The scope of the right to respect for private or family life

Ali & Anor, R (on the application of) v Minister for the Cabinet Office the Statistics Board [2012] EWHC 1943 (Admin) (13 July 2012)

Summary

This decision of the English and Wales High Court considered the right to respect for private and family life and the exceptions to this right. In particular, the High Court considered whether the Statistics Board’s ability to disclose personal information provided to it in the census for the purposes of a criminal investigation or proceedings was incompatible with a person’s Convention right to privacy.

Facts

On 27 March 2011, householders in the United Kingdom were required to complete a census form. It is a criminal offence not to do so. The information required included sensitive personal data such as information about individuals’ racial or ethnic origins, their religious and other beliefs, and their physical and mental health.

Section 39(4)(f) of the Statistics and Registration Act 2007 (UK) (the 2007 Act) permits the Board to disclose personal information and sensitive personal information provided to it in the census where the disclosure is made “for the purposes of a criminal investigation or criminal proceedings (whether or not in the United Kingdom)”.

The first claimant completed and returned a census form. He was concerned that his personal and sensitive information might be transferred abroad to support a foreign criminal investigation, perhaps for a relatively minor offence.

The second claimant, a refugee from Afghanistan, refused to complete a census form because he was concerned that his personal details might be disclosed to external agencies, including the Afghan authorities.

Both claimants sought a declaration that section 39(4)(f) of the 2007 Act was incompatible with article 8 of the European Convention on Human Rights, which provides that there shall be no interference by a public authority with a person’s right to respect for their private or family life except “such as is in accordance with the law and necessary in a democratic society in the interests of national security, public safety … for the prevention of disorder or crime … or for the protection of the rights and freedoms of others”.

The claimants argued that the absence of criteria for disclosure in the 2007 Act meant that:

• The regime was not a clear, transparent and sufficiently predictable body of law, and therefore a disclosure would not be “in accordance with the law”.
• There was no way of assessing whether the disclosure was proportionate.

They also contested the lack of advance notification to a person of a request for disclosure and an opportunity to challenge the disclosure. The second claimant also submitted that there was no safeguard as to how personal data may be used by other authorities once disclosed by the Board.

The defendants, the Minister for the Cabinet’s Office and the Board, argued that the Data Protection Act 1998 (UK) (the DPA Act), the Human Rights Act 1998 (UK) and the Board’s published policy combined with the 2007 Act to provide appropriate protection.

Legislative and Policy Framework

Section 6 of the Human Rights Act (which incorporates the Convention into UK law) states that public authorities must act in a way that is compatible with the Convention.

The DPA Act sets out eight data protection principles. These include that personal data “shall be processed fairly and lawfully”, it “shall not be kept for longer than is necessary for that purpose”, it “shall be processed in accordance with the right of data subjects” under the DPA Act, and it shall not be transferred to a country or territory outside the European Economic Area “unless that country or territory ensures an adequate level of protection for the right and freedoms of data subjects in relation to the processing of personal data.” The Board is required to comply with the obligations under the DPA Act, including the eight data protection principles.

The Board’s policy is that the Board will never volunteer to disclose personal information, it will refuse requests for disclosure where it is lawful to do so, and it will contest any legal challenge to its decision to the maximum extent possible under the law. The only qualification to this is if a court order is made requiring disclosure.

Decision

The Court dismissed the claims.

Justice Beatson of the High Court set out three elements to his decision:

• In determining the overall effect of section 39 of the 2007 Act and its compatibility with the Convention, it is legitimate and necessary to consider the DPA Act, the Human Rights Act and the Board’s policies.
• The Board, employees and contractors complying with the various rules, principles and policies would not be able to disclose census information in a manner that would constitute a disproportionate interference with article 8.
• Despite the number of legal sources governing the matter, the position is sufficiently certain to comply with the requirement of article 8(2) that any interference with privacy be “in accordance with the law”.

In relation to the second element, Justice Beatson noted that article 8 contains implicit procedural safeguards to ensure that the decision-making process is fair. However, in a case where there is a risk that the investigation or proceedings may be endangered, the fact that an individual is not informed of the disclosure or not informed in advance, will not constitute a breach of article 8. It is necessary to assess the decision-making process as a whole in determining whether there are “adequate and effective safeguards against abuse” and whether the scope of the discretion is sufficiently well-defined. In doing so it is relevant to consider whether there are procedural safeguards such as advance authorisation by a court, judicial control of the exercise of discretion, and the possibility of judicial review.

Justice Beatson found that the conditions in the DPA Act must be seen as guidelines structuring the discretion of the Board. The DPA Act provides for a balancing exercise which takes into account the rights and freedoms or legitimate interests of the data subject.

Justice Beatson also stated that the Board’s policy to refuse to disclose personal census data unless compelled by a court was an important additional safeguard which meant that, looking at the decision-making process as a whole, the interests of the data subject would be adequately protected.

Commentary

This case has relevance to the Victorian Charter of Human Rights and Responsibilities Act 2006 (Vic) in that the Charter contains a right to the protection of privacy and family life under sections 13 and 17. Section 7 of the Charter also states that a human right may be subject “under law” only to “such reasonable limits as can be demonstrably justified in a free and democratic society based on human dignity, equality and freedom”, taking into account all relevant factors. The wording of article 8(2) of the Convention and section 7 of the Charter do have some differences: for example article 8(2) talks about what is “necessary” as opposed to section 7 which looks at what is “reasonable” and can be “demonstrably justified”. However, there are similarities between these two sections which both place a limitation on the right to privacy, and in the case of the Charter, the other rights listed therein.

This case could therefore provide some guidance as to what is required to provide sufficient protection to individuals when limiting a right listed in the Charter.

The decision is available online at: http://www.bailii.org/ew/cases/EWHC/Admin/2012/1943.html

Tamsin Webster is a lawyer at Maddocks.