|[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]|
England and Wales Court of Appeal (Civil Division) Decisions
You are here: BAILII >> Databases >> England and Wales Court of Appeal (Civil Division) Decisions >> Cooper v National Crime Agency  EWCA Civ 16 (22 January 2019)
Cite as:  EWCA Civ 16
[New search] [Context] [View without highlighting] [Printable PDF version] [Help]
A2/2017/1901(E), A2/2017/1901(C) & A2/2018/1717
ON APPEAL FROM THE EMPLOYMENT APPEAL TRIBUNAL
AND ON APPEAL FROM THE COUNTY COURT
AT CENTRAL LONDON CHANCERY LIST
Strand, London, WC2A 2LL
B e f o r e :
LORD JUSTICE SALES
LORD JUSTICE BAKER
| MICHAEL COOPER
|- and -
|NATIONAL CRIME AGENCY
Catrin Evans QC, Simon Murray and Jonathan Scherbel-Ball (instructed by the Government Legal Department) for the Respondent
Hearing dates: 30, 31 October, 1 and 13 November 2018
Crown Copyright ©
Lord Justice Sales:
"As a SOCA officer you are expected to maintain the highest professional standards. You are required to comply with all such subsisting policies, procedures and the Staff Charter for SOCA officers, as may from time to time be notified and made available to you."
"16 Disciplinary procedure
16.1 SOCA expects the highest professional standards from its officers. You will be expected to comply with the Statement of Values and Staff Charter for SOCA officers, which will be made available to you.
16.2 SOCA has a disciplinary procedure, which is set out in the SOCA Misconduct and Discipline Policy, a copy of which is available for your reference in the Human Resources Department.
"SOCA will not terminate your employment unless it has followed its own internal policies and procedures. SOCA may only terminate your employment without notice in circumstances where you have been found to have committed an act or omission of gross misconduct."
"24 Data Protection
24.1 In relation to Personal Data and Sensitive Personal Data (as defined by the Data Protection Act 1998) provided by you to SOCA, you give your consent to the holding and processing of that data for all purposes relating to your employment by SOCA.
24.2 In particular, you agree that SOCA can hold and process Personal Data and Sensitive Personal Data so that it can pay and review your remuneration and other benefits and provide and administer any such benefits, provide information to the HM Revenue and Customs and the Contributions Agency, administer and maintain personnel records (including sickness and other absence records), monitor and review data for the purpose of planning, policy development and to ensure SOCA's compliance with existing policies and legislation, carry out reviews of your performance, give references to future employers, and transfer your Personal Data and Sensitive Personal Data to countries outside the United Kingdom for the purpose of your duty, if you are either posted or travel abroad on SOCA business."
The ET's decision
The EAT's decision
The DPA proceedings and the County Court judgment
The legislative and policy context for SOCA's operations
"In this Part 'conduct matter' means any matter which is not and has not been the subject of a complaint but in the case of which there is an indication (whether from the circumstances or otherwise) that a person serving with the police may have
(a) committed a criminal office; or
(b) behaved in a manner which would justify the bringing of disciplinary proceedings."
"11 Recording etc. of conduct matters in other cases
(a) a conduct matter comes (otherwise than as mentioned in paragraph 10) to the attention of the local policing body or chief officer who is the appropriate authority in relation to that matter, and
(b) it appears to the appropriate authority that the conduct involved in that matter falls within sub-paragraph (2),
it shall be the duty of the appropriate authority to record that matter.
(2) Conduct falls within this sub-paragraph if (assuming it to have taken place)
(a) it appears to have resulted in the death of any person or in serious injury to any person;
(b) a member of the public has been adversely affected by it; or
(c) it is of a description specified for the purposes of this sub-paragraph in regulations made by the Secretary of State.
(3) Where the appropriate authority records any matter under this paragraph it
(a) shall first determine whether the matter is one which it is required to refer to the [IPCC] under paragraph 13 or is one which it would be appropriate to so refer; and
(b) if it is not required so to refer the matter and does not do so, may deal with the matter in such other manner (if any) as it may determine.
(4) Nothing in sub-paragraph (1) shall require the appropriate authority to record any conduct matter if it is satisfied that the matter has been, or is already being, dealt with by means of criminal or disciplinary proceedings against the person to whose conduct the matter relates.
12 Duties to preserve evidence relating to conduct matters
(2) Where a chief officer becomes aware of any recordable conduct matter relating to the conduct of a person under his direction and control, it shall be his duty to take all such steps as appear to him to be appropriate for the purposes of Part 2 of this Act for obtaining and preserving evidence relating to that matter.
(3) The chief officer's duty under sub-paragraph (2) must be performed as soon as practicable after he becomes aware of the matter in question.
(4) After that, he shall be under a duty, until he is satisfied that it is no longer necessary to do so, to continue to take the steps from time to time appearing to him to be appropriate for the purposes of Part 2 of this Act for obtaining and preserving evidence relating to the matter.
"The Parties to this Agreement intend that any complaint about the conduct of a member of the Staff of SOCA made on or after 1 April 2006, any conduct matters involving such a person and any death or serious injury matter following contact with such a person coming to the attention of the appropriate authority on or after that date should be dealt with in accordance with the relevant provisions of Part 2 of Schedule 3 to the Police Reform Act 2002."
"A conduct matter coming to the attention of the appropriate authority [as defined in clause 1(2)] in relation to the conduct of a member of the staff of SOCA shall be treated as if it had come to the attention of the authority under paragraph 10 or 11 of Schedule 3 to the 2002 Act and as if the provisions of Part 2 of the Act dealing with conduct matters applied to it, and accordingly in those provisions-
(a) a reference to a chief officer shall be treated as a reference to the Director General, and
(b) a reference to a police authority shall be treated as a reference to SOCA".
Clause 2(1) and (3), respectively, made similar provision to incorporate the statutory provisions in respect of complaints and death or serious injury matters in relation to members of the staff of SOCA. Clause 2(4) provided that the 2004 Regulations should be treated as applying to complaints and conduct matters involving the staff of SOCA.
"Personal data are exempt from the non-disclosure provisions where the disclosure is necessary-
(a) for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings)
Or is otherwise necessary for the purposes of establishing, exercising or defending legal rights."
"1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes."
"(1) for the purposes of the first principle data are not to be treated as processed fairly unless
(a) in the case of data obtained from the data subject, the data controller ensures so far as practicable that the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3), and
(b) In any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3).
(2) In sub-paragraph (1)(b) 'the relevant time' means (a) the time when the data controller first processes the data
(3) The information referred to in sub-paragraph (1) is as follows, namely
(a) the identity of the data controller,
(c) the purpose or purposes for which the data are intended to be processed, and
(d) any further information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair."
"5. The purpose of purposes for which personal data are obtained may in particular be specified-
(a) in a notice given for the purposes of paragraph 2 by the data controller to the data subject, or
(b) in a notification given to the [Information Commissioner] under Part III of this Act.
6. In determining whether any disclosure of personal data is compatible with the purpose or purposes for which the data were obtained, regard is to be had to the purpose or purposes for which the personal data are intended to be processed by any person to whom they are disclosed."
"1. The data subject has given his consent to the processing.
2. The processing is necessary
(a) for the performance of a contract to which the data subject is a party,
3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.
5. The processing is necessary
(b) for the exercise of any functions conferred on any person by or under any enactment,
(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.
6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. "
"1. The data subject has given his explicit consent to the processing of the personal data.
2(1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.
6. The processing
(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),
(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.
7(1) The processing is necessary
(b) for the exercise of any functions conferred on any person by or under an enactment "
"There must therefore be some form of active communication where the individual knowingly indicates consent If you are going to rely on consent as your condition you must be sure that individuals know precisely what data sharing they are consenting to and its implications for them. They must also have genuine control over whether or not the data sharing takes place. "
The County Court appeal
Ground (1): compliance with the first data protection principle
(i) Compliance with conditions in Schedule 2 DPA
" The test of necessity in the conditions means more than desirable but less than indispensable or absolutely necessary: see e.g. Goldsmith International Business School v Information Comr  UKUT 563 (AAC) at . A test of reasonable necessity should be applied: see the Goldsmith International Business School case, para. . This test implies that the council [the data controller in that case] has an appropriate margin of appreciation. The parties agreed that the power had to be exercised proportionately. "
"25. I agree with Mrs Wolffe to this extent: the word "necessary" has to be considered in relation to the processing to which it relates. If that processing would involve an interference with the data subject's right to respect for his private life, then the Austrian Radio case is clear authority for the proposition that the requirements of article 8(2) of the European Convention on Human Rights must be fulfilled. However, that was a case about article 7(e), where there is no express counterbalancing of the necessary processing against the rights and interests of the data subject. In a case such as this, where that balance is built into article 7(f) and condition 6, it may not matter so much where the requirements of article 8(2) are considered, as long as the overall result is compliant with them.
26. In this particular case, however, as the processing requested would not enable Mr Irvine or anyone else to discover the identity of the data subjects, it is quite difficult to see why there is any interference with their right to respect for their private lives. It is enough to apply article 7(f) and condition 6 in their own terms.
27. I disagree with Mrs Wolffe, however, about the meaning of "necessary". It might be thought that, if there is no interference with article 8 rights involved, then all that has to be asked is whether the requester is pursuing a legitimate interest in seeking the information (which is not at issue in this case) and whether he needs that information in order to pursue it. It is well established in community law that, at least in the context of justification rather than derogation, "necessary" means "reasonably" rather than absolutely or strictly necessary (see, for example, R v Secretary of State for Employment, Ex p Seymour-Smith (No 2)  1 WLR 435; Chief Constable of West Yorkshire Police v Homer  UKSC 15;  ICR 704). The proposition advanced by Advocate General Poiares Maduro in Huber [Case C-524/06 Huber v Bundesrepublik Deustchland  All ER (EC) 239] is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. Thus, for example, if Mr Irvine had asked for the names and addresses of the employees concerned, not only would article 8 have clearly been engaged, but the Commissioner would have had to ask himself whether his legitimate interests could have been served by a lesser degree of disclosure."
"The concept of necessity has a long history in Community law and is well established as part of the proportionality test. It means that the authority adopting a measure which interferes with a right protected by Community law in order to achieve a legitimate aim must demonstrate that the measure is the least restrictive for the achievement of this aim."
(ii) Compliance with the conditions in Schedule 3 DPA
(iii) Overarching fairness
(iv) Section 35(2) of the DPA
Ground (2): compliance with the second data protection principle
Ground (3): SOCA's disclosure of Mr Cooper's personal data to the police
Ground (4): Causation
The employment appeal and cross-appeal
Lord Justice Baker:
Sir Geoffrey Vos, C: