![]() |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] [DONATE] | |||||||||
High Court of Justice in Northern Ireland Queen's Bench Division Decisions |
||||||||||
PLEASE SUPPORT BAILII & FREE ACCESS TO LAW
To maintain its current level of service, BAILII urgently needs the support of its users.
Since you use the site, please consider making a donation to celebrate BAILII's 25 years of providing free access to law. No contribution is too small. If every visitor this month gives just £5, it will have a significant impact on BAILII's ability to continue providing this vital service.
Thank you for your support! | ||||||||||
You are here: BAILII >> Databases >> High Court of Justice in Northern Ireland Queen's Bench Division Decisions >> McCord, Re Judicial Review [2020] NIQB 17 (24 Februay 2020) URL: https://www.bailii.org/nie/cases/NIHC/QB/2020/17.html Cite as: [2020] NIQB 17 |
[New search]
[Context]
[View without highlighting]
[Printable PDF version]
[Help]
Ref: KEE11202
Neutral Citation No: [2020] NIQB 17
Judgment: approved by the Court for handing down
(subject to editorial corrections)*
Delivered: 24/02/2020
KEEGAN J
Introduction
(a) To release or publish on 17 February 2020 the applicant's personal data (to wit, a list of the applicant's legal aid certificates and all payments made thereunder) under the Freedom of Information Act 2000 before the Information Commissioner has had the necessary time to investigate, consider and determine a complaint made by the applicant to release the said personal data; and/or
(b) The decision to release the personal data at any time at all.
The point at issue
Anonymity and Reporting Restrictions
The substance of the case
"The Agency is also of the view that the indication that Mr McCord will seek an urgent injunction to prevent publication is misplaced, as Mr McCord has a statutory remedy. If Mr McCord believes that the Agency's final reply is not in accordance with the Freedom of Information Act 2000 he may ask for an internal review within two calendar months of the date of the Agency's final response. If you request a review you should do so in writing stating the reasons.
If following an internal review Mr McCord remains dissatisfied he may make a complaint to the Information Commissioner and ask him to investigate whether the DOJ has complied with the terms of FOIA."
The LSA provided contact details of the Information Commissioner ("ICO").
"We refer to your review decision of 5 February 2020. We write to advise that our client wishes to make a complaint to the Information Commissioner, subject to an undertaking from you that you will not release any information whatsoever until the Information Commissioner makes a decision in respect of our client's complaint. Please provide us with the undertaking sought by close of business 12 February 2020, otherwise we have instructions to seek urgent injunctive relief without any further notice to you."
"I note that, further to my review decision of 5 February, Mr McCord intends to exercise his right to complain to the Information Commissioner. You have requested that an undertaking be provided that no information whatsoever be released until a decision has been made by the Information Commissioner in respect of Mr McCord's complaint. I write to advise that no such undertaking is to be provided. This matter has been carefully considered and I can confirm the position is, as previously set out, that the information will be released on 17 February in accordance with the review decision."
"Reference our telephone conversation this morning regarding the above, many thanks for sending me through correspondence and submissions for consideration. As you are aware, these contain a voluminous amount of information, which will take some weeks to read through and provide a view regarding the proposed disclosure of personal data and consideration of exemptions under FOIA as well as consideration of the Data Protection Act 2018 and the General Data Protection Regulation 2018 GDPR.
Please keep me updated with developments regarding this and in the meantime I will give the matter consideration and form a preliminary view as to what action, if any, the Commissioner can take in such an instance."
Legal framework
"(3) Paragraph (1) does not prevent the disclosure of information for any purpose with the consent of the individual in connection with whose case it was furnished and, where he did not furnish it himself, with that of the person or body who did."
"3.—(1) This regulation applies to information which is furnished—
(a) to the Department or any court, tribunal or other person or body on whom functions are imposed or conferred by or under Articles 12A to 20A of the Order, and
(b) in connection with the case of an individual seeking or receiving civil legal aid services funded by the Department.
(2) Information as described in paragraph (1) may be disclosed—
(a) in accordance with the law of Northern Ireland or a court order;"
"1. Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency');
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes ('purpose limitation');
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ('accuracy');
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation');
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality')."
"1. Processing shall be lawful only if and to the extent that at least one of the following applies:
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks."
"(39) Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principal of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used … in particular, the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data. The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed.
(50) The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected.
(60) The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes.
(69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject."
"(117) The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure."
(142) Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of personal data to lodge a complaint on his or her behalf with a supervisory authority, exercise the right to a judicial remedy on behalf of data subjects or, if provided for in Member State law, exercise the right to receive compensation on behalf of data subjects.
(145) For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers."
"167 Compliance orders
(1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation.
(2) A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—
(a) to take steps specified in the order, or
(b) to refrain from taking steps specified in the order.
(3) The order may, in relation to each step, specify the time at which, or the period within which, it must be taken."
Conclusion