying on the exemption does so "with significant and weighty grounds and evidence." The degree of risk must be such that there "may very well" be prejudice to those interests, even if the risk falls short of being more probable than not (R (Lord) v Secretary of State for the Home Department [2003] EWHC 2073 (Admin), paras 99-100, per Munby J; applied in Zaw Lin & Wai Phyo v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB), paras 84-85, per Green J as he then was).
The transcription of court proceedings
- The transcription of court proceedings is subject to procedural rules. CPR 39.9 provides (so far as material):
" (1) At any hearing, whether in the High Court or the County Court, the proceedings will be tape recorded or digitally recorded unless the judge directs otherwise.
(2) No party or member of the public may use unofficial recording equipment in any court or judge's room without the permission of the court. (To do so without permission constitutes a contempt of court under section 9 of the Contempt of Court Act 1981.)
(3) Any party or person may require a transcript or transcripts of the recording of any hearing to be supplied to them, upon payment of the charges authorised by any scheme in force for the making of the recording or the transcript.
…
(4) Where the person requiring the transcript or transcripts is not a party to the proceedings and the hearing or any part of it was held in private under rule 39(2), paragraph (3) of this rule does not apply unless the court so orders."
Issue 1: Scope of the judicial exemption
The parties' submissions
- Mr Alan Bates with Mr Will Perry submitted on behalf of the second defendant that the phrase "judicial capacity" and the other elements of the judicial exemption should be read broadly. In support of this submission, he relied on the contextual framework and drafting history of para 14 which was enacted by Parliament during the United Kingdom's membership of the European Union and which reflects the restrictions on access to personal data permitted under the European Union General Data Protection Regulation ("EU GDPR"). I shall return to the EU law background later in this judgment.
- Mr Bates referred to EU case law to advance the contention that the judicial exemption covers the ability of judges to exercise their office free from any form of direct or indirect pressure (X v Autoriteit Persoonsgegevens [2022] 3 C.M.L.R. 26, 1069, paras 73, 82, 91-93 and 123 of the Advocate General's Opinion; paras 32 and 34 of the judgment). He submitted that the freedom of judges to exercise the duties of their office covers all aspects of judicial functions and is not limited to the production of judgments or other judicial decisions.
- Mr Bates submitted that the underlying purpose of the judicial exemption is the preservation of judicial independence. The resulting breadth of the exemption is consistent with the public policy justification for the principle of judicial immunity from civil liability which exists to protect judicial independence at common law. Under that principle, judges may not be sued for their judicial acts because immunity from suit upholds the independence of the judiciary and prevents judges from being harassed by vexatious litigants. Similar public policy objectives should apply to proceedings brought against judges under data protection legislation.
- Mr Bates submitted that the breadth of the judicial exemption is consistent with the scheme of the Freedom of Information Act 2000 ("FOIA") in which courts and tribunals are entirely excluded from the general obligation under section 1 of FOIA to disclose information: they are not listed as public authorities at Schedule 1 or designated as such by a section 5 order (see section 3(1) of FOIA).
- Mr Bates stated in open session that the personal data held by the second defendant related to two broad categories: the case management of costs proceedings and the JCIO proceedings. The claimant was a party to both those sets of proceedings. The costs proceedings were clearly covered by the judicial exemption because the second defendant held the claimant's personal data entirely for the purpose of exercising a judicial function. The JCIO proceedings related to a complaint about how the second defendant had dealt with the costs proceedings. The JCIO proceedings therefore amounted to a complaint about matters relating to the second defendant's judicial function and related to data processed in a judicial capacity.
- Mr Bates submitted that the second defendant was entitled to review the transcripts of the proceedings prior to the claimant receiving them. She alone was entitled to do so, in her capacity as the judge. The nature of any changes she made to the drafts sent to her by the first defendant (and whether the claimant agreed with the extent of the changes) was irrelevant to the issues in the claim. The breadth of the judicial exemption covered the second defendant's dealings with the first defendant relating to the production of transcripts of proceedings. The exemption was broad enough to cover all the second defendant's dealings with the claimant.
- Mr Stacey adopted Mr Bates' submissions on the grounds that the claimant could not be in a better position in relation to obtaining data from the first defendant than from the second defendant. The judicial exemption cannot be overcome by a SAR against a non-judicial party who has received personal data which would be covered by the judicial exemption if it were in the hands of the person carrying out a judicial function.
- Mr Stacey submitted that the involvement of a judge in approving a transcript is judicial processing and a judge is acting in a judicial capacity when doing so. The judge is typically making decisions as to the accuracy of the transcript. The approval process may involve the judge in such matters as checking that the transcript is appropriately anonymised; ensuring that other reporting restrictions are dealt with; and checking that the correct case number and case details have been placed on the transcript. The finalisation and approval of transcripts is so intimately connected with judicial work that it falls within the exemption. In the present case, the defendants were concerned with the creation of transcripts and then with the determination of their adequacy by the second defendant. Those tasks – of which the claimant was well aware – were carried out by the second defendant in a judicial and not administrative capacity.
- On these grounds, Mr Stacey submitted that data contained in draft transcripts are subject to the judicial exemption as are data contained in the court's response to the EX107 request and data contained in the court's response to requests for guidance or determination of issues arising during the course of the production of a transcript by the transcriber. In essence, the transcription processes on which the first defendant had embarked fell within the judicial exemption.
- Mr Boyle emphasised that the second defendant had chosen not to file and serve evidence. His principal submission both in writing and orally was that, in the absence of any evidence from the second defendant, neither she nor, by extension, the first defendant could satisfy the burden that lay upon them to prove the applicability of the judicial exemption. Mr Bates' skeleton argument had relied on factual assertions but these could not form the basis of factual findings as counsel could not give evidence.
- Mr Boyle submitted that there was no evidence upon which the second defendant could make any factual assertion whatsoever. The court's consideration of the SAR required evidence of the data, evidence of the judicial function in question, evidence of the circumstances in which the data came to be held and evidence of the purpose of holding it. There was no such evidence because the second defendant had chosen not to provide it for reasons which were (in Mr Boyle's words) "patently tactical."
- Mr Boyle submitted that, given the burden of proof, there could be no closed session or debate about the documentation as there was no evidential footing from the second defendant upon which to found the defendants' case. The claimant's primary case was that the court, in the absence of any evidence that the judicial exemption applied, should simply make a compliance order. Where there was no objective evidence and no statement of truth proffered by the second defendant in relation to any of the documents before the court in the open or closed bundles, the second defendant's case was not legitimately put before the court.
- Mr Boyle submitted that the judicial exemption should be interpreted narrowly. The obvious meaning of "acting in a judicial capacity" is "judging" which means the determination of the matters in issue between the parties in the context of litigation rather than simply carrying out tasks during the course of being a judge. If Mr Bates' broad definitions were correct, then any data which happened to be put on a court file (i.e. processed) would inevitably be part of the judicial function, no matter which individual within HMCTS took that action. The terms of the judicial exemption are not so broad as to amount to a total exemption for judges from providing personal data to those who request it. The defendants had acted as if the exemption was total.
- Mr Boyle submitted that the judicial functions of a judge come to an end when he or she delivers judgment. The transcription of proceedings after the costs judgment of April 2021 had been delivered was an inherently administrative process in that it had involved a verbatim recording of what was said in court with no room for substantive judicial input or judgment.
- Mr Boyle said that the starting point for the claimant's SAR to the second defendant was that he had requested transcripts in relation to three hearings and had not received two of them. The claimant criticised the second defendant for failing fully to anonymise the transcript that he had been given but Mr Boyle said that the claimant's concern was not about the content of the transcripts but about the delay in providing him with the full set as he had requested. He submitted that matters relating to delay did not engage any judicial as opposed to administrative actions.
- Mr Boyle emphasised the nature of the data sought from the second defendant: "special category" data (in particular health); matters relating to anonymity and the second of personal data; administrative matters for HMCTS; and the claimant's professional and business interests (including research). All these categories of data were upon analysis administrative data.
- Mr Boyle placed a great deal of reliance on the internal guidance to the judiciary entitled "Data Protection: The Responsibilities of the Judiciary" (Version 1/2019 (issued 7 May 2019) ("the Judicial Guidance"). He submitted that the second defendant's "stance" of non-disclosure was contrary to the Judicial Guidance and would render it entirely otiose. The Guidance makes plain that judges are not exempt from dealing with SARs and sets out a detailed framework requiring judges to comply with SARs. The purpose of the Judicial Guidance would be entirely defeated if a judge were entitled to refuse SARS without applying the details of the Guidance. The second defendant had failed to have regard to the system set out in the Guidance.
- Mr Boyle submitted that there is no evidence to show that the provision of the claimant's personal data would compromise judicial independence. He contended that if the data were innocuous, they could not compromise judicial independence; and if they would reveal wrongdoing, judicial independence had already been compromised and the disclosure of the data would be beneficial.
Discussion
- The independence of the judiciary, and the corresponding immunity of judges from civil liability, is a hallmark of a democratic society and has long been recognised by the common law. In Anderson v Gorrie [1895] 1 QB 668, pp.670-671, Lord Esher M.R. explained the principles underpinning judicial immunity:
"The ground alleged from the earliest times as that on which this rule rests is that if such an action would lie the judges would lose their independence, and that the absolute freedom and independence of the judges is necessary for the administration of justice.
… Crompton J. in Fray v Blackburn said: 'It is a principle of our law that no action will lie against a judge of one of the superior Courts for a judicial act, though it be alleged to have been done maliciously and corruptly…The public are deeply interested in this rule, which indeed exists for their benefit, and was established in order to secure the independence of the judges, and prevent their being harassed by vexatious actions.'"
- In the same case, Kay LJ held at p.672:
"It cannot be denied that all the acts complained of were done by the defendant in his capacity of judge, and whether he acted rightly or wrongly cannot be questioned in this action."
- More recently, in Hinds v Liverpool County Court [2008] EWHC 665 (QB), para 13, Akenhead J considered that judicial immunity can be justified on a number of grounds:
"(i) judges in this country are chosen on the basis, amongst others, of their integrity;
(ii) judges should be permitted to act, in their capacity as judges, without fear of being sued for their judicial acts; an apprehension or fear that he or she might be sued could itself give rise to assertions of bias; the independence of the judiciary is vital in the administration of justice;
(iii) there is an appeal process which allows wrong, unfair or biased decisions to be overturned; that process is tried and tested. Whilst no court process can guarantee perfection in every case, serious injustice is almost always put right on appeal. In appropriate cases, new evidence can be put before the appellate court and indeed first instance decisions can be reviewed and set aside on the basis of new evidence;
(iv) statistically, there are exceptionally few (if any) reported cases of judges behaving with malice or in a corrupt manner. Such cases as there are of judges behaving unfairly are those where invariably the appellate courts have found this to have occurred and the unfairness is addressed on appeal.
(v) there are disciplinary procedures for judges who misbehave in one way or another, albeit that few judges have had charges established against them."
- I would adopt Akenhead J's observations. There is an intrinsic and enduring connection between the independence of the judiciary and immunity from suit at common law. Judicial independence means that the parties to litigation submit to the authority of the court, not the other way round. The court does not submit to the wishes or stratagems of the parties. The protection of judges from suit has the objective of ensuring that judges are not the subject of partisan pressures and that they are free to take decisions that may have significant adverse consequences for a party without the threat of civil litigation. In my judgment, the same reasoning and principles apply to ensuring the independence of the judiciary under para 14, whether in relation to the exemption for judges acting in a judicial capacity (para 14(2)(a)) or to judicial independence in direct terms (para 14(3)).
- It is wrong to pick a low hanging fruit by suggesting that, in the interests of rooting out wrongdoing, the judicial exemption should be narrowly construed and restricted to matters relating to the production of judgments or the making of decisions. First, such a submission ignores the parameters of the scheme of the UK GDPR and the DPA 2018. That scheme has a specific and limited purpose, which is to enable a person to check whether a data controller's processing of his or her "personal data" unlawfully infringes privacy rights and, if so, to take such steps as the DPA 2018 provides (Durant v Financial Services Authority [2003] EWCA Civ 1746, [2004] FSR 28, para 27, per Auld LJ, in the context of earlier legislation but applicable to the present statutory scheme). It is impermissible to deploy the machinery of the Act as a proxy for the wider purpose of obtaining documents with a view to litigation or further investigation (Durant, para 31). The scheme for access to personal data is not a vehicle for a party to proceedings to root out information about a judge.
- Secondly, the DPA 2018 is not a general mechanism for holding judges to account for what they have done. The rule of law means that the way for parties to challenge judicial acts is the exercise of rights of appeal. The claimant has indeed consistently exercised his appeal rights in relation to the second defendant's decisions over the life of the costs proceedings. If data protection rights were deployed to hold judges to account, a party to litigation could use the machinery of the UK GDPR and the DPA 2018 to avoid the limits of an appellate jurisdiction (such as a requirement for permission to appeal) or to seek to undermine a judge's authority when appeal rights did not bring about the result that a party wished. Such a scenario would be contrary to the public interest.
- The claimant specifically complains about delay in the provision of transcripts. Parliament has in the Constitutional Reform Act 2005 enacted a scheme for complaints about the conduct of judges. Under that scheme, complaints of judicial misconduct are handled by JCIO and JACO. The claimant has exercised the right to complain to JCIO and thereafter to JACO. It is in the public interest that the UK GDPR and the DPA 2018 should not be used as a proxy for the statutory complaints procedures.
- Thirdly, as Lord Esher M.R. held in Anderson v Gorrie, the public interest in the independence of the judiciary runs deep. This fundamental public interest is protected by the various elements of para 14(2) and (3). As Mr Bates submitted, the question of whether the claimant agrees with, or objects to, the way in which his data were processed is nothing to the point: if the data were processed by the second defendant acting in a judicial capacity, the public interest demands that they be exempt.
- The claimant maintains that the defendants' refusal to provide any personal data (save on a voluntary basis) amounts to a status-based blanket exemption for judges and those who process data at the request of judges. It is not in dispute that judges cannot claim a total exemption from providing personal data in response to SARs. The judicial exemption is limited to the matters set out in para 14. The claimant mischaracterises the defendants' submissions and aims his fire at the wrong target.
- As I have set out above, the claimant in large part rested his legal arguments on the Judicial Guidance as the prevalent source of the second defendant's duties. He quotes the Judicial Guidance at length in his witness statement, setting out in detail the procedure in the Guidance as to how judges are to deal with SARs.
- The Judicial Guidance gives examples of judicial and non-judicial processing by judges (para 1.1):
"Examples of judicial processing are: case management decisions, listing hearings, trials, appeals, judgment writing, the making of court orders. As a general approach, if the processing takes place whilst acting further to rules of court, whilst exercising a court or tribunals' inherent jurisdiction to govern its own process or its statutory jurisdiction, or whilst exercising a judicial function required by statute, it will be judicial processing. As a rule of thumb if the activity would be protected by judicial immunity from suit it will be judicial processing.
Examples of non-judicial processing are: processing done whilst carrying out judicial leadership responsibilities; administrative functions carried out by members of the judiciary e.g., judicial deployment, communication with HMCTS staff, judges' clerks, and other officials; processing carried out by judicial associations, judicial committees."
- These various examples cannot be exhaustive. Moreover, Mr Bates urged me to exercise caution before accepting that each of them properly falls within the category in which it is placed. I agree that not all of the examples of non-judicial processing would stand up to analytical scrutiny. Communications between a judge and HMCTS staff or a judge's clerk are obvious candidates for judicial processing in so far as they are made in relation to a judge's case load.
- More importantly, the claimant seeks to use the content of guidance as an external aid to the interpretation of primary legislation. That approach is ill-founded. Mr Boyle did not bring to my attention any authority to suggest that it would be legitimate for the court to depart in this instance from the conventional principle that the meaning of primary legislation cannot be interpreted by reference to extra-statutory guidance. The submission that the Judicial Guidance would somehow be otiose unless the court were to use it as an interpretative tool is not founded on any proper legal analysis.
- As Mr Bates submitted, the judicial exemption was enacted by Parliament during the UK's membership of the European Union, pursuant to article 23(1) of the EU GDPR (as originally introduced). This provision permitted EU Member States to restrict various data subject rights "when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard … (f) the protection of judicial independence and judicial proceedings."
- By enacting the judicial exemption, Parliament restricted data subjects' GDPR rights in order to safeguard judicial independence. Parliament was entitled to restrict those rights under article 23(1)(f). The principal restriction is that judges are exempted from data protection obligations by virtue of para 14(2) which applies generally to all personal data processed by an individual "acting in a judicial capacity." In my judgment, Parliament has used this broad language in order to ensure that the exemption is not limited to data processed when a judge is producing (orally or in writing) a judgment or decision. Parliament intended that all judicial functions should be covered.
- The phrase "judicial capacity" is not used in article 23(1)(f) of the EU GDPR. It is however used in article 55(3) which provides that national supervisory authorities (such as the Information Commissioner in the UK) "shall not be competent to supervise processing operations of courts acting in their judicial capacity." The purpose of this provision is explained in further detail by Recital 20 of the EU GDPR which states (among other things):
"The competence of the supervisory authorities should not cover the processing of personal data when courts are acting in their judicial capacity, in order to safeguard the independence of the judiciary in the performance of its judicial tasks, including decision-making."
- It is plain that Recital 20 contemplates the independence of the judiciary as extending not only to decision-making but to other "judicial tasks."
- In X v Autoriteit Persoonsgegevens, the essential question for the court was whether article 55(3) applied where a court makes temporarily available to journalists documents from court proceedings containing personal data in order to enable them better to report on the course of those proceedings. The CJEU concluded that article 55(3) applied and that the Dutch supervisory authority did not have competence to ensure compliance with a court's data protection obligations.
- In reaching this conclusion, the CJEU considered Recital 20 and held:
"32. As the Advocate General observed in points 80 and 81 of his Opinion, it is apparent from the very wording of recital 20 of Regulation 2016/679, and in particular from the use of the expression 'including', that the scope of the objective pursued by Article 55(3) of that regulation, consisting in safeguarding the independence of the judiciary in the performance of its judicial tasks, cannot be confined solely to guaranteeing the independence of the judges in the adoption of a given judicial decision.
33. After all, safeguarding the independence of the judiciary presupposes, in general, that judicial functions are exercised wholly autonomously, without the courts being subject to any hierarchical constraint or subordinate relationship and without taking orders or instructions from any source whatsoever, thus being protected from any external intervention or pressure liable to jeopardise the independent judgment of their members and to influence their decisions. Observance of the guarantees of independence and impartiality necessary under EU law requires rules in order to dispel any reasonable doubt in the minds of individuals as to the imperviousness of the body in question to external factors and its neutrality with respect to the interests concerned…
34. Accordingly, the reference in Article 55(3) of Regulation 2016/679 to processing operations carried out by courts 'acting in their judicial capacity' must be understood, in the context of that regulation, as not being limited to the processing of personal data carried out by courts in specific cases, but as referring, more broadly, to all processing operations carried out by courts in the course of their judicial activity, such that those processing operations whose supervision by the supervisory authority would be likely, whether directly or indirectly, to have an influence on the independence of their members or to weigh on their decisions are excluded from that authority's competence.
35. In that regard, while the nature and purpose of the processing carried out by a court relate principally to the examination of the lawfulness of that processing, they may constitute indicia that that processing falls within the exercise, by that court, of its 'judicial capacity'."
- I agree with Mr Bates that the policy objectives which underpin this broad interpretation of article 55(3) are equally applicable to the judicial exemption. It is appropriate therefore to interpret the judicial exemption in the same broad way.
- Mr Boyle submitted that I should not follow the broad approach in X v Autoriteit Persoonsgegevens on the basis that it is a post-Brexit case. However, the CJEU's analysis of the importance, nature and scope of judicial independence is compelling. Irrespective of whether it is binding post-Brexit, I have been provided with no sound reason to take a different view.
- It follows that I reject Mr Boyle's submission that the actions taken in relation to the transcript requests must fall outside the judicial exemption because the second defendant had by then given judgment in the case. The tasks undertaken by the second defendant in relation to the production of transcripts of proceedings, and the data processed for the purposes of those tasks, are judicial tasks performed as part of a judge's judicial functions. That the production of transcripts is covered by procedural rules that apply in civil litigation (CPR 39.9, above) strengthens this conclusion. The second defendant's processing and the associated processing undertaken by the first defendant are covered by the judicial exemption.
- Nor is the claimant entitled to the data by rebadging it as data processed in the course of a JCIO complaint. The personal data held by the second defendant did not lose its immunity from disclosure because the claimant chose to complain. Personal data processed by the second defendant in the context of the JCIO complaint that were earlier processed during the course of her judicial tasks remain exempt on the grounds that they were processed in a judicial capacity.
- The claimant's SAR made to the second defendant refers specifically to "special category" personal data. The SAR also refers to information relating to anonymity and data touching on the claimant's professional, business or research interests. I have been provided with no sound reason why these data are administrative in nature in the context of processing by a judge with conduct of litigation. In my judgment, the better view is that the personal data processed by a judge and a transcriber for the purpose of litigation and in the context of court proceedings are captured by either para 14(2) or alternatively para 14(3).
- Questions of proof – such as whether a judge is bound to file a witness statement in order to rely on the exemption – are different and do not cast light on the meaning of statutory language. They are more properly considered in my assessment of the evidence as a whole (below).
- For these reasons, both defendants were entitled to withhold the claimant's personal data on the basis of para 14(2). If I am wrong about that, they were entitled to withhold the data on the basis of para 14(3).
Issue 2: Procedure for consideration of whether the judicial exemption applies
- At the pre-trial review, the parties raised competing Methods for the consideration of the exempt data in the closed bundles. I take the wording of these Methods from para 7 of the Order that I made following the pre-trial review:
"A. Method A, being a fully open hearing, open to the public (subject to reporting restrictions as appropriate) with the Claimant raising issues and/or questions to be considered in the closed session; followed by closed sessions with, separately, the First Defendant and Second Defendant; followed by a further open session in advance of which the Claimant will be provided with the gist of the closed sessions and at which the Claimant will be permitted to make further submissions as appropriate; or
B. Method B, being a hearing fully in private, with the Claimant present to consider and respond to the Defendants' submissions on the closed documents as appropriate."
- In support of Method A, Mr Bates submitted that two necessary implications must be drawn from article 79 of the UK GDPR and section 167 of the DPA 2018 (quoted above). First, the court has the power to inspect personal data which are said to be exempt from disclosure. Secondly, the court has the power to seek clarification from the representatives of data controllers who are relying on an exemption. In the absence of these powers, the court would have no ability to consider the personal data that the data controller wishes to withhold, thereby undermining data subjects' ability to obtain an effective remedy and preventing the court from effectively exercising its powers under section 167(1).
- Mr Bates invited me to adopt Method A on the grounds that it was consistent with the analogous context of appeals under FOIA and the Environmental Information Regulations 2004, where the ability of courts and tribunals to use closed procedures was confirmed by Browning v Information Commissioner [2014] EWCA Civ 1050, [2014] 1 WLR 3848. The court in Browning approved the approach adopted by the First-tier Tribunal (General Regulatory Chamber) in British Union for the Abolition of Vivisection v Information Commissioner (EA/2010/0064) (unreported) 11 November 2011 ("BUAV"). Method A reflected the BUAV approach.
- Mr Stacey supported Method A and adopted Mr Bates' submissions. He added that there was no ideal process but that the court was required to consider the most fair and effective process in all the circumstances. Method A was appropriate and fair in circumstances in which the court would not undertake its own fresh analysis of the data but would review the decisions of the defendants to withhold the material (Durant, para 60).
- In support of Method B, Mr Boyle emphasised that the DPA 2018 did not re-enact the provisions of section 15(2) of the DPA 1998. In considering the scope of the new statutory regime, the court should presume that Parliament had excluded the words of section 15(2) for a reason: it was not legitimate simply to assume that the current situation was identical to the pre-2018 position.
- Mr Boyle submitted that the starting point should be that the claimant should hear what the defendants have to say directly, rather than simply be provided with a potentially nebulous gist. If the defendants' position had credibility, the inevitable logic would be that once the claimant had identified a counter-argument, he would then have to be excluded while the relevant defendant sought to meet the counter-argument. Such a procedure could not be appropriate.
- Mr Boyle submitted that the quickest and fairest way forward would be for the court to adopt a procedure akin to a detailed costs assessment when some parties may leave court so as to enable the costs judge to consider relevant material that would otherwise be non-disclosable on grounds of legal professional privilege. By analogy, in the present proceedings, all parties should be present throughout, save that as and when an issue arose regarding what information should be disclosed about a specific piece of data, the court could ask the claimant to leave court on an item-by-item basis.
- Mr Boyle also invited me to consider the approach of Green J in Lin. The case was decided under the DPA 1998 and concerned the application by two defendants facing capital charges in criminal proceedings in Thailand for disclosure to them of personal data held by the police. The data were contained in a confidential report prepared by the police in relation to a murder inquiry in Thailand.
- The application came before the High Court on an urgent and expedited basis during the legal vacation. Green J described the stakes for the claimants as being life or death. He expressed "profound unease at a procedure whereby a disclosure exercise is being conducted with the accused arguing with their eyes covered" in a death penalty case (para 15). He concluded that he had the power to consider the information in issue both under section 15(2) of the DPA 1998 and in the exercise of the court's inherent jurisdiction to seek clarification of the evidence before it (para 44). The approach he adopted in the circumstances of the case is set out at para 45:
"I ultimately came to the conclusion that, given the exigencies of the situation, the best way to proceed was for me to raise any questions and queries that I had about individual pieces of information…in open court articulating my queries and questions in the abstract ie without disclosing the specific information in issue. This way Mr Facenna [counsel for the claimants from whom the information was withheld] could at least (I hoped) respond by reference to my generic description of the information and according to principle. Further, I sought to mitigate further possible prejudice to the accused by seeking to accord to them the benefit of any doubt that there might exist."
- Relying on this authority, Mr Boyle submitted that the court could have the closed bundles in open court and refer the defendants' counsel to passages or lines in the documents that were on the borderline of the judicial exemption. The defendants' counsel would be asked to give a broad explanation and the court would then seek assistance from the claimant in broad terms on the borderline material. Only if the defendants could not deal with the court's concerns in an open session would the court go into closed session.
Discussion
- Mr Boyle's submissions are founded on the proposition that, by failing to re-enact the power of a court to inspect data in the absence of a party, Parliament intended to remove the power. He cited no authority for the proposition that the omission of a power in a new Act that existed under an old Act should impel a court to interpret the new Act as marking a change of Parliamentary intention irrespective of the consequences. The court's function is to ascertain the legislative intention. In carrying out this function, the court may have regard to previous legislative provisions. I was, however, directed to no rule of law to suggest that previous legislation must animate the meaning of new legislation to the cost of any other principle.
- It would defeat the purpose of the legislation if a person challenging the application of an exemption were to be given sight of the material for the purpose of advancing his or her arguments (Lin, para 41). It would bring about a situation in which a party seeking personal data "would have obtained the very thing which the hearing was designed to decide" (Browning, para 29). Parliament cannot have intended to protect judicial independence by enacting the judicial exemption and at the same time to have sanctioned the revelation of the data in a court. Such an absurd result cannot properly be regarded as the legislative intention.
- This absurdity means that the lacuna in the DPA 2018 should not be resolved by permitting the claimant to have sight of the closed bundles. The anomaly is best resolved on the basis that, as Mr Bates submitted, the court has an implied power (i) to inspect the personal data; (ii) to seek any necessary clarification from those asserting the exemption; and (iii) to carry out these functions in the absence of the claimant and his legal representatives. To the extent that the implication is statutory (in that it may be derived from the scheme of the DPA 2018), I would regard it as part and parcel of section 167. If I am wrong about that, I would regard the implication as being that there is no statutory bar to the exercise of the High Court's inherent jurisdiction to review evidence in a party's absence: the inherent jurisdiction fills the statutory lacuna.
- If there is no such implication, the court would have no ability to consider the claimant's personal data. As Mr Stacey pointed out, if the court cannot consider the data in closed session, the claimant's interests would suffer. The court would be compelled not to look at the closed material, with the consequence that the claimant would never know whether his privacy rights had been infringed. As the purpose of the statutory scheme for access to data is for individuals to know whether their data has been lawfully processed, the court's inability to consider the data would turn the scheme on its head and so cannot have been intended by Parliament. The right to an effective judicial remedy – which is express in article 79(1) of the UK GDPR and which must be implied in section 167 of the DPA 2018 – would be undermined.
- In Browning v Information Commissioner, the Court of Appeal considered the approach undertaken by the First-tier Tribunal (General Regulatory Chamber) ("FTT") to FOIA appeals in the BUAV case. Giving the judgment of the court, Maurice Kay LJ held:
"23 The next milestone was the BUAV case which was to form the basis of the decision of the FTT in the present case. The BUAV case, decided on 11 November 2011, contained a thorough explanation by the FTT, chaired by Mr Andrew Bartlett QC, of the approach, taking into account the most recent authorities on the open justice principle such as Al Rawi v Security Service (JUSTICE intervening) [2012] 1 AC 531 and Tariq v Home Office (JUSTICE intervening) [2012] 1 AC 452.
24 As it contains the most comprehensive reasoning behind the approach of the FTT it is necessary to refer to some of its content in detail. The reasoning in the BUAV case is set out in Appendix 2 to the decision. Para 14 includes:
'(g) The [Information Commissioner], though a party to the appeal, does not have the specific objective of trying either to procure or to prevent the release of the particular information. His concern, like the tribunal's, is to see that the Act is properly applied and to take proper account of the relevant private and public rights and interests. He argues for disclosure or non-disclosure according to his view of the application of the Act to the particular circumstances. Because his commitment is to the Act rather than to a pre-selected result, it is not unusual for his arguments to alter during the course of a hearing as evidence unfolds . . .
'(h) In appeals which involve consideration of the requested information in closed session, the role of the commissioner's counsel is of particular importance. Counsel is able to assist the tribunal in testing the evidence and arguments put forward by the public authority.
'(i) However, irrespective of the assistance of the commissioner, the tribunal, as a specialist tribunal, can be expected to be able, at least in some cases, to assess for itself the application of the provisions of FOIA to the closed material . . . The extent to which the tribunal will be in a position to do this will depend on the particular circumstances.
'(j) Until the tribunal has decided whether the information is to be disclosed under section 1 of FOIA, it must proceed on the basis that it may decide against such disclosure. The tribunal must therefore be careful not to do anything which might prejudice that outcome.
'(k) Disclosure to the appellant's counsel on restricted terms would not itself amount to disclosure to the public under section 1 of FOIA. But it would be attended by risks of prejudicing the outcome. There could be a slip of the tongue. Information could be given away by facial expression or body language, or by the way questions were asked or answered or submissions made, or by inference from advice given. A change in the approach of counsel after seeing the material could make apparent the content of the information, or some of it. Such risks are relevant to the exercise of discretion under the tribunal's procedural powers.
'(l) Further risks may arise, beyond the individual appeal, because there are many individuals and organisations who are regular users of the right to freedom of information in pursuance of a particular interest. BUAV is one example out of many. If it became a regular practice to disclose requested information to counsel for the appellant, such counsel would over time build up a bank of knowledge concerning the topic of interest, derived from information which the public has no right to see. This could affect the person's or organisation's strategy in the use of the Act. I have observed above that, unlike a special advocate, an ordinary legal representative, authorised to see the closed material on confidential terms, would continue to communicate with the appellant after seeing it, and would take into account the confidential information when advising the appellant and taking decisions on the conduct of the case. By making the information available to counsel, in cases where there is no right to it, the appellant would over time derive illegitimate benefits.
'(m) Difficulties would also arise in relation to how appellants should be treated, who are not legally represented. An appellant may be wholly trustworthy and may o›er an undertaking not to disclose the information unless the tribunal so orders. If the information can be made available to counsel, why not to a trustworthy appellant? Yet to give it to the appellant before the tribunal has decided whether it is disclosable, would be to override the Act and undermine the tribunal's function. Giving it to a lawyer acting as the appellant's representative is not far different from giving it to the appellant in person.'
These observations led to the tribunal expressing its approach as follows, at para 15:
'These considerations lead me to the conclusion that the type of order now sought should not be made, save in exceptional cases where, as a minimum, the tribunal take the view that it cannot carry out its functions effectively without the assistance of the appellant's legal representative in relation to the closed material. Whether there will be any such cases remains to be seen. The approach must depend on the particular circumstances. In some cases the tribunal will be able to deal with the matter without external assistance. In many cases all necessary assistance will be provided by counsel for the commissioner. In a few cases it may be necessary to appoint a special advocate, despite the extra expense likely to be occasioned.'
This is the passage that was adopted by the [Upper Tribunal] in the present case…Since the present case was decided by the FTT, a further Practice Note has been issued in May 2012: see Practice Note Closed Material in Information Rights Cases. It provides for additional procedural protection by a requirement of an application in writing for the withholding of material. Where a party and, by inference, his legal representative are excluded from part of a hearing it states, at para 12, that ''the judge will explain to the excluded party, usually the citizen, what is likely to happen during the closed part of the hearing. The judge may ask if there are any particular questions or points which (s)he would like put to the other parties while (s)he is absent'. It further provides for the tribunal to discuss with the remaining parties, prior to the end of the closed hearing, what summary of the closed hearing can be given to the excluded party and whether, in the course of the closed session, any new material has emerged which it is not necessary to withhold and which therefore should be disclosed. "
- In upholding the adoption of the BUAV approach in the case before it, the court held:
"33 The crucial task is to devise an approach, in the context of a specific case, which best reconciles the divergent interests of the various parties. In my judgment, the approach adopted in this case and originating in the BUAV case does precisely that, having regard to the unique features of appeals under the 2000 Act where issues of third party confidentiality and damage to third party interests loom large. The features to which reference was made in the BUAV case - the expertise of the tribunal, the role of the [Information Commissioner] as guardian of the 2000 Act etc - make it permissible to exclude both an appellant and his legal representative except in circumstances where the FTT
'cannot carry out its investigatory function of considering and testing the closed material and give appropriate reasons for its decision on a sufficiently informed basis and so fairly and effectively in the given case having regard to the competing rights and interests involved'...
In associating myself with this formulation I am accepting that there are features surrounding a case such as this which merit the description of the procedure as being at least in part investigatory as opposed to adversarial.
34 …What is important is that each case should be considered in its particular factual context.
35 What is also important is that when the FTT excludes both a party and his legal representative it does its utmost to minimise the disadvantage to them by being as open as the circumstances permit in informing them of why the closed session is to take place and, when it has finished, by disclosing as much as possible of what transpired in order to enable submissions to be made in relation to it. The same commitment to maximum possible candour should also be adopted when writing the reasoned decision….
36 It follows from what I have said that, in my judgment, the 2009 [Procedure] Rules, properly construed, do permit the course that was taken by the FTT and upheld by the [Upper Tribunal] in the present case. There are sound reasons why their natural meaning should be maintained so that justice can be achieved to the fullest extent possible, having regard to the conflicting interests which arise in a unique statutory context."
- Mr Boyce emphasised that, in contradistinction to BUAV and Browning, I do not have assistance from the Information Commissioner (whose role under the DPA 2018 is different from his role under FOIA). The High Court is however better placed than the Commissioner to judge matters relating to judicial independence and the administration of justice. It does not need specialist assistance and has sufficiently flexible procedures at its disposal so as to ensure that prejudice to an excluded party is kept to a necessary minimum.
- Neither Browning nor BUAV was cited in the judgment in Lin. Irrespective of the exigencies that faced the court in Lin, it would have been neither workable nor desirable in the present case for the court to have considered the closed material in the claimant's presence. Communicating with Mr Bates and Mr Stacey in purely general terms, hoping that they would latch onto my questions and that I would latch onto their answers, would have resulted in less than proper scrutiny of the data.
- A hearing in the claimant's presence but otherwise in private would have removed the risk of circulation of the data to the wider public. It would however have given rise to the risk of accidental disclosure to the claimant through unintentional revelations by counsel or the court. It would have brought the risk of jigsaw identification of the data: whereas any individual part of the discussion of the data may on its own have been unrevealing, the cumulative effect of coded discussions could have been revelatory. The model adopted in costs assessments for preserving legal professional privilege is not in my judgment well-suited to the consideration of a body of data which I needed to consider overall and in the round.
- For these reasons: (i) a court has the power to hold closed sessions in proceedings brought under section 167 of the DPA 2018; and (ii) Method A – which reflected the approach in BUAV - was the preferable method for closed sessions in the present case.
Safeguards
- In the interests of fairness and open justice, the following procedural safeguards were applied:
i. The length of the closed sessions was kept to a necessary minimum.
ii. In order that there should be no improper passing of the claimant's data from one defendant to another, I held one closed session attended by the second defendant's lawyers from which the claimant and the first defendant were excluded. I then held a second closed session attended by the first defendant's lawyers from which the second defendant and the claimant were excluded. I held a third closed session attended by both defendants' lawyers in order to check that the proposed gist of the closed sessions for reading out in open court was accurate. The claimant's data were not discussed during this session which was necessary only because checking the proposed gist in separate closed sessions would have involved too high a degree of mental gymnastics.
iii. The court had the assistance of counsel who are members of the independent Bar with regulatory, professional and ethical duties to the court that arise when one party to the proceedings does not appear before the judge. Both Mr Bates and Mr Stacey acknowledged their heightened duties. Counsel were well aware of their duty to draw to the court's attention any matter adverse to their respective client's cases.
iv. I required counsel in the closed sessions to be attended by a solicitor in order that a further lawyer with regulatory and professional obligations could observe the interactions between counsel and the court.
v. The closed sessions were limited to discussion with counsel as an aid to the court's inspection of the data: no closed witnesses were called. Mr Stacey submitted a brief closed skeleton argument which was more in the nature of a guide to the documents and did not raise any further points of law. Mr Bates and Mr Perry's skeleton argument included a short "Confidential Closed Annex."
vi. Mr Boyle provided helpful written lists of questions for the court to consider in reviewing the respective defendants' closed bundles. These were the subject of discussion with counsel in the closed sessions.
vii. I probed counsel for each defendant on any points that were on my mind with a view to satisfying the court's duty under section 6 of the Human Rights Act 1998 to act compatibly with the claimant's human rights (including his fair trial rights under article 6 of the European Convention on Human Rights and his article 8 privacy rights which the improper spread of information about him might engage). This was a more inquisitorial role than would have been appropriate in some other civil proceedings.
viii. With counsel's assistance, I composed a gist of the closed sessions which I read out in open court.
ix. Where the court considered that clarification of the scope of any of Mr Boyle's listed questions was needed, he was asked in open session to give that clarification; further information, beyond the gist, was given to him in response. Mr Stacey and his solicitor at one stage left court in case any points of clarification by the second defendant would lead to the passing of personal data to the first defendant.
- In addition to the gist of the closed sessions, both defendants were willing to provide the claimant with some insight into the substance of the withheld data on a purely voluntary basis (and without waiving their reliance on the judicial exemption or other aspects of the UK GDPR and DPA 2018). The second defendant's description of the data is set out in Mr Bates' skeleton argument:
"13. X's personal data which falls within scope of the SAR was all processed in the context of the costs proceedings and/or the JCIO complaint. Although D2 [i.e. the second defendant] is not required to give a detailed overview of the content of the personal data held (given her reliance on the Judicial Exemption), she is prepared to reveal voluntarily that (a) the vast majority of the personal data relates to case management and other procedural matters in the costs proceedings, and largely consists of emails between the parties to those proceedings, D2's clerk, other personnel within HMCTS, and the Transcription Agency; and (b) a small portion of the personal data was processed in the context of the JCIO complaint – e.g. an email from the JCIO informing D2 of the complaint and inviting comments.
14. The amount of personal data within scope of the SAR runs to around 1,000 pages when printed on A4 paper, but many of which are duplicates included in email 'strings'. The vast majority of the personal data falling within scope of the SAR – around ¾ of it – is found in emails which X himself either sent or received…Although D2 is able to rely on the Judicial Exemption in relation to such personal data, she has decided to indicate where there is duplication between personal data within scope of the SAR and items on the Claimant's disclosure list. This has been done voluntarily without prejudice to D2's position that such personal data is within scope of the Judicial Exemption."
- Mr Stacey's supplementary skeleton argument confirmed that:
"7. In order to assist matters, D1 [the first defendant] intends to provide to C [the claimant] in Word summary format the information in the closed bundle not covered by the judicial exemption in advance of trial.
8. As to the provision of the material, it is made without prejudice to D1's assertion that it does not contain C's personal data.
9. It is disclosed in order to reassure C that the material which D1 has which is not covered by the judicial exemption does not contain his personal data and to the extent (which is denied) that it does such is anodyne and uncontroversial.
10. It will also have the effect – it is hoped – of limiting the closed session involving D1 (it will not end it as there is still material in the closed bundle).
11. It will also enable C to ensure (primary purpose of DPA 2018 and GDPR) that the personal data (if any) which is kept about him is accurate and fair."
- The first defendant provided the claimant and the court with schedules of some of the data in relation to each of three transcription requests. Mr Boyle cross-examined Ms Goodson about them.
- The claimant had in any event been provided with documents by both defendants in the normal course of events (i.e. prior to his SARs). This is not a case where the claimant knew nothing about the data that had been processed.
Issue 3: Application of the judicial exemption to the facts of the case:
- I turn to my consideration of the evidence relating to the processing of the claimant's personal data by the defendants.
The parties' evidence
- In his witness statement, the claimant deals in detail with the content of the Judicial Guidance and provides the court with his views about it. He describes some of the process for the transcription of court proceedings and sets out his views about them. His opinion is that a judicial office holder has no role in approving transcripts of hearings outside any judgment; nor would it be appropriate to interfere with the record. Any anonymisation is a matter for the transcriber.
- The claimant sets out some elements of the delay in supplying him with the requested transcripts:
"34. On 16.12.2020 the 2nd Defendant stated in an email (12.45):
'I have received the Hearing transcript for [Day 1].
I gather the recording from [Day 2] was not great and that the transcribers have asked for another copy so that the transcript from that date is not yet to hand.
I also gather that the request in respect of [Day 3] was never received, which is very odd as all three were walked over together at the same time. If [the claimant] could send another copy of that EX107 I will ensure it is completed and walked over again.'
35. On 19.01.2021 the 2nd Defendant sent an email (16.01)
'Please note the EX107 for the recording of [Day 3] is still outstanding (please do not get into an arid debate about whether it has been submitted before; I need a fresh copy…).
…no EX107, no transcript.
I hope this assists.'
36. In the letter of 18.06.2021 the 1st Defendant stated:
'5. We are unable to provide you with a copy or the Contract which The Transcription Agency LLP holds with HMCTS. This is specifically not allowed under the terms of the Contract, neither is it relevant to your SAR. It is possible that a redacted version of the Contract is in the Public Domain and we will endeavour to provide you its location.'"
- The claimant's witness statement records that the first defendant told him in the same letter:
"Telephone Hearing [on Day 2] -we received the transcript request on the first occasion, by post, 04.12.20. However, the audio quality made it unable to be transcribed (this does happen from time to time). A request was made for replacement audio. There followed a considerable delay and our records show that we chased the court in December 2020, January, February, March and April 2021. We received the replacement audio 16.04.21."
- In a further passage of his witness statement, the claimant expresses concern that his anonymity has not been respected:
"Furthermore, it is of concern to me as to why and how the one transcript produced by the 1st Defendant (in respect of the hearing on [Day 1]) came to being without preserving my anonymity in circumstances where the EX107 notes at item B7 there is anonymity."
- The claimant goes on to criticise the defendants on the grounds of lack of transparency in dealing with his personal data, the failure to provide him with data and the inadequacy of their searches for his data.
- On behalf of the first defendant, Ms Goodson adopted her witness statement in which she says that the first defendant is part of VIQ Solutions, a global provider of transcription services headquartered in Mississauga, Canada. She has been employed by the first defendant since 7 April 2003 and was acting in her current role as Operations Manager at the time of material events. She also has responsibilities in relation to information security and was involved in the production of the first defendant's privacy policy. As Operations Manager, she is responsible for the management of the first defendant's contract with the Ministry of Justice. The original contract was secured in 2007 following a competitive tender process. Transcription services are provided to the Ministry of Justice under the Framework Agreement which is a highly sensitive and confidential agreement.
- Ms Goodson explained the transcription process in general terms as follows. The first defendant receives a request for a transcription of proceedings on court form EX107. That form is populated with information provided by the court user in Parts A-D, while Part E is completed by the judge or a court officer. Part A is populated with the requestor's details. Part B contains the case details. At B7 the requestor is asked whether a reporting restriction or anonymisation was imposed and at B8 whether the case was heard in private. Part C is populated with details of the transcript being requested. Part D contains a declaration under which the requestor accepts that the transcripts are provided subject to terms agreed between the first defendant and the Ministry of Justice, among other things. Part E provides for the judge or a court officer to confirm that permission has been granted for the requestor to order the transcript and other matters. These include confirmation of whether the transcript should be returned to the court for approval by a judge prior to release. The judge or court officer will also confirm whether there are any reporting restrictions or anonymisation, and if the proceedings were held in private.
- The completed form is sent by the court office to the first defendant along with the recording of the court hearing for transcription. Following the payment of estimated costs, the request is allocated to a transcriber and fulfilled. Receipt of payment constitutes an agreement to the first defendant's terms and conditions. All judgments must be approved by the presiding judge prior to release of the transcript. A court may request that a transcript of proceedings is returned to the court for approval prior to distribution to requestors. The requirement for all judgments to be approved by the judge, and the term that a court may request that a transcript of proceedings is returned to the court for approval prior to distribution to the requestor, is incorporated into the first defendant's terms and conditions.
- Ms Goodson confirmed that the claimant had requested transcripts of three hearings. By email of 2 December 2020, the first defendant had referred the claimant to its terms and conditions by way of a hyperlink. The email also specifically informed the claimant that the proceedings (and any judgment delivered) must be approved by the judge before release of the transcript.
- Ms Goodson explained that she had responded to the claimant's SAR not because she accepted that the first defendant is a data controller but because she regarded a response as a more courteous way of dealing with the claimant than telling him to address any requests to the Ministry of Justice. Before preparing the response, she sought advice from the Information Commissioner's Office on the meaning of the term "personal data". She spoke to the second defendant by telephone for guidance in relation to the content of the claimant's request and disclosure of communications in which she was identifiable. She wanted to check if the second defendant considered that the claimant was entitled to receive all such information or if there were any grounds on which disclosure of information should be withheld. The second defendant informed her that any entitlement of the claimant to information regarding his personal data did not apply to personal data processed by a person acting in a judicial capacity. The second defendant also informed her that the claimant was not automatically entitled to receipt of personal data that would disclose information relating to another individual who could be identified from the data where that individual had not given consent. She was not minded to give her consent.
- Following her conversation with the second defendant, Ms Goodson consulted the relevant provisions of the UK GDPR and the Information Commissioner's Guidance. She determined that the judicial exemption applied to the processing of data by the judge and court officers in relation to the transcriptions, and that it was not reasonable to disclose information where the second defendant was identifiable, particularly as she had not given her consent. She had written the letter of 28 May 2021, confirming the details of the personal data held, insofar as it fell within the scope of the subject access request, and explained that information contained within certain communications was exempt from disclosure.
- I did not permit Mr Boyle to cross-examine Ms Goodson on matters that would have compelled her to disclose information covered by the judicial exemption. In questions from Mr Boyle, she repeated matters that were already in her witness statement which I do not set out again. She was asked for her view on whether the first defendant was a data controller or data processor which I did not find helpful as it concerned a matter of law. She confirmed that she had learned about the judicial exemption and the third party exemption when the UK GDPR was published but that she did not keep them in her mind before she dealt with the claimant's SAR. She did not usually speak to judges about transcripts and she could not recall any particular reason for speaking to the second defendant in this case. She did not know whether the closed bundle was complete but lawyers had been involved in the search for documents after the commencement of proceedings. She was asked about any internal investigations undertaken by the first defendant in relation to the loss of a tape of proceedings but said that she could only comment if there was some evidence indicating that the tape had arrived at the first defendant's premises. She had not been involved in responding to the claimant's complaint about delay in receiving transcripts and could not comment on any internal discissions about delay.
- As I have said, the second defendant did not provide a witness statement and did not attend the hearing.
Discussion
- As I have previously indicated, the claimant submitted that the second defendant was unable to meet her burden of proving the application of the judicial exemption because she had provided no evidence but was simply relying on Mr Bates' assertions to the court.
- I do not accept the claimant's foundational proposition that, in the absence of any witness statement from the second defendant herself, there is no evidence that she processed the claimant's data acting in a judicial capacity. Such a proposition does not accord with common sense. The second defendant is a judge. She came across the claimant during the course of costs proceedings in which she was performing the constitutional responsibilities of a judge. The context of the second defendant holding data about the claimant is a judicial context.
- Some judges may hold data about people other than in a judicial capacity. For example, some judges in a leadership capacity hold administrative data about (for example) the welfare or health of those judges whom they lead. There is, however, no evidence to suggest that the second defendant had any reason to hold data about the claimant that was not connected to her being the judge in his case. The claimant asks the court to ignore the context.
- The claimant demands that the second defendant prove that she had no data relating to him that did not relate to the context of the case before her. I reject that demand because it is a fishing expedition. It does not equate to putting the second defendant to proof but is rather an attempt to draw the court into speculation and conjecture which are in truth the diametric opposite to findings of fact based on probabilistic assessment.
- Nor does any principle of law require a party to discharge a burden of proof by reference to some fixed form of evidence such as a witness statement. Judges (and juries) on conventional principles may consider circumstantial evidence and may draw inferences from primary facts. These are not second-rate tools but may fairly and justly form the foundations of factual findings (even to the higher criminal standard of proof which does not apply here). I am entitled to infer that, in the absence of any evidence suggesting that the judge had anything to do with the claimant other than as a judge, she processed his personal data in a judicial capacity.
- I am fortified in this conclusion by the observation of the Advocate General in X v Autoriteit Persoonsgegevens that it will be assumed by default that a court acts in a judicial capacity unless it is proven otherwise in an individual case (see para 73 of his Opinion). Such an approach does not shift any part of the burden of proof to the claimant. It enables the defendants to meet their burden by reference to the common sense inference that – in the absence of any evidence relating to some specific circumstance – the second defendant processed data about the claimant in her capacity as a judge.
- I am in any event entitled to take into consideration all the witness evidence I have heard and read including the evidence of Ms Goodson on behalf of the first defendant. She was entirely honest. She endeavoured to achieve accuracy in her answers in a conspicuously careful and thoughtful way. I accept her evidence in its entirety. It would be artificial to accept her evidence in relation to the first defendant's case but to put it out of my mind in relation to the second defendant's case. No aspect of her evidence suggested anything other than the processing of data in relation to transcripts.
- More generally, the second defendant has now confirmed by signed statement the nature and extent of her search for the claimant's personal data for inclusion in her closed bundles. The search satisfied her duties to the court. Contrary to the claimant's suggestion, I accept with no hesitation that the second defendant's search was proper and adequate. The closed bundles from each defendant are all of a piece with data processing in a judicial capacity. There is no evidence in the closed bundles to suggest that the second defendant strayed from her constitutional function as a judicial office holder or that the first defendant strayed from its proper functions as a transcriber.
- I have considered, line by line, all the closed material in the bundles. I probed counsel on any possible hint of data usage that could conceivably fall outside the judicial exemption. On the basis of all the open and closed evidence, I am satisfied that (i) the second defendant processed the claimant's personal data acting in a judicial capacity and (ii) the first defendant processed his data only as an adjunct to judicial processing. Both defendants can rely on the judicial exemption on the grounds that the second defendant was acting in a judicial capacity.
- If I am wrong about that, I am satisfied that the relevant subject access provisions do not apply because the application of those provisions would be likely to prejudice judicial independence. There are "significant and weighty grounds and evidence" for reaching that conclusion (see Lord and Lin, above).
- As to weighty evidence, the second defendant is a judge and she had conduct of the costs proceedings in which the claimant was a party. No further factual background is required and in any event there is no evidence (open or closed) to suggest the misuse of data for non-judicial purposes.
- As to weighty grounds, the judge was not obliged to account to the claimant for her actions in checking or approving the transcripts of hearings before her, or for any other processing of his data. She was not obliged to account to anyone because constitutional law places her under a duty to maintain independence from the parties. If the outcome of her actions was wrong, an appellate court could correct her. If any of her actions amounted to judicial misconduct, the JCIO would have said so. Other than that, she was under no obligation to cede the authority of the court by providing a running commentary on all and any emails or other communications she had made or received about the claimant. On the contrary, she was obliged by her judicial office to uphold the authority of the court and to preserve it from partisan interference.
- For these reasons, the defendants' responses to the SARs contain no error of law or fact. The judicial exemption applies to both defendants in relation to all the data that are before me in the open and closed bundles. In so far as the claimant claims otherwise, his claims against both defendants are dismissed.
Issue 4: Did the second defendant reply to the SAR in time?
The parties' submissions
- I have earlier in this judgment set out the chronology of the second defendant's receipt of, and response to, the SAR. Mr Boyle submitted that the second defendant should be treated as having received the SAR when it arrived at the Royal Courts of Justice on 30 April 2021. As the response was not received by the claimant until 3 June 2021, the second defendant had failed to respond within the one-month period required by article 12(3) of the UK GDPR.
- Mr Bates submitted that the second defendant could not be treated as having received the SAR until she had been given the letter. The latest that her response would have been posted was 2 June 2021. She had therefore responded within one month of receiving the SAR and was no more than 2 days late if the appropriate date for response was one month from the date of receipt at the Royal Courts of Justice. If the response was late, the second defendant apologised.
Discussion
- The Information Commissioner has produced guidance on how to calculate timeframes under article 12(3):
"A calendar month starts on the day the organisation receives the request, even if that day is a weekend or public holiday. It ends on the corresponding calendar date of the next month… However, if the end date falls on a Saturday, Sunday or bank holiday, the calendar month ends on the next working day. "
- While I would not necessarily endorse the entirety of that guidance, I was not asked by Mr Boyle to treat the one-month period in article 12(3) as ending on anything other than the corresponding calendar date of the next month. I shall adopt that approach.
- The issue of the second defendant's timeliness may be dealt with in brief terms. The SAR was made to the second defendant and not to HMCTS or anyone else who works at the Royal Courts of Justice. That the SAR was directed to the second defendant is reflected by the wording of the SAR: "Personal – only to be opened by addressee." The second defendant could not physically respond to a SAR before receiving it. In these circumstances, the claimant has failed to meet the burden which lies on him to prove that the second defendant responded outside the period of one month. This part of the claim is dismissed.
- Even if the response ought to have been provided within a month of the SAR arriving at the Royal Courts of Justice, it would have been due by 30 May 2021. The claimant can work out – by process of inference – that a letter received on 3 June must have been posted on or before 2 June. It is then a matter of simple mathematics that the response was written two days late. I would refuse to exercise my discretion to grant relief on the grounds that (i) any breach of the time limit was trivial (Ittihadeh, para 110); and (ii) the grant of relief would serve no purpose as the court would simply be reflecting a mathematical calculation that the claimant may undertake for himself.
Other issues
The status of the first defendant
- Mr Boyle submitted that the first defendant was a data controller - with its own separate duties - on the grounds that it had actively engaged in discussion and liaised with the second defendant about the claimant's personal data and their use. The claimant's skeleton argument states that he "perceives that the Framework Agreement will define the extent to which the First Defendant has autonomy as to how it processes personal data and whether it is, in fact, a data controller." The claimant asked the first defendant to bring an unredacted copy of the Framework Agreement to court.
- I did not direct the First Defendant to disclose an unredacted copy. I was not asked to do so. The First Defendant did not bring a copy to court and so I have not seen the Framework Agreement in unredacted form. The claimant has seen what I have seen.
- There has been no formal application before me for disclosure of the Framework Agreement in unredacted form. If such an application were proposed, it ought to have been filed on notice in time for the pre-trial review. Setting this procedural element aside, the claimant advanced no real legal argument (as opposed to assertion) as to the effect of the Framework Agreement on the issue of whether the first defendant was a data controller.
- Mr Stacey in open session directed me to relevant provisions of the Framework Agreement. He submitted that the Agreement's intention was that the first defendant would be the data processor and the second defendant the data controller in relation to processing of data received from the court system; however, the first defendant was an independent data controller in its own right with respect to some data (called User Personal Data) under the Agreement.
- Mr Stacey accepted that the contractual intention and arrangements cannot be definitive but submitted that the documentation showed that typically the first defendant was processing documentation on behalf of the second defendant and that she determined the purposes and means of processing the personal data.
- I have dismissed the claim against the first defendant on the basis of the judicial exemption. If I am wrong about that, I would agree with Mr Stacey that the first defendant was typically a data processor. In relation to any residual matters which may not have been typical, I would have refused to grant relief on the grounds that any atypical processing was trivial. I would have refused to grant relief on the basis that the first defendant was not a data controller in any non-trivial way.
Special category data
- Mr Boyle complained in particular about the holding and use of special category data, given the close connection between such data and article 8 privacy rights. However, article 8 rights are qualified so that intrusion into the sphere of those rights must be balanced against the public interest. There is nothing in the language of the judicial exemption to suggest that Parliament has struck an inappropriate balance between the rights of individuals to know the personal data held about them and the public interest in an independent judiciary. I was provided with no developed argument as to why special category data should receive different treatment – whether substantively or in the use of closed procedures – from any other personal data which touch on private life.
- As Mr Bates submitted, the claimant's references to the alleged misuse of special category data were gnomic, relying to a material degree on the involvement of another member of the Bar who had appeared for the second defendant at an earlier stage but who did not appear before me. There are no grounds for relief in relation to these arguments which lacked clarity.
The third party exemption
- The claimant seeks to criticise the defendants for no longer seeking to rely on the third party exemption (which is contained in para 16 of Schedule 2 to the DPA 2018) as an additional ground for refusing to disclose data. The claimant appears to imply that the change of position was sinister. There is no substance to that criticism. A party to litigation is entitled to narrow its case. The defendants were entitled to rely on the judicial exemption irrespective of their position in other respects.
GLD involvement
- The claimant regards it as improper that the second defendant is represented by GLD (as explained in his Memorandum dated 16 December 2022 and in paras 22-24 of his witness statement). In his skeleton argument, Mr Boyle suggests that GLD is "not entitled to act for an individual unless it asserts that the government has a vested interest in the outcome of the case." He implies that the second defendant has not applied her own independent judgment to certain matters that have arisen in the course of these proceedings, having let herself be dominated by hostile government lawyers "supposedly instructed by her".
- The gist of the claimant's objection to GLD appears to be a concern that the government (a party to the costs proceedings before the second defendant) would have sight of information that was disclosable in the assessment of costs but would in any other context be the subject of legal professional privilege. The claimant is concerned that his privileged material may have been deployed against him in the present proceedings. However, there are no proper grounds for advancing such a proposition.
- There is no evidence before me that GLD has mishandled any information or documents relating to the claimant. Nor have I been given any reason to suppose that GLD as an organisation does not have adequate systems for conflict checks in place. While the claimant has repeatedly goaded GLD (such as by pursuing a SAR to GLD raising disputatious questions about GLD and its various instructed counsel), I cannot conceive of how I could properly interfere with the second defendant's relationship with her solicitors and independent counsel. I have not been asked to take any action or make any order in relation to the second defendant's representation. I shall not do so.
The Gaskin procedure
- The APOC contend that the defendants had breached the "Gaskin procedure" – referring to Gaskin v United Kingdom (1990) 12 EHRR 36. The claimant deals with the Gaskin procedure at paras 50-51 of his witness statement. The essence of that procedure (I was told) is that a public authority should consider a SAR in three steps: (1) Does the request require disclosing information that identifies a third party? (2) Has the third party provided consent? (3) Is it reasonable to disclose the data without the third party's consent? This part of the claim was not pursued against either defendant at the trial and it is right that I should record as much.
Conclusion
- For these reasons, the claims against both defendants are dismissed. There is no closed judgment.
