BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £1, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!
 |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] | |
Jersey Unreported Judgments |
||
|
You are here: BAILII >> Databases >> Jersey Unreported Judgments >> Cole v Jersey Post and States Police [2003] JRC 152 (04 September 2003) URL: http://www.bailii.org/je/cases/UR/2003/2003_152.html Cite as: [2003] JRC 152 |
||
[New search] [Help]
[2003]JRC152
royal court
(Samedi Division)
4th September 2003
|
Before: |
M C St J Birt, Deputy Bailiff and Jurats P.J. de Veulle and A.P.Quérée |
|
Between |
HARRY ROYSTON COLE |
Plaintiff |
|
|
|
|
|
|
|
|
|
And |
THE STATES OF JERSEY POSTAL ADMINISTRATION COMMITTEE (T/A JERSEY POST) |
First Defendant |
|
|
|
|
|
And |
THE CHIEF OFFICER OF THE STATES OF JERSEY POLICE |
Second Defendant |
Appeal by the Plaintiff against an Order of the Master, striking out Order of Justice on ground it was frivolous, vexatious and an abuse of process.
The Plaintiff in person
Advocate D.J.Benest for the First and Second Defendants
judgment
the deputy bailiff:
1. This is an appeal by the plaintiff, Mr. Cole, against the decision of the Master to strike out his order of justice on the grounds that it was frivolous or vexatious and an abuse of process.
2. In October 2001, in response to an advertisement, the plaintiff decided to seek temporary employment over the Christmas period with the Post Office which is managed by the first defendant ("Jersey Post"). He obtained an application form. According to Jersey Post, all application forms sent out were accompanied by a covering letter which included this sentence -
"Please note that it is standard practice for all references to be checked and for all applicants to undergo a security check before commencing employment".
The plaintiff states that he did not receive this covering letter because he went into Jersey Post to pick up an application form in person. As this is a striking out application, we proceed on the basis that he is correct and that he did not receive this letter.
3. The plaintiff duly completed the application form. The form contained a section headed "CONVICTIONS" in which the question posed was "Have you ever been convicted or found guilty of any offence in a court of law (including honorary police enquiries, juvenile court or court martial) or is any case pending?" To this, the plaintiff answered "NO". The form contained the following declaration just before the signature -
"I declare that I have answered these questions truthfully and accurately and that I understand the conditions for employment. I understand that the particulars given by me might be checked (emphasis added) and that if they are found to be false within my own knowledge I may be regarded as ineligible for recruitment or dismissed after appointment".
4. The plaintiff returned the completed application form on 30th October 2001. He then received an acknowledgement dated 31st October 2001 confirming that he had provisionally been allocated a position with Jersey Post over the Christmas period "subject to satisfactory police checks". The plaintiff did not object at any time to a police check being carried out but neither did he expressly indicate his consent. Jersey Post asserts that the completion of the form and the lack of objection to the acknowledgement letter dated 31st October amounted to an express, alternatively an implied consent to such a check.
5. The police check showed that the plaintiff did have previous convictions from many years ago. However, these were convictions that, under the Rehabilitation of Offenders Act 1974 of the United Kingdom ("the 1974 Act"), were spent convictions and therefore would not have to be included in a similar application form being completed in the United Kingdom. The plaintiff asserts in his order of justice that that is why he answered 'No' to the question in the form concerning previous convictions. He assumed that the 1974 Act was applicable in Jersey. On 13th November 2001, having received the result of the police check, Jersey Post withdrew its provisional offer of temporary employment.
6. The plaintiff issued his order of justice on 27th March 2002. He is acting in person and it is not easy to ascertain the exact nature of the various causes of action upon which he relies. Nevertheless, we think they have been usefully summarized by Advocate Benest as follows -
(i) A claim for compensation against the second defendant ("the Police") for breach of the Data Protection (Jersey) Law 1987 ("the 1987 Law").
(ii) A claim against the Police for breach of the 1974 Act by disclosing spent convictions.
(iii) A claim against both defendants for breaches of the European Convention on Human Rights ("ECHR") or the Human Rights (Jersey) Law 2000 by reason of the disclosure of the plaintiff's spent convictions without his consent.
(iv) A claim in negligence against Jersey Post for using an application form which did not make it clear that police criminal records would be checked or require his specific consent to such checks or make it clear that the 1974 Act did not apply in Jersey so that all convictions needed to be included.
(v) A claim in negligence against the Police for breach of their duty to ensure that they were acting within the terms of the 1987 Law and of their duty to ensure that the plaintiff had consented to the disclosure of his criminal record to Jersey Post and for failing to ensure that Jersey Post's application form made it clear that the 1974 Act did not apply in Jersey.
7. As stated previously, the defendants have applied to strike out the order of justice on the grounds that it is frivolous or vexatious and an abuse of process. In such an application, limited evidence is permissible (unlike where the application is based upon the ground that the claim discloses no reasonable cause of action) and the defendants have filed two affidavits in order to give background material.
8. Allyson Edwards is the manager of the Criminal Justice Unit of the Police and acts as their data protection officer. She states that the Police are registered as a data user under the 1987 Law and that the Post Office is included in the entry in the register as one of the persons to whom the Police may wish to disclose data in accordance with Article 3(3)(d) of the 1987 Law. The purpose set out in the registration form is 'policing' but a further purpose is 'in addition it (i.e. the Criminal Records Index) may be used for ACPO approved background checks'.
9. She asserts that she requires a party such as Jersey Post, which is seeking access to data held on the criminal records index, to satisfy her that the data subject has given his/her authority to the check. She would regard it as sufficient that the authority is implied, although she would prefer it to be express.
10. She states that in October 2001 she was contacted by Jenny Callaghan on behalf of the human resources manager of Jersey Post, Teresa Lamy, seeking advice about procedures for taking on temporary staff at Christmas. Ms Edwards has a standard check-list on such matters which she used to brief Ms Callaghan. Two particular points on that check-list are as follows -
· "Applicants must be aware that the Rehabilitation of Offenders Act does not apply in Jersey (Act to rehabilitate offenders who have not been re-convicted of any serious offence for periods of years).
· Applicants must provide consent for a check to be made with the Police."
She says that she made Ms Callaghan aware of these requirements.
11. Following this discussion, Ms Callaghan sent Ms Edwards the standard application form for approval. On 5th November 2001 Ms Edwards contacted Ms Callaghan to express her concern about the application form as the specific consent from the applicant for a police check to be conducted seemed to be missing: Apparently Ms Callaghan replied that a standard letter always accompanied the application form and this made it clear that a police check was carried out as a matter of course. It was agreed that Jersey Post would send Ms Edwards a copy of the standard letter and this was done on 7th November. It would seem that Ms Edwards was satisfied with the terms of this letter. This was the standard covering letter referred to in paragraph 2 above.
12. It was on this basis that the Police processed the various checks required by Jersey Post on its potential temporary employees, including that upon Mr. Cole. It would however appear that Jersey Post had not taken on board the advice referred to in the first bullet point concerning the non applicability of the 1974 Act in Jersey and Ms Edwards does not seem to have queried this omission when she reviewed the standard application form.
13. Ms Edwards goes on to say in her affidavit that she has been informed that Mr. Cole denies having received the standard letter which accompanied the application form. She has however been shown the letter which Mr. Cole was sent on 31st October (see paragraph 4 above) and asserts that, had she been shown this letter at the time, she would have regarded Jersey Post as having discharged its responsibility to ensure that an applicant was aware of and had the opportunity to object to a police security check being carried out. Ms Lamy's affidavit is broadly consistent with that of Ms Edwards.
14. Following the events giving rise to this action, Jersey Post's application form has been re-designed. The Court has seen the amended version which states specifically that the UK Rehabilitation of Offenders Act does not apply in Jersey and contains a specific authority by the applicant for Jersey Post to contact the Police regarding the relevant security clearance. The plaintiff relies on that in support of his contention that the original application form was inadequate. However, before getting to that point, the Court has to consider whether, even assuming that to be so, the plaintiff has an arguable cause of action.
15. With that introduction we turn to consider the various causes of action in turn.
16. Article 22 of the 1987 Law provides as follows -
17. Before the Master, Mr. Benest relied simply on paragraph (2) of the Article, asserting that it was an absolute defence in respect of any disclosure to Jersey Post because Jersey Post was listed in the entry in the register as being an entity to which the Police intended or wished to disclose data pursuant to Article 3(3)(d) of the Law. On the basis of the arguments put forward to him, it is not surprising that the Master came to the conclusion that Mr. Benest's submission was correct. However, the Court has required rather more detailed argument concerning the framework of the 1987 Law (which is not easy to understand) and, having had the benefit of those further submissions, we conclude that the position is not as straightforward as was put to the Master.
18. It seems to us that Article 22 has no application to the present case. Article 22(1)(c) provides for a right on the part of the individual who is the subject of personal data ("the data subject") to compensation where the data about him is disclosed "without such authority as aforesaid". That can only be a reference to the authority described in Article 22(1)(b) which refers to the "authority of the data user". Thus, the Article is not dealing with a disclosure made without the authority of the data subject; it is dealing only with disclosure made without the authority of the data user (the Police in this case). It is presumably dealing, for example, with an accidental disclosure or with a disclosure made by a member of the Police for his own purposes so that the Police as a body cannot be taken to have authorized the disclosure. But we are not dealing with such a position. The Police undoubtedly authorised this disclosure. The defence referred to in paragraph (2) is not relevant because the Article itself does not apply; the disclosure was made with the authority of the Police as data user.
19. What the plaintiff alleges in this case is that the Police disclosed data to a recipient listed in the entry in the register without the consent of the data subject. The question arises therefore of whether this amounts to a breach of the 1987 Law and, if so, whether such a breach confers a private law remedy of damages on the part of the data subject against the data user. This necessitates a brief review of the material provisions of the 1987 Law.
20. The 1987 Law seems to provide for three forms of remedy. In some cases the Law provides for a criminal prosecution; in others for a remedy by way of enforcement notice (or de-registration notice) issued by the registrar; and in others it provides for a private law remedy of compensation.
21. We will deal first with some of the breaches which amount to criminal offences. Article 3 provides that the registrar will maintain a register of data users who hold personal data. Article 3(3) provides -
22. Article 4 is a key provision. It provides that it is a criminal offence to hold personal data unless registered under Article 3 and goes on to provide at paragraph (2) -
A breach of Article 4 is a criminal offence.
23. The disclosure in the present case, even if made without the plaintiff's consent, is not in breach of Article 4(2)(d) because it was not a disclosure to a person who is not described in the entry pursuant to Article 3(3)(d). We shall use the expression "a listed recipient" to cover a person who is described in the entry and "an unlisted recipient" to cover a person who is not described in the entry. Jersey Post is a listed recipient in respect of the Police and any disclosure by the Police to Jersey Post is therefore not a breach of Article 4(2)(d).
24. The second type of remedy conferred by the Law is an enforcement notice (or in very serious cases a de-registration notice). Article 9(1) provides that, where he is satisfied that a person has contravened or is contravening any of the data protection principles, the registrar may serve the registered person with an enforcement notice requiring him to take such steps as are specified to comply with the principle in question. A failure to comply with an enforcement notice is an offence (see Article 9(9)).
25. The data protection principles are set out in part I of the first schedule of the Law. Part II of the first schedule contains the rules to be applied in interpreting the principles in part I. The relevant principles in this case are the second and third principles which provide as follows -
26. The relevant rules of interpretation in relation to these two principles contained in part II of the first schedule are as follows -
Rule 3(b) must be referring once again to a person listed in the entry in the register pursuant to Article 3(3)(d), i.e. it is only a breach of the third principle to disclose data to an unlisted recipient; disclosure to a listed recipient is not a breach. Here, of course, we are dealing with disclosure of the plaintiff's record to a listed recipient. Accordingly, even if disclosed to Jersey Post without the plaintiff's consent, the data concerning the plaintiff's record was not disclosed in breach of the third principle so far as it specifically concerns disclosure.
27. Thirdly, the 1987 Law confers a remedy to compensation on the part of the data subject in some cases. Thus Article 21 confers a right to compensation for inaccuracy of the data held by the data user and Article 22 confers a right to compensation for loss or for certain unauthorized disclosures. However, as described earlier, Article 22 does not confer a right to compensation in the circumstance of this case where the disclosure was made with the authority of the Police. Furthermore, even if disclosure were made without the authority of the Police, there would be no right to compensation where that disclosure was to a listed recipient such as Jersey Post (see Article 22(2)).
28. The Court allowed the data registrar to address it in order to assist the Court in understanding the Law. He referred to Article 33(5) and indicated that this suggested that the consent of a data subject like Mr. Cole was required for a disclosure by the Police to a listed recipient such as Jersey Post. With respect, we do not agree. Article 33 falls within part IV of the Law and is dealing with exemptions from the provisions of parts II and III. In particular, Article 33(5) confers an exemption from "the non-disclosure provisions" where the data subject has requested or consented to the particular disclosure. The "non-disclosure provisions" is a defined term which is to be found at Article 25(3). For present purposes the only relevant non-disclosure provision is Article 4(2)(d) i.e. the provision which makes it an offence to disclose data to an unlisted recipient. In such cases the consent of the data subject means that there is no breach of Article 4(2)(d). But neither Article 25(3) nor Article 33(5) is dealing with any form of disclosure to a listed recipient and Article 33(5) is therefore not relevant for the purposes of this case.
29. It follows from this that there appears to be no provision of the Law which restricts the ability of a data user to disclose information to a listed recipient. It would seem that a data user can safely disclose data about a data subject to a listed recipient even if there is no good reason to do so; he might even be acting maliciously. We find this somewhat surprising. One of the objectives of the Law is to control the holding and disclosure of data and to protect the right to privacy of individuals about whom data is held. It would seem to be inconsistent with those objectives if, just because a data user has listed a particular recipient in his entry in the register, he can disclose any data he likes to that recipient for whatever purpose.
30. Could the answer lie in Article 4(2)(b) and the third data protection principle insofar as it concerns `use' rather than `disclosure'? For convenience, we repeat them. Article 4(2)(b) provides -
The third data protection principle provides -
Could it be argued that the disclosure of data for a purpose other than one described in the entry in the register (an "unlisted purpose") amounts to `use' of that data for such a purpose or use of that data in a manner incompatible with the purpose listed in the register?
31. The argument in this case presumably would be that the disclosure to Jersey Post was clearly not for the purposes of 'policing'. It can only have been for the purpose listed in the register of 'ACPO approved background checks'. We have not heard any evidence about the requirements for ACPO approved checks but the plaintiff suggested that ACPO require the consent of the data subject to be obtained. If that is correct, the argument might be that disclosure would only be for the listed purpose of "`ACPO' approved background checks" [emphasis added] if the procedures laid down by ACPO for obtaining the consent of the data subject were fully complied with. Accordingly, if the matter stood there, we would feel that the case was not suitable for striking out. The issue of whether consent was required by ACPO procedures, and if so, whether it was sufficiently obtained in this case, is more suitable for resolution after evidence has been heard.
32. However, it seems clear to us that 'using' data cannot include 'disclosing' data. The Law repeatedly draws a distinction between the two words which would suggest that they mean something different and that `using' data does not include `disclosing' data (cf Article 3(3)(b) with 3(3)(d) and 4(2)(b) with 4(2)(d). So far as Article 4 is concerned, it specifically deals with the issue of disclosure at 4(2)(d) and makes it a criminal offence (subject to the exemptions in Article 33) for a data user to disclose data to an unlisted recipient. It says nothing about it also being a criminal offence to disclose data to a listed recipient but for an unlisted purpose. We cannot accept that, although dealing specifically with the issue of disclosure in 4(2)(d), the 1987 Law has surreptitiously criminalised disclosure of data to a listed recipient for an unlisted purpose by means of Article 4(2)(b), which deals with the holding and use of data.
33. Although the third data protection principle suggests that data must not be used or disclosed in any manner incompatible with the listed purpose(s), Rule 3(b) of the interpretation provisions makes it clear that, so far as disclosure is concerned, the third principle is only concerned with disclosure to an unlisted recipient. It would be very surprising if Rule 3(b) specifically provided that the third principle could not be breached by disclosure to a listed recipient but Rule 3(a) could be interpreted to mean that disclosure to a listed recipient could be a breach of the third principle because it was `used' for an unlisted purpose.
34. For these reasons we hold that what is alleged by the plaintiff in this case cannot amount to a breach of Article 4(2)(b) or the third data protection principle.
35. Even if the Court is wrong in concluding that, even on the plaintiff's case, there has been no breach of Article 4(2)(b) or the third data protection principle (in relation to use), the plaintiff faces one final difficulty. The Law provides a remedy for a breach of Article 4, namely a criminal sanction. The Law also provides a remedy for a breach of the data protection principles, namely an enforcement notice on the part of the registrar. Private law remedies are conferred by the 1987 Law for certain matters (e.g. Articles 21 and 22) but the Court has not been referred to any provision which confers a private law cause of action for a breach of the duties imposed by Article 4(2)(b) or the third data protection principle.
36. The leading authority on the principles to be applied in determining whether a breach of a statutory duty confers a private law cause of action on a person who has suffered loss as a result of such a breach is 3 WLR 152. See in particular the comments of Lord Browne-Wilkinson at 166 where he said -
37. The Court would accept that the statutory duties in the 1987 Law were imposed for the protection of a limited class of the public, namely data subjects about whom data is held. However it seems impossible to find that the States intended to confer on data subjects a private right of action for any breach of duty in this case. In the first place the 1987 Law has provided alternative remedies for breaches of Article 4 (criminal prosecution) and breaches of the data protection principles (enforcement notices). As Lord Browne-Wilkinson says, this points against the existence of a private remedy although it is not necessarily decisive.
38. Secondly, the legislature has specifically addressed the question of a private law remedy and has held that it should be conferred in the circumstances set out in Article 21 (compensation for inaccuracy) and Article 22 (compensation for loss or destruction of data or certain unauthorized disclosures). Article 22(2) is particularly significant. It provides specifically that, even where data is wrongly or negligently disclosed without the authority of the data user, there is only a remedy by way of compensation if the disclosure is to an unlisted recipient. If such negligent or wrongful disclosure is made to a listed recipient, there is no right to compensation even if the disclosure was made for an unlisted purpose. Article 22(2) is absolute in its terms. It would be somewhat illogical for the legislature, whilst specifically denying a remedy in such circumstances, to be held nevertheless to have intended that there should be a right to compensation where disclosure was made to a listed recipient with the authority of the data user but for an unlisted purpose. Where the legislature has specifically addressed the question of private law remedies and has decided that these should be made available in some cases in a particular piece of legislation, it cannot be open to the courts to invent private law remedies for other breaches of statutory duty where the legislature has specifically declined to do so.
39. The Court holds therefore as a matter of law that, even if the plaintiff were to establish breaches of Article 4(2)(b) or the third data protection principle (in respect of use), there is no private law cause of action for any such breaches.
40. It follows that, even if the plaintiff were to be successful at trial in showing that ACPO approved procedures required that disclosure should not have been made by the Police to Jersey Post without his consent and even if he is further successful in showing that the necessary consent was not obtained in this case, his case is doomed to failure and should be struck out. We therefore uphold the Master's decision on this aspect, albeit on somewhat different grounds.
41. In his order of justice the plaintiff claimed damages for a breach (presumably by the Police) of the 1974 Act in wrongly disclosing spent convictions. In his submissions before the Court the plaintiff accepted that he could not pursue this claim. In our judgment he was right to do so. The 1974 Act is an Act of the United Kingdom Parliament which does not extend to Jersey by its express terms nor has it been extended to the Island by Order in Council. It therefore has no application in Jersey and does not form part of Jersey law. The plaintiff may not therefore bring any claim in reliance upon it in the present proceedings. It is true that the Island has now passed the Rehabilitation of Offenders (Jersey) Law 2001 but this has not yet come into force. The Master was therefore quite correct in concluding that this aspect of the plaintiff's claim was doomed to failure and should be struck out accordingly.
42. Although the order of justice alleges breaches of a number of articles of the ECHR the plaintiff said in argument that, on reflection, he relied upon only three articles of the Convention as follows -
(i) Article 6 - This had been breached by the decision to strike out his proceedings.
(ii) Article 8 - This had been breached by the wrongful disclosure of his record.
(iii) Article 14 - He was discriminated against by Jersey Post because they had employed other persons with criminal records.
43. The Human Rights (Jersey) Law 2000 will incorporate the ECHR into the domestic law of Jersey. However, the Law has not yet been brought into force. The ECHR therefore remains unincorporated into Jersey domestic law and the Court accordingly has no power to enforce breaches of the Convention by way of awarding damages for such a breach. The relevance of the ECHR in domestic law was authoritatively stated by Southwell JA in the Court of Appeal in JLR 213 at 218 where he said -
44. It follows that, even if the plaintiff were to succeed in showing on the facts that there had been a breach of one or more articles of the ECHR, the Court would have no jurisdiction to make an award of damages or any other remedy in respect of such a breach. Accordingly the Master was correct to strike out this part of the claim.
45. The plaintiff claims in negligence against Jersey Post for designing an application form in such a way as not to make clear that there would be a police check or requiring the plaintiff specifically to consent to such a check and not making it clear that the 1974 Act did not apply in Jersey.
46. Mr. Benest relied on the case of Lloyds LR 48. That case was concerned with whether an applicant for employment could bring a claim in negligence against a doctor who had been requested by the potential employer to prepare a medical report on the applicant and who was allegedly negligent in the preparation of such a report. In passing, the court made it clear that an employer owes no duty of care towards applicants for employment. Thus Kennedy LJ said at 50 -
Millett L J at 56 (paragraph 13) said this -
47. On the basis that an employer owes no duty of care towards a potential employee in respect of the processing of applications for employment, it must follow that, even if Jersey Post was negligent in the way it prepared the application form, it cannot be liable to the plaintiff in negligence because it owed him no duty of care in this respect.
48. Furthermore, as the plaintiff accepts, he cannot on the facts prove any loss. The plaintiff accepts that, if he had been told that the 1974 Act did not apply in Jersey and had been specifically asked for consent to a police check, he would have been forced to make one of two choices. He could either have consented to the police check (in which event the result would have been the same as it was in this case because Jersey Post would have refused to offer him employment once it received the results of the check) or he could have refused to authorize a police check (in which event, he accepted, Jersey Post would undoubtedly have refused to offer him employment because they required all applicants to undergo a police check). In other words, even if Jersey Post had not been negligent as alleged, the plaintiff would not have obtained this employment and he therefore suffered no financial loss as a result of any negligence.
49. For both of these reasons, we conclude that the plaintiff's claim under this heading is doomed to failure and the Master was therefore right to strike it out.
50. The plaintiff alleges that the Police were negligent in not ensuring that all their actions were consistent with the requirements of the 1987 Act and in not ensuring that Jersey Post made clear that the 1974 Act did not apply and had obtained the specific consent of the plaintiff to a police check.
51. The Master held that, by analogy with the decision in , the Police could not owe any duty of care towards a potential applicant for employment with Jersey Post. The duty, if any, was owed by the Police to Jersey Post. We agree.
52. It might be argued that the circumstances in this case were slightly different from those in because there was a pre-existing relationship to the extent that the plaintiff was a data subject in respect of data held by the Police. However in our judgment that can make no difference in this case. The Court has already held that, for the reasons set out earlier, there is no private law cause of action for breach of statutory duty simpliciter in connection with any alleged breaches of the 1987 Law. In those circumstances it would not be right for the Court to imply a common law duty of care in circumstances where it has declined to find a private law cause of action for breach of statutory duty. In this context the remarks of Lord Hoffman in 3 WLR 388 at 414 are of assistance -
53. In our judgment there are no valid grounds in this case for taking the exceptional course of finding that there is a common law duty of care when there is no private cause of action for a breach of statutory duty.
54. For the reasons which we have given, we conclude that the Master was right to strike out the order of justice as a whole on the grounds that all of the plaintiff's claims were obviously unsustainable and doomed to failure with the result that they were frivolous or vexatious and an abuse of process. We therefore dismiss this appeal.
