[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	England and Wales High Court (Administrative Court) Decisions
You are here: BAILII >> Databases >> England and Wales High Court (Administrative Court) Decisions >> Information Commissioner v Islington Borough Council [2002] EWHC 1036 (Admin) (24th May, 2002) URL: http://www.bailii.org/ew/cases/EWHC/Admin/2002/1036.html Cite as: [2002] EWHC 1036 (Admin)

[New search] [Printable RTF version] [Help]

Information Commissioner v Islington Borough Council [2002] EWHC 1036 (Admin) (24th May, 2002)

IN THE HIGH COURT OF JUSTICE
QUEEN’S BENCH DIVISION
DIVISIONAL COURT

		Royal Courts of Justice Strand, London, WC2A 2LL
		24th May 2002

Mrs Justice Hallett :

1. There is before the court an appeal by way of case stated by the Information Commissioner against the decision of Deputy District Judge Timothy Pattinson sitting at Highbury Corner Magistrates Court on 8^th February 2002. He dismissed on a submission of no case seven charges laid against the London Borough of Islington alleging the use for an unauthorised purpose of data held on a computer contrary to section 5 of the Data Protection Act 1984. Section 5 prohibits the unregistered holding and use of personal data. A valid registration must disclose the purpose or purposes for which data is held or used. Section 5, where relevant, reads as follows:

“(1) A person shall not hold personal data unless an entry in respect of that person as a data user … is for the time being contained in the register.

(2) A person in respect of whom such an entry is maintained in the register shall not

(a) hold personal data of any description other than that specified in the entry

(b) hold any such data or use any such data held by him for any purpose other than the purpose or purposes described in the entry…..

(3) A servant or agent of a person to whom subsection (2) above applies shall as respects personal data held by that person be subject to the same restrictions on the use, disclosure or transfer of the data…..

(5) Any person who contravenes subsection (1) above or knowingly or recklessly any of the other foregoing provisions of this section shall be guilty of an offence.”

2. The first charge alleged that the London Borough of Islington “on a day or days between 1^st June and 23^rd December 1999 being a person in respect of whom an entry as a data user was contained in the Data Protection Register did at New Municipal Offices 222 Upper St N1 knowingly or recklessly use personal data for a purpose namely Collection of Taxes and other Revenue, being a purpose other than the purpose described in the register, contrary to section 5 (2) 5(5) and 19(2) of the Data Protection Act.”
3. Each of the other charges was similar but the purposes were specified as “Accounting and related Services”, “General Insurance Administration”, “Investment Deposit Account Administration”, “Management of Agents and Intermediaries”, “Borrower or Credit account Facilities Administration”, and lastly “Collection of Rates”.
4. The factual background is not in dispute and the evidence was given by way of statements admitted pursuant to section 9 of the Criminal Justice Act 1967. In 1986 the London Borough of Islington was first registered to hold and process personal data for a number of purposes under different entries. Registration had to be renewed every 3 years. The registration for the purposes specified in each of the seven charges was renewed until June 1999. Despite reminder letters before and after the expiry date no application was received from the Council to renew registration for the seven purposes. Thus, during the period 1st June 1999 to 23^rd December 1999 the London Borough of Islington was not registered to hold or use data for these specific purposes. It remained registered for other purposes.
5. Mr Angus Hamilton is a solicitor practising from 42B Independent Place in London E8. In 1998 and 1999 both he and a colleague Mr Campbell were instructed to act for a client B. B was asked to produce proof of his council tax payments in support of an application for legal aid. B asked the council to send such proof to Mr Campbell at 42B Independent Place. The council recorded that address on their computer as B’s address and used it to send letters to B demanding payments of his council tax. Mr Hamilton, concerned that the address might appear on a list of debtors, repeatedly pointed out the error. He first did so by letter dated 29^th January 1999. Despite his threat to complain to the Information Commissioner, in November 1999 a summons was issued in respect of non payment of council tax to B care of Mr Campbell at 42B Independent Place.
6. On the 11^th November 1999 Mr Hamilton spoke to a council employee Ms Roy who accepted that there was no record of Mr Hamilton or Mr Campbell having authorised the use of the address for B. She insisted it must have existed or the records would not have been amended. She agreed the council had received his letter of complaint and taken no action. She told Mr Hamilton that his address was kept on file and correspondence sent to him in an attempt to prompt him to disclose a forwarding address for B. She was aware of the Council’s responsibilities under the Data Protection Act 1984. Mr Hamilton unaware of the failure to renew the registration complained to the Information Commissioner about breaches of “data protection principles”.
7. Mr Burden a registered Investigation Officer for the Data Commissioner confirmed that personal data had been used for the issue of a summons re non payment of council tax by B. He conducted interviews with Mr Bradley assistant Head of Finance for the Council on the 20^th March 2000. Mr Bradley was shown a copy of the Council’s registration under number K3060082. He agreed the registration was in respect of thirteen purposes (although on my calculations it related to only eleven different purposes). He also agreed that the registration for those purposes expired on 1^st June 1999. In fact, registration had lapsed for only seven of the purposes contained in it. The remaining four were covered by other entries. Still referring to the registration in respect of the so-called thirteen purposes, Mr Bradley accepted there was a need for registration before and after the 1^st June 1999. He was asked “was in fact data obtained and disclosures made to such bodies as per the registration after 1^st June 1999?” He said: “yes”. He accepted that the council’s computer record in relation to B indicated that data was processed after 1^st June in respect of council tax.
8. Mr Bradley apologised to Mr Hamilton and said that the matter was overlooked due to pressure of work and clerical error. Mr Frank Graney the then Finance Director dealt with the registration and he had left the council 2 or 3 years before without advising others that the registration required renewal. Mr Graney’s name appears on the registration documents as Finance Director. Mr Bradley said the council could find no trace of the reminder letters which may have been addressed to Mr Graney personally. They would have been acted upon had they come to the council’s attention. He assured Mr Burden that the council “regretted the lapse”, was fully committed to compliance with the Data Protection legislation and once the position was drawn to their attention took steps to “remedy the breach” and to ensure no re-occurrence. This is accepted.
9. On behalf of the respondent council it was and is submitted that at the close of the prosecution’s case there was insufficient evidence to found a case to answer on all seven charges.
10. Firstly in relation to charges two to seven, the Commissioner could have charged the council with “holding” the data, to which it would have had no defence. The Commissioner chose, however, to charge the Council with “using” the data. To “use” is different from to “hold”. Guidance was given as to the definition of the word “use” in R v Brown (1996) 2 Cr App R 72 “Use” must be given its natural and ordinary meaning i.e. to “make use of” or “employ for some purpose”. Proof that the data had merely been retrieved so that it appeared upon a computer screen would not be sufficient. In respect of charges two to seven the prosecution rested solely on the admissions made by Mr Bradley in interview. Mr Bradley was led into error by the nature of the questioning. He made a broad admission dealing with a number of purposes, some of which were covered by a proper registration. The Deputy District Judge was bound to consider these charges individually and the prosecution had simply failed to establish “use” by the council to the appropriate criminal standard on each of them.
11. In respect of the first charge where data was admittedly “used” to issue the summons to B, it was argued on the Council’s behalf that the prosecution had failed to establish the necessary mens rea. Despite having other options available to her under the statutory scheme, the Commissioner chose to charge an offence under subsection (2). This required proof of knowledge or recklessness. Knowledge was not alleged in this case. The definition of “recklessness” applicable to offences under the Data Protection legislation was provided by the Divisional Court in Data Protection Registrar v Amnesty International reported in 1995 Crim L R 633 and the Data Protection Encyclopaedia. Lord Justice Rose agreed with the proposition that to establish recklessness, the prosecution “must prove first that there is something in the circumstances that would have drawn the attention of an ordinary, prudent individual to the possibility that this act was capable of causing the kind of mischief that sections 5(2) and 5(5) are intended to prevent and that the risk of those mischiefs occurring was not so slight that the ordinary, prudent individual would feel justified in regarding them as negligible. Secondly the prosecution must prove that before doing the act, the defendant either failed to give any thought to the possibility of their being such a risk, or, having recognised that there was such a risk, he nevertheless went on to do it.”
12. It is the unauthorised use of the data, therefore, which must be reckless. Mr Davies QC argued that this meant the prosecution must prove that the council officer who used the computer for an unauthorised purpose to issue the B summons knew or should have known that the registration had expired. It is the action of the unauthorised user which is subject to the provision of section 5 not the omission of the officer or officers who failed to renew. There was no evidence the user knew or should have known of the failure to renew and there was therefore no case to answer.
13. Mr Davies developed the argument further in his submissions before us. He submitted that the offences created by section 5 did not give rise to vicarious liability. Liability under section 5 is placed upon the corporate person when there are individuals who are “controlling officers” who can be said to be the directing mind and will” of the corporate body or the “embodiment” of the company. Mr Graney the finance director had been responsible for registration and had left the Council without advising his successor of the Council’s duty under the Act. To the extent that a senior officer was fixed with the knowledge or sufficient knowledge of a failure to renew or react to correspondence as “reckless”, that person was no longer a part of the corporate entity when the need to renew arose. In other words in so far as Graney was reckless he was not part of the local authority when the alleged offence occurred.
14. Further, Mr Davies argued that when Mr Hamilton alerted the Council to the problems he was having, there was nothing in his complaints to alert any Council employee let alone the user of the material to the fact that there was another problem with data protection compliance namely non-registration. Mr Hamilton was concerned solely with a breach of the principles of Data Act protection not with the separate issue of non-registration.
15. It was accepted that a body corporate, the London Borough of Islington could be a person for the purposes of section 5 and could, therefore, act knowingly or recklessly. As far as proof of “use” was concerned Mr Riley on behalf of the Commissioner argued that Mr Bradley’s admissions in interview read as a whole, even if mistaken in some respects, amounted to sufficient evidence that data had been used for the purpose specified in each of the summonses. Mr Bradley then explained what had happened in an attempt to mitigate the offences he had admitted on behalf of the Council. The Council failed to put in place any proper or effective system to ensure compliance with their statutory duties and it was no defence to blame a systems failure for the breaches. If it were, this would defeat the effective operation and enforcement of the registration requirements of the Act and the intentions of Parliament.
16. Mr Riley submitted that the omission to renew the registration despite the reminder letters in the circumstances of this case was sufficient to constitute the necessary element of recklessness.
17. In the case stated the Deputy District Judge said that he applied the well-established principles set out in Galbraith 73 Cr App R 124. He asked himself whether a reasonable tribunal properly directed could convict upon the unchallenged evidence before him. In relation to summonses two to seven, he reminded himself that there is a separate provision for “holding” of data contrary to the Act. The charge here was “use” of the data. He found no specific reference to “use” of the data in the evidence and accordingly dismissed the charges.
18. As far as the first charge was concerned the use of the B data was admitted. The Deputy District Judge accepted that the council was capable of acting knowingly or recklessly, but found that the prosecution had failed to adduce sufficient evidence that it had knowingly or recklessly used the information. He wanted more evidence, he said, if the case was to proceed, that the council had deliberately shut its eyes to the obvious or refrained from enquiry because it suspected that it had failed to register and did not want to discover the truth.
19. He certified the following questions:
20. Was he right to conclude that there was no evidence of “use” in charges two to seven within the meaning of section 5 of the Data Protection Act 1984?
21. What weight should he have attached to the council’s having accepted their failure to register themselves for the 6 month period, given that in interview they accepted the need to be registered?
22. As far as B’s summons was concerned, was he right to find that an omission by a former employee to fulfil his duty was insufficient to found a case to answer?
23. In applying the test of recklessness, how should he have approached the “actions and inferred responsibilities of the Council as a body through its servants or agents past or present? Is an omission to act (in this case an omission to ensure registration or a systems failure) enough to constitute recklessness?”
24. Where an omission to act leads to the consequences that section 5 (2) (b) envisages are there any other consequences required before the prosecution can show that there is a case to answer?
25. With respect to the Deputy District Judge I find the formulation of the five questions posed unnecessarily complicated. I agree with Mr Davies that each case turns on its own facts and I prefer to return to the Galbraith test and the words of the section itself, The question for this court is, therefore, was there sufficient evidence upon which a reasonable tribunal properly directed to the criminal standard could find that the defendant council in relation to each summons had used data for the purpose set out therein and had done so knowingly or recklessly.
26. The Deputy District Judge was obliged to consider each charge separately. He had to ask himself in relation to each charge whether or not the use of data for the purpose alleged was properly established. I am satisfied that he was entitled to find that Mr Bradley’s rolled up admission in relation to the use of data for unspecified purposes was insufficient to found a case to answer. The admission was wrong both as to numbers and in so far as Mr Bradley purported to accept that data for the four registered purposes had been used unlawfully. I accept, therefore, that his answers were insufficiently precise to establish “use” of the relevant data for the specific purposes alleged in the charges.
27. Turning to the question of recklessness and the first charge, I am satisfied that there was sufficient evidence to meet the Galbraith test. The prosecution established that senior employees at the level of Director and or Assistant Director of Finance were aware of the council’s duties under the Data Protection Act and were responsible for ensuring compliance with the Act. The fact that Mr Graney had left the council by the time the registration expired is in my view irrelevant. At all times the council remained under a duty to ensure compliance with the Act and to ensure that it had a proper system in place to effect renewal of the registration. It was reminded of the need to do so. The council as an ordinary prudent “person”, through its officers, would or should have known that any use of the data it held, in the absence of renewal, would be in contravention of the Act. The council as a body had either given no thought to the risk of causing the mischief which section 5 was designed to prevent or having recognised such a risk nevertheless went on to act as it did.
28. In my judgment there was sufficient evidence that any use of data in November 1999 by a Council employee acting in the course of his or her employment must have been, at the very least, reckless on the part of the Council as a whole. I reject Mr Davies’ argument that the prosecution had to prove that the person who accessed the computer to send out the council tax summons to B acted recklessly. Such an approach would make it virtually impossible to hold a large organisation to account for the unlawful use of data knowingly or recklessly. It would effectively defeat the purpose of subsection (2). It is highly unlikely that any of the directing minds of a body corporate would be personally responsible for day to day administration such as sending out letters or arranging for the issue of a summons. It is also unlikely that the person responsible for doing so, at a lower level, would have any knowledge of the council’s status as far as registration is concerned. In my judgment the knowledge and actions of the directing minds of a corporate body must be taken together with the actions of those to whom administrative functions are delegated for the purposes of the section.
29. I therefore accept Mr Riley’s submissions on behalf of the Commissioner that the Deputy District Judge was wrong to dismiss the first charge at the close of the prosecution’s case.
30. The answers to the questions posed in the Case Stated are as follows:

Question 1: Yes.

Question 2: The question of what weight should attach to particular evidence is always a matter for the tribunal of fact. The Council’s admission of the need for registration and failure to renew the registration did not assist the prosecution on the question of actual use. The Council needed to register simply to hold the data.

Question 3: In deciding whether or not there was sufficient evidence of recklessness the Deputy District Judge was wrong to take into account solely Mr Graney’s failings.

Question 4: The evidence had to be considered as a whole to determine whether or not there was sufficient evidence that the Council through its responsible officers and employees had committed the offence in question. An omission to act in circumstances such as these may be sufficient to amount to recklessness.

Question 5: The court must be satisfied that the ordinary prudent individual would have been aware that there was a more than negligible risk of his act causing the kind of mischief sections 5(2) and 5(5) were intended to prevent.

31. Accordingly I am satisfied this case should be remitted to the Deputy District Judge to continue the hearing in relation to the first summons where use was admitted. In the circumstances, I make no order as to costs.

Lord Justice Kennedy :

32. For the council it was submitted to the Deputy District Judge at the close of the prosecution case that save in the case of B there was no sufficient evidence of use by the council of data for any of the purposes specified in the summonses, and the Deputy District Judge accepted that submission. It was further submitted that even in relation to the one summons relating to a purpose which was relevant in the case of B there was no sufficient evidence that the council acted knowingly or recklessly, and the Deputy District Judge said that more evidence was needed if he was to be satisfied that there was a prima facie case. He therefore dismissed all seven summonses.
33. In my judgment if a corporate body such as this council fails to renew a registration it can reasonably be inferred that it is aware of its omission, and that inference is re-inforced when, as in this case, the council, through the medium of its relevant offical, is specifically reminded of the need to renew and subsequently of the failure to do so. If thereafter the council, as a result of the actions of some other officer, acting within the normal course of his or her employment, uses data which should not be used when unregistered then, as it seems to me, the council must be found to have knowingly or recklessly contravened the prohibition on such user. The Deputy District Judge rightly accepted that “a body such as the defendant borough was capable of acting knowingly or recklessly”, and in my judgment there was ample evidence to show that, at least in relation to the B matter, this borough did so.
34. As to the evidence of use of data other than in relation to the B matter, I agree with the Deputy District Judge. The questions asked at the interview and the answers obtained were insufficiently precise to establish user in relation to any of the other specified purposes.
35. I would therefore agree with Hallett J. that the five questions should be answered as she has indicated, and that this case should be remitted to the Deputy District Judge to continue the hearing in relation to the one summons where the B evidence is relevant. The appellant did not seek any order as to costs, and I would therefore make no such order.