Mr Justice Cranston :
Introductory
- The claimant in these proceedings, Clive Roberts, has been refused access to a report prepared by someone who worked for the defendant. The defendant is the NHS Trust responsible for Rampton Hospital, where the claimant receives care and treatment for his illness. The claimant has made an application to this court under section 7(9) of the Data Protection Act 1998 for access to the report. Procedurally that application is being pursued under Part 8 of the Civil Procedure Rules. The claimant is also seeking unquantified damages for distress and damage caused by the failure to provide the report. Mr Justice Lloyd Jones gave judgment at an earlier stage of the proceedings: [2008] EWHC 1617. As a result a special advocate was appointed, who has had access to the report and other material not available to the claimant's legal representatives. The special advocate was charged with the responsibility of advancing arguments in the claimant's favour. The office of special advocate is well-known in other areas of the court's work but is novel in this context. The nature of the proceedings demands that there be two judgments, an open and a closed judgment. This is the open judgment.
Background
- The background to the present proceedings is conveniently set out in the judgment of Mr Justice Lloyd Jones.
"2. The claimant is sixty-nine years of age. He is detained as a patient at Rampton Hospital, for which the defendant NHS Trust is responsible, pursuant to sections 37 and 41 of the Mental Health Act 1983. He receives care and treatment for his mental illness. He is diagnosed as suffering from
a psychotic delusional disorder and bi-polar effective disorder. He was convicted in October 1989 of offences of making threats to kill and possession of a firearm with intent to endanger life, and possession of a firearm without
a licence. On 5 October 1989 he was sentenced at Leicester Crown Court where he was made subject to a Hospital and Restriction Order. He was initially admitted to Rampton Hospital, a high security psychiatric hospital. He remained at various medium and high secure units between 1994 and 2004, but on 21 October 2004 he was readmitted to Rampton Hospital.
3. The lawfulness of his detention has been reviewed by the Mental Health Review Tribunal during his detention at medium secure units and at Rampton Hospital, and he has found on each occasion to be lawfully detained.
4. Between April 2006 and August 2007 the psychologist appointed to work with the claimant was a person to whom I shall refer as A. A was an employee of the defendant. On 24th September 2007, A provided the defendant with
a report on the claimant which was dated 3 September 2007. The defendant considered the report prepared by A. A number of concerns were voiced in respect of the report. A letter dated 10 January 2008 was sent to the claimant's solicitor by the defendant, setting out certain concerns of the defendant in this regard. The claimant's solicitors requested disclosure of the report on 21 December 2007 pursuant to the Data Protection Act. The defendant replied by letter dated 10 January 2008. The defendant indicated its intention to obtain further psychological evidence from a doctor, to whom I shall refer as B, who had replaced A as the claimant's named psychologist. The claimant again requested the report in a letter dated 22 January 2008. That request once again, was made pursuant to Section 7 of the Act. The defendant replied on 25 January 2008 confirming that it was aware of its duties under the Data Protection Act, but confirmed that it would not be providing a copy of the report prepared by A.
5. The claimant's solicitor wrote on 31 January 2008 to the Regional Chairman of the Mental Health Review Tribunal requesting disclosure of the report. That request was refused on the basis that the Regional Chairman did not have jurisdiction to order such disclosure.
6. On the 8 February 2008 the defendant again wrote to the claimant's solicitors confirming that it had considered the request for access to personal data and concluded:
"Having considered all of their obligations under the relevant Data Protection Legislation, our client is not prepared to provide you with any further information. Our understanding is that our client is under no obligation to do so. If you disagree with our interpretation we suggest you contact the Information Commissioner's Office for further clarification."
7. On 3 March 2008, a further request from the claimant's legal representatives for disclosure of A's report was made at a hearing of the Mental Health Review Tribunal. That application was refused on the basis that the defendant did not intend to rely on the report at the forthcoming hearing, that there was no statutory duty upon the defendant to provide the Tribunal with a psychology report in any event, that the MHRT had no jurisdiction to compel the defendant to disclose a report upon which it did not wish to rely, that a psychology report from B was to be relied on by the defendant, that the claimant had permission to rely on his own independent psychology report, and that the claimant therefore would have a fair opportunity of challenging the defendant's evidence and presenting his own evidence. The hearing before the MHRT was adjourned on the 3rd March 2008 to allow sufficient time for the preparation of the claimant's expert evidence. That decision of the MHRT has not been challenged by way of judicial review.
8. On 23 April 2008, the claimant's solicitors wrote again to the defendant requesting the report pursuant to section 7 (1) of the Act, and stating that the defendant's refusal was a breach of statutory duty and that there did not appear to be any exemptions to justify non-disclosure. On 6th May 2008, the defendant replied as follows:
"The Trust has complied with its duties under the Data Protection Act and the various Subject Access Modification Orders which apply to the DPA. You will no doubt be aware that there are a number of reasons for which access to medical records can be restricted or declined. The Trust has properly considered these when reaching its decision. You will also no doubt be aware that there is no duty or obligation on a Trust to confirm why certain parts of medical records have been withheld. Again the Trust has properly considered whether it is appropriate to do so."
9. On 12 May 2008, the claimant's solicitors responded in a letter accepting that the Tribunal did not have jurisdiction to consider the claim, but maintained that the defendant had failed to comply with its obligations under section 7 (1). It accepted that the Act does not require the defendant to give reasons for refusing access, but went on to say that if the defendant was relying on an exemption it was unreasonable for the defendant not to say so.
10. The restored hearing before the Tribunal is listed for the 19 August 2008. This is the background against which the claimant now wishes to pursue its application before this court for the disclosure of the report."
The Law
(1) The right to data
- Section 7 of the Data Protection Act 1998 ("the 1998 Act") confers on individuals a right of access to personal data. In outline the section reads:
"(1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled —
…
(c) to have communicated to him in an intelligible form —
(i) the information constituting any personal data of which that individual is the data subject …"
Personal data is defined in section 1 of the 1998 Act as: data
"which relates to a living individual who can be identified –
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual …"
- There is no need to examine the background to the Act except to note that it derives from Directive 95/46/EC, [1995] OJ L281/31 ("the Data Protection Directive") to which, under ordinary principles, regard must be had when interpreting the relevant United Kingdom legislation. By Article 12(a) of the Directive, the rights available under it are to be available to individuals without constraint, at reasonable intervals and without excessive delay or expense. That is reinforced by the preamble to the Directive, to which reference can be made again under general principles. Recital 41 of the preamble refers to any person being able "to exercise the right of access to data relating to him which are being processed, in order to verify in particular the accuracy of the data and the lawfulness of the processing."
- Neither in the Act nor in the Directive is there a requirement upon a data subject to provide a reason for wishing to make a request for access to data. By section 27(5) of the Act, the subject access rights contained in the Act have effect notwithstanding any legislative provision or rule of law prohibiting or restricting the disclosure, or authorising the withholding of information. This is in contrast to the provision at section 44 of the Freedom of Information Act 2000, which provides that information is exempt information if its disclosure by the public authority holding it is prohibited by or under any enactment. This has the effect that the sole means available to a data controller to restrict the subject access rights provided for in the 1998 Act is by recourse to the specific exemptions provided for in the Act: see P. Coppel, Information Rights (2nd edition): paragraph 5-008.
(2) Exemptions
- Article 13 of the Data Protection Directive authorises member States to adopt legislative measures to restrict the scope of the obligations and rights provided for
"when such a restriction constitutes a necessary measure to safeguard:
(a) national security;
(b) defence;
(c) public security;
(d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;
(e) an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;
(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e);
(g) the protection of the data subject or of the rights and freedoms of others."
Recitals 42 and 43 of the Directive read:
"(42) Whereas Member States may, in the interest of the data subject or so as to protect the rights and freedoms of others, restrict rights of access and information; whereas they may, for example, specify that access to medical data may be obtained only through a health professional;
(43) Whereas restrictions on the rights of access and information and on certain obligations of the controller may similarly be imposed by Member States in so far as they are necessary to safeguard, for example, national security, defence, public safety, or important economic or financial interests of a Member State or the Union, as well as criminal investigations and prosecutions and action in respect of breaches of ethics in the regulated professions; whereas the list of exceptions and limitations should include the tasks of monitoring, inspection or regulation necessary in the three last-mentioned areas concerning public security, economic or financial interests and crime prevention; whereas the listing of tasks in these three areas does not affect the legitimacy of exceptions or restrictions for reasons of State security or defence …"
Reflecting these provisions, there are exemptions from disclosure as set out at Part IV of the 1998 Act as well as in Orders made by the Secretary of State pursuant to specific provisions of Part IV. In particular section 30 empowers the Secretary of State to exempt from the "subject information provisions", defined in section 27 as including section 7 of the Act, personal data relating to health. Unlike the exemptions provided for under the Freedom of Information Act 2000, there is no distinction between "absolute" and "qualified" exemptions under the 1998 Act. In other words, data are either exempt or they are not.
- One of the exemptions to section 7 disclosure is provided for by Article 5 of the Data Protection (Subject Access Modification) (Health) Order 2000, SI 2000 No 413 ("the Health Order"). That order applies to personal data consisting of information as to the physical or mental health or condition of the data subject (paragraph 3). Paragraph 5 of the Order reads:
"(1) Personal data to which this Order applies are exempt from section 7 in any case to the extent to which the application of that section would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person."
Paragraph 5(2) goes on to provide that a data controller who is not a health professional shall not withhold information constituting data to which the Order applies under the exemption unless the data controller has first consulted the person who appears to be the appropriate health professional. That health professional must be asked whether or not the exemption in paragraph (1) applies with respect to the information. In general terms the "appropriate health professional" is the health professional who is currently or was most recently responsible for the clinical care of the data subject in connection with the matters to which the information sought relates. Where there is more than one such health professional, that person is the health professional who is the most suitable to advise on the matters to which the information sought relates.
- The key part of the exemption in the Health Order is that the disclosure of the information must be "likely to cause serious harm to the physical or mental health or condition of the data subject or any other person". R (on the application of Lord) v Secretary of State for the Home Department [2003] EWHC 2073 (Admin); [2004] Prison L.R. 65 involved an application for judicial review of a decision to disclose only the gist of a category A prisoner's annual security classification report. The claimant contended that the effect of section 29(1) of the 1998 Act was to prohibit the Secretary of State's blanket policy of non-disclosure of all Category A reports. Section 29(1) provides that certain personal data processed for the purposes of preventing crime and apprehending and prosecuting offenders is exempt from release under section 7 if it "would be likely to prejudice" any of these purposes. Munby J held:
"In my judgment "likely" in section 29(1) connotes a degree of probability where there is a very significant and weighty chance of prejudice to the identified public interests. The degree of risk must be such that there "may very well" be prejudice to those interests, even if the risk falls short of being more probable than not."
- In my judgment the same approach applies in the present context of the Health Order. The question is whether there may very well be a risk of harm to health even if the risk falls short of being more probably than not. Harm to health could arise in various ways. In the context of mental health, it could be self harm or harm to others. The issue demands a factual inquiry: taking all matters into account such as the personality of the applicant, his past history, the care regime to which he is subject and so on, might there very well be a risk of harm to health on release of the data? Whether there is a risk of harm from non-disclosure does not, however, arise. There is no balancing exercise in this regard, as there is in other parts of the 1998 Act, as where a data controller may balance the interests of third parties or administrative convenience when complying with an applicant's request: ss. 7(4), 8(2)(a).
(3) The court's role
- Under the 1998 Act the court is entrusted with a power to order release of data when it is satisfied that the data controller has failed to comply with a request in contravention of the legislative provisions. Section 7(9) reads:
"If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request."
To assist in that task the court is entitled to see the data. Again the relevant statutory provision, section 15(2), is worth quoting:
"For the purpose of determining any question whether an applicant under subsection (9) of section 7 is entitled to the information which he seeks (including any question whether any relevant data are exempt from that section by virtue of Part IV) a court may require the information constituting any data processed by or on behalf of the data controller and any information as to the logic involved in any decision-taking as mentioned in section 7(1)(d) to be made available for its own inspection but shall not, pending the determination of that question in the applicant's favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery (or, in Scotland, recovery) or otherwise."
Thus section 15(2) entrusts the court with a discretion to require the data, details of the exemption claimed, and information as to the logic behind the decision of the data controller. However, the court must not order disclosure of the information to the applicant or his representatives, pending determination of the issue as to whether the data is exempt.
- A number of general points can be made about the court's role under section 7(9). First, its role is to review the decision of the data controller rather than to act as primary decision maker. In Durant v Financial Services Authority [2003] EWCA Civ 1746; [2004] IP & T 814 Auld LJ said at [60]:
"Parliament cannot have intended that courts in applications under section 7(9) should be able routinely to "second guess" decisions of data controllers, who may be employees of bodies large or small, public or private or be self-employed. To so interpret the legislation would encourage litigation and appellate challenge by way of full rehearing on the merits and, in that manner, impose disproportionate burdens on them and their employers in their discharge of their many responsibilities under the Act."
And then, after referring to the Data Protection Directive and to Article 8 of the European Convention on Human Rights, Auld LJ continued at [60]:
"Under both international legal codes, it is for the Member State to justify, subject to a margin of national discretion, any provisions enabling refusal of disclosure in terms of necessity and proportionality, and similarly, data controllers should have those notions in mind when considering under section 7(4)-(6) whether to refuse access on that account. So also should courts on application by way review of any such decision under section 7(9). But it does not follow that the courts should assume, if and when such a question reaches them, the role of primary decision-maker on the merits."
- Secondly, the court must determine, with the benefit of sight of the data, whether the data controller has appropriately concluded that one of the exemptions provided for under the Act or an Order applies. The burden of proof is on the data controller, to the civil standard. Given the right involved, however, the court will approach the matter with a heightened sense of what is at stake, what has been described in other contexts as "anxious scrutiny". Auld LJ's judgment is helpful in indicating how that issue is to be approached, "in terms of necessity and proportionality". Necessity as a test originates in the directive, as can be seen from recital 43. Proportionality as an approach no doubt derives from the relevance of the European Convention on Human Rights to the issue. The twin requirements of necessity and proportionality constrain the data controller in any decision to refuse release of the data. In the light of all of this the court then reviews the decision of the data controller. It is not a decision on the merits but a consideration of whether the data controller's decision is flawed on public law grounds whether, for example, irrelevant matters have been taken into account or the decision not to release is such that no reasonable data controller would have arrived at that conclusion.
- Next, the court retains a discretion under section 7(9) of the 1998 Act as to whether to order relief, notwithstanding that the data controller has failed to comply with its disclosure obligations. In Durant Auld LJ endorsed the view that the discretion of the court in this regard was "general and untrammelled" at para [72]. He rejected the view of Ward LJ, in granting permission to appeal in Durant, that the discretion "might arguably be better expressed to be to allow disclosure unless good reason is shown why it should not be disclosed". In reaching his conclusion, Auld LJ referred to Criminal Proceedings against Lindquist, Case C-100/01, [2004] QB 1014, where the European Court of Justice said that the provisions of the Data Protection Directive were necessarily relative since it had to be applied to a large number of very different situations. The court added that "the Directive quite properly includes rules with a degree of flexibility and, in many instances, leaves to the Member States the task of deciding the details or choosing between options" (at para 83). The issue of discretion in section 7(9) does not arise in the present case. Had it done so it would have been necessary to examine more closely the notion of a general and untrammelled discretion. At first blush I am attracted to Mr Ruck Keene's submission, that the approach of Ward LJ is more faithful than that of Auld LJ to the purposes of the Data Protection Directive.
- Finally, apart from the Act, the court has no independent discretion to sanction non-disclosure of data by a data controller. If a data controller is to deny a request for access to data it must point to the Act, most likely, an exemption, and then satisfy the various legal requirements just canvassed. Any other approach, recognising in the court a power to deny access to data, despite the prerequisites of the Act being satisfied, would drive a coach and horse through the legislation as well as undermining this country's international obligations.
Claimant's submissions
- The submissions for the claimant adopt a two-fold approach. First, it is said that the claimant is entitled to the report under section 7(9) of the 1998 Act and that the defendant is not entitled to take advantage of an exemption in that Act or any Order made under it. The submissions in this regard have been advanced both by Mr Ruck Keene, instructed by the claimant's solicitors and by Mr Goudie, the special advocate. Secondly, it is submitted by Mr Ruck Keene that the court can and should disclose the report of A to the claimant's solicitors on the basis that they do not disclose it to or discuss it with the claimant. In other words, even if the claimant himself does not obtain the report it should be disclosed to his legal representatives under the Data Protection Act 1998 who can use it, for example, to assist in his case before the Tribunal.
- There is no dispute between the parties that in terms of the Data Protection Act 1998 the report constitutes data personal to the claimant, that the defendant is the controller of the data contained in the report and disclosure to the claimant of the report would constitute disclosure for the purposes of section 7. What is at the heart of the case is whether the defendant has properly identified a reason which can potentially apply to prevent disclosure of the report and whether it is necessary and proportionate that an exemption should apply to prevent disclosure. It is agreed by all parties that the issue of discretion under section 7(9), general and untrammelled or otherwise, does not arise in this case.
- In advancing the claimant's case in relation to an applicable exemption, and whether it was necessary and proportionate that it should apply to prevent disclosure, Mr Ruck Keene submitted that he was working in a vacuum. The only indication that the claimant or his legal representatives have as to the contents of the report is to be found in the letter from the defendant, dated 10 January 2008, in which it was stated that it "represents a lengthy, unedited and largely verbatim statement from Mr Roberts outlining his version of his history". A's opinion, as relayed to the claimant's representatives when she contacted them on late January, was that the claimant would benefit from seeing the report and he should be allowed access to it. Mr Ruck Keene submitted that the views of the defendant as to the standard of the report, as expressed in the January letter, were entirely irrelevant to the question of the applicability of any exemption potentially available under the 1998 Act. He reiterated the contention that it appeared extraordinary that the defendant sought to prevent disclosure of a report to the claimant which, by its own account, represented a "lengthy, unedited and largely verbatim statement" from him. In the circumstances, the claimant's representatives submitted that the defendant would have to advance truly compelling reasons in closed session to justify non-disclosure given that the defendant's own position is that that the claimant must already have knowledge of the contents of the vast majority of the report.
- As to my role Mr Ruck Keene submitted that the background circumstances were that the defendant has declined to provide any information to the claimant or his representatives as to the exemption being relied upon, or the reasons for such non-disclosure. Thus the onus was upon me to scrutinise with particular anxiety, if necessary with the benefit of the assistance of the special advocate, the basis upon which the defendant had declined disclosure and the necessity and proportionality of that decision. Even if this did not mean that the court formally assumed the role of primary decision-maker upon the merits, in this instance the line between the functions of reviewing and reaching a decision upon the merits should be a very fine one indeed.
- Mr Ruck Keene founded his argument for disclosure of the report to the claimant's legal representatives on a number of grounds. First, he said that the court should construe subsection 15(2) of the 1998 Act under section 3(1) Human Rights Act 1998 so as to be compatible with the rights of the claimant under Articles 5(4) and 6 of the European Convention on Human Rights. In this regard he adopted the comments expressed in the judgment of Lloyd Jones J, who had said at [12]:
"I accept that this application is made in a genuine attempt to resolve the issues which arise without placing in jeopardy those interests which the Defendant seeks to protect. However, the proposed procedure, that is that I should decide the issues finally on an ex-parte application, does cause me real concern for a number of reasons. The proposed course would lead to the court granting declaratory relief in the form of final declaratory orders as to the entitlement, or lack of entitlement, of the Claimant without hearing any representations on behalf of the Claimant. It would deny the Claimant any opportunity to take part in the proceedings. It would deny the Claimant any knowledge of the case which he has to meet, and it may well deny the Claimant any knowledge of the grounds on which the decision is ultimately taken. It is a matter of particular concern that it is proposed that this procedure should be followed in a case which is essentially concerned with the liberty of the subject. In this regard I have firmly in mind the common law principles, long established, that a party is in general entitled to the disclosure of all materials which may be taken into account by the court when reaching a decision adverse to that party, and the principle audi alteram partem, that a party to litigation should know what case he has to meet. Similarly, I have in mind Article 5 (4), European Convention on Human Rights, where in non-criminal cases the approach of the Strasbourg Court has generally required disclosure of adverse material and an adversarial procedure of a judicial character in which the person affected has the effective assistance of his lawyer and has the opportunity to call and question witnesses. I also have in mind the question as to whether the proposed procedure would comply with Article 6 of the European Convention on Human Rights."
- Mr Ruck Keene submitted that were subsection 15(2) not to provide the power to the court to order disclosure to the applicant's representatives in a case such as this, the court would have no option in any case of this nature but to seek the appointment of a special advocate. He submitted that, given the strictures laid down most recently in Malik v Manchester Crown Court [2008] EWHC 1362 (Admin), this would be a highly undesirable situation, especially given the fact that a special advocate in a case such as this is operating outside any statutory provisions.
- Mr Ruck Keene invoked in aid some very general provisions to support his contention that the court has the power to order disclosure on a limited basis. Thus he invoked CPR r. 1.1(2)(a), which requires that the court deal with cases justly, including, so far as practicable ensuring that the parties are on equal footing, read together with CPR r.3.1(2)(m), which provides that the court may take any other step or make any other order for the purpose of managing the case and furthering the overriding objective. Further, he submitted that the court has the power to order limited disclosure by exercising its inherent jurisdiction,
"the reserve or fund of powers, a residual source of powers, which the court may draw upon as necessary whenever it is just or equitable to do so, in particular to ensure the observance of the due process of law, to prevent vexation or oppression, to do justice between the parties and to secure a fair trial between them." Halsbury's Laws, v.37, Practice and Procedure, para 12.
- In this instance, he submitted, ordering limited disclosure would have the effect of ensuring, as much as possible, that justice is done between the parties. In all, Mr Ruck Keene submits that if the court accepts that it has the power to order disclosure on the limited basis sought by the claimant's representatives it should find that it is both proportionate and, indeed, necessary that it do so as to obviate the need for the special advocate, who should only be appointed as a last resort, and to ensure that the parties are on as equal a footing as possible for purposes of Articles 5(4) and 6(1) ECHR as well as the CPR.
Issue 1: Has the defendant failed to comply with the statutory requirements?
- Under section 7(9) of the 1998 Act the court has to be satisfied that the defendant as data controller has failed to comply with the statutory requirements if it is to order release of the report in this case. In making that determination I accept Mr Ruck Keene's very helpful submissions on the law, referred to above, in particular the need to scrutinise the matter with particular anxiety. While his submission that the line between primary decision-making and the court's review function should be very fine indeed overstates the matter, there is no doubt that, given the interests at stake, we are in the territory of heightened review. Notwithstanding that, and applying anxious scrutiny to the matter, it is my judgment that the defendant has produced clear and compelling reasons based on cogent evidence, that I should not order that A's report be released. Moreover, the defendant has also persuaded me, on the same basis that the justification for this, in terms of any exemption recognised by the Act, should not be stated. My reasoning is detailed in the closed judgment.
- However, it is necessary that I should state in this judgment that I have given the most anxious consideration to whether any injustice will follow for the claimant in not having access to the report for the purposes of his imminent hearing before the Tribunal. It will be recalled that the claimant's arguments were based primarily on his right under section 7 of the 1998 Act to access the report. Indeed at one point in Mr Ruck Keene's submissions the principled basis on which he put the claimant's case was that the good reasons the claimant had for seeing the report were not relevant to his right to see it, although it was a powerful factor in favour of the exercise of any discretion in his favour. In fact, as indicated above, there was no need to exercise any discretion in his favour.
- In any event, it is my firm conclusion that there is no injustice in the claimant not having this report for the Tribunal hearing. The defendant does not intend to rely on it at the hearing. The Tribunal has no jurisdiction to compel the disclosure of a report upon which the defendant does not wish to rely (Mental Health Review Tribunal Rules 1983, 1983 SI No 942 ("Tribunal rules"), rule 12). Indeed, there is no statutory requirement upon the defendant to provide the Tribunal with a psychology report (rule 6, Part B, Schedule paragraphs 1 to 4), although a psychology report from B is to be relied upon by the defendant. Most importantly, the claimant has permission to rely upon his own independent psychology report. He therefore has a fair opportunity of presenting his own psychological evidence and challenging the defendant. Although a party has a right to a fair trial under Article 6 of the European Convention on Human Rights that does not mean he or she has an absolute or unqualified right to see every document.
Issue 2: A half way house? Disclosure to the claimant's legal representatives
- An option advanced by Mr Ruck Keene for the claimant was that the report could be released to the claimant's solicitors under condition that they would not impart it to him. In statutory terms disclosure to the solicitors would constitute adequate disclosure under the 1998 Act. It was said that this would be an appropriate and proportionate response in the circumstances of this case. It would have the advantage that no longer would the special advocate need to be involved. The solicitors would undertake to the court that they would not disclose the report or discuss it with the claimant. They would reserve the right to use it to make submissions on the claimant's behalf to the Tribunal in his absence, on the basis that any such submissions were not to be disclosed or discussed with him. Apparently the claimant is content with this arrangement.
- Mr Ruck Keene pointed to the language of section 15(2) of the Data Protection Act 1998 itself. The penultimate clause of the sub-section refers to disclosure to the applicant or to his representatives. On that basis he submitted that the statutory language draws a distinction between the applicant and his representatives and recognises that there can be disclosure to the representatives but not to the applicant. That distinction is supported, it is submitted, by the statutory purpose of section 15(2). In his submission the court can not only permit disclosure of the information to the applicant's representatives pending the outcome of the application, upon an agreement to this end between the parties, but can also require the information to be disclosed. He submitted that this flows from the wording of the subsection, which does not talk in terms of permitting, but in terms of requiring the disclosure of the information in question. It is submitted that "requiring" in this context must by necessary implication carry with it the connotation of compulsion on the part of the court, rather than simply a role in reviewing and sanctioning an agreement between the parties. Mr Ruck Keene drew support from the Tribunal Rules. Rule 12(1) is entitled "disclosure of documents" and provides that the tribunal must send every relevant document it receives to an applicant or patient. It can decide not to forward such documents if satisfied that disclosure would adversely affect the health or welfare of the patient or others (r. 12(2)). However, a half-way house is provided by rule 12(3) of disclosure to legal representatives.
"(3) Where the tribunal is minded not to disclose any document to which paragraph (1) applies to an applicant or a patient who has an authorised representative it shall nevertheless disclose it as soon as practicable to that representative if he is-
(a) a barrister or solicitor
(b) a registered medical practitioner
(c) in the opinion of the tribunal, a suitable person by virtue of his experience or professional qualification; provided that no information disclosed in accordance with this paragraph shall be disclosed either directly or indirectly to the applicant or (where he is not the applicant) to the patient or to any other person without the authority of the tribunal or used otherwise than in connection with the application."
- In my judgment section 15(2) cannot be read in the way contended. Under it the court can require that the information in question be disclosed to it for purposes of considering an application for data disclosure. This will be the usual course of action because otherwise the court will be unable to determine the merits of the parties' position. The court cannot require the disclosure of the information to the applicant pending the outcome of the application for the obvious reason that to do so would be to pre-judge its outcome. There is no power in the court to order disclosure to the applicant's representatives for the purpose of determining the application. Indeed the statute is couched in terms which make clear that there is no such power. Pending the determination of the issue of whether the applicant ought to have access to the data, the court cannot require it to be disclosed at all to either the applicant or the applicant's legal representatives. Moreover, it seems to me that in drawing a distinction between an applicant and the applicant's representatives the section is not empowering the court to order that it be disclosed to the representatives and not the applicant. It is simply acknowledging that in some situations an applicant will be content that information is disclosed to his representatives. In my judgment rule 12(3) of the Mental Health Review Tribunal Rules does not advance the argument. Although it arises in a similar context to the present case – access by a mental patient to a relevant document – it can have no bearing on how the Data Protection Act is to be interpreted. Finally it was never explained how section 15(2) could be rewritten under section 3(1) of the Human Rights Act 1998, even had I been persuaded that Articles 5(4) or 6 of the Convention demanded it.
- Moreover, no authority was cited to me on the extent to which solicitors can withhold information from their clients. As I indicated in argument my view is that in the absence of specific authorisation lawyers must disclose all relevant information they have to a client. Specific authorisation could derive from statute, such as rule 12(3) of the Tribunal Rules, or from the client. But the general rule mandating disclosure seems to me to follow from the duty of loyalty which lawyers have to their client. Acting "in the best interests of a client", which is one aspect of the duty of loyalty, does not, in my judgment, entitle a lawyer to refuse disclosure – to decide that it is in the best interests of the client not to disclose relevant information. Relevant information and knowledge must be placed, as a matter of principle, at a client's disposal. It is a contradiction in terms for a solicitor to undertake to act for a client and then to withhold relevant information and knowledge. Working again from general principle the only exception I can conceive of is a public interest exception where, for example, the client would to the knowledge of the lawyer misuse the information to breach the criminal or civil law.
- Specific authorisation that information not be disclosed to a client could derive from the client. In other words a client could waive the right to be informed under an agreement with the solicitor that there be no, or limited, disclosure to him. Subject to any statutory provision to the contrary there would seem to be no objection to this in principle. A practical difficulty is that the client could always change his mind. In that court the solicitor could point to the agreement and refuse, but that would probably be the end of the professional relationship. In this case the claimant's representatives have acknowledged the difficulty. Apparently the claimant has given his clear and informed consent to limiting disclosure of the report to his solicitors. If he should seek to retract that undertaking they concede that they would consider themselves professionally embarrassed and could no longer able to act for him. It seems to me that although in other contexts the claimant's authorisation could be effective as a practical matter, in this case there is no basis for an exercise of discretion on my part under the Civil Procedure Rules or the in exercise of the inherent jurisdiction of the court. For the reasons given earlier the refusal of the defendant to disclose is justified under the relevant legislation and in general terms there is no injustice to the claimant in that result.
Conclusion
- In light of the very serious concerns and unusual circumstances in this case I have exercised my duty of "anxious scrutiny" to determine whether the defendant has complied with its obligations under the Data Protection Act 1998. In my judgment the defendant has clear and compelling reasons based on cogent evidence to support its decision not to release the report. Moreover, I have been persuaded that disclosure of the reasons for this conclusion are not appropriate in this case. As to what I have described as the half-way house, disclosure to the claimant's legal representatives but not the claimant, in my judgment the court has no power to order it. There is no such power in the Data Protection Act 1998. The other grounds which were advanced as a basis for that power are besides the point once it is recognised that, absent specific authorisation, legal representatives cannot keep relevant information or knowledge from a client. In this case the claimant has agreed to abide by the half-way house but that is no ground for the exercise of any discretion on my part to order disclosure of the report, given the statutory position and my conclusion that no injustice is caused to the claimant by not doing so.
- Finally, I need to emphasise that the appointment of a special advocate is not automatic. It should not be thought that the appointment of one in this case will lead to a presumption that a special advocate will be appointed in future applications under the Data Protection Act 1998. Each case will require consideration by the court and the Attorney-General as to the appropriateness or otherwise of the involvement of the Special Advocate. In this case, the Attorney General considered it appropriate and the claimant has not opposed it. For reasons given in the Closed Judgment the circumstances here were highly unusual and a special advocate was justified.
