Lin & Anor v Commissioner of Police for the Metropolis [2015] EWHC 2484 (QB)

Case No HQ15X0311

[2015] EWHC 2484 (QB)

IN THE HIGH COURT OF JUSTICE

QUEEN'S BENCH DIVISION

Venue Royal Courts of Justice, Strand, London, WC2A 2LL

Date 25/08/2015

Before

MR JUSTICE GREEN

Between

(1) Zaw LinClaimants

(2) Wai PhyoClaimant

Commissioner of Police for the MetropolisDefendant

Gerry Facenna, Julianne Kerr Morrison, and, Nikolaus Grubeck (instructed by Leigh Day) for Claimants

Anya Proops, and, Christopher Knight (instructed by instructed by Directorate of Legal Services, Metropolitan Police Service) for Defendant

Hearing Hearing date: 21 st August 2015

Judgment

Mr Justice Green :

[1]This case concerns the application by two defendants facing capital charges in criminal proceedings in Thailand for disclosure to them of personal data held by the Defendant, the Commissioner of Police for the Metropolis (“MPS”). The data is contained in a confidential report (“the Report”) prepared by the MPS into a murder inquiry conducted in Thailand. The purpose of the Report was to enable the MPS to provide reassurance to the families of the victims about the investigation being conducted by the Thai authorities. The application is brought under section 7(9) of the Data Protection Act 1998 (“DPA 1998”).

[2]This matter has been brought before the Court on an urgent and expedited basis during the vacation. As of the present date the trial of the Claimants (who are the accused in the Thai criminal proceedings) in Thailand is ongoing having commenced in early July 2015. The prosecution has nearly completed presenting its case; the accused (the Claimants in these proceedings) will open their defence shortly and it is anticipated that the trial will continue until mid/late September 2015, when the court will adjourn to consider the evidence and arrive at verdicts. The decision is taken by a judge; there is no jury. I am told that the defence can tender evidence, which therefore includes any disclosure ordered as a result of these proceedings, until the end of their case.

[3]In order to address certain procedural issues arising I convened a case management hearing on 19th August 2015 and the substantive hearing was held on 21st August 2015. Judgement is now being given upon an expedited basis. I indicated to the parties at the case management hearing on 19th August 2015 that, having made enquiries myself by that stage and regardless of outcome, I would grant permission to appeal and that the Court of Appeal would hear any appeal very expeditiously in order that the final outcome of this case would be in time to enable any disclosure that was ultimately ordered to be assessed and placed before the Thai court, if that was considered appropriate. I took this view because the issues of both law and fact are complex, novel and difficult. The stakes are very high for both sides. For the Claimants they could hardly be higher: life or death. For the Defendant it has been urged upon me that an incursion by a court into the ability of the police, or of Ministers, to make promises of confidentiality to foreign authorities, could have substantial and adverse consequences for law enforcement and/or the fulfilment of public policy or security objectives.

[4]In order to explain my reasoning it has been necessary in this judgment to record the arguments of the accused in the Thai proceedings. I should make clear at the outset of this judgment that, in setting out arguments made by the parties and in particular the Claimants about the Thai criminal investigation and the proceedings, nothing that I say is intended to express any view by this Court whatsoever on the merits of the issues arising in the Thai courts or upon the conduct of those proceedings by the authorities there.

[5]On 19th November 2014 each Claimant submitted a subject access request to the MPS under section 7(9) DPA 1998 (set out below at paragraph [72]). They each sought disclosure of material held by the MPS in connection with its review. The MPS accepts that, prima facie, it does hold information (“personal data”) relating to the Claimants. However, it relied upon section 29 DPA 1998 (set out below at paragraph [74]) which permits access requests to be refused in certain defined circumstances relating to criminal law enforcement. In this case the MPS says that in preparing the Report: (i) it was processing the Claimant’s personal data for purpose of family liaison which it submits is a legitimate part of crime enforcement; and (ii), it was proportionate on the facts to withhold the data, even in a death penalty case.

[6]The MPS has confirmed that the total of the potentially relevant “personal data” is to be found in drafts of the final report and in one email from 2014. I shall refer throughout this judgment to this material generically as the “Disputed Information”, but I also refer to the “Report” to indicate the final version of the Report prepared by DCI Lyons and his team.

[7]With that introduction I turn now to the facts. (ii) The basic facts: the murders

[8]On 15 September 2014 two young British tourists, Hannah Witheridge and David Miller, were brutally murdered on the island of Koh Tao in Thailand. Hannah was also raped. The crimes made international news. The Claimants in this case – Zaw Lin and Wai Phyo – are Burmese nationals who were living in Thailand. They were arrested and charged by the Royal Thai Police (“RTP”) with the murders of Hannah and David. The Claimants confessed to these attacks both during interviews with the police and then later during a video recorded demonstration of how they acted before police officers. Later they were taken to the scene of the murders where they re-enacted the attacks this time with the world’s media in attendance. Later on the Claimants alleged that the confessions had been tortured out of them and the confessions have now been retracted. They have subsequently complained of the conduct of the prosecution and by the courts and they allege they cannot obtain a fair trial. If convicted the Claimants face the death penalty and indeed this is actively sought by the prosecution. The incident, but also the misgivings about the handling of the prosecution arising out of the Claimants allegations, has received worldwide coverage in the media. For obvious reasons the case is one of great sensitivity to the Thai authorities. (iii) The deployment of the DCI Lyons of the MPS to Thailand and the concerns expressed by the MPS about confidentiality

[9]The misgivings raised were sufficient for the Prime Minister to engage in discussion with the Prime Minister of Thailand with the consequence that the two reached agreement that The Commissioner of Police for the Metropolis (MPS) would send a team led by a senior officer to Thailand to conduct an independent inquiry. That senior officer was DCI Lyons. The legal basis for this cooperation was section 26 Police Act 1996. This empowers a police authority to provide advice and assistance to foreign police authorities and it includes a power to send police officers on a temporary basis to a third country to engage with such foreign authorities. The power can only be exercised with the express authority of the Secretary of State subject to such conditions as the Minister might consider appropriate.

[10]In the present case the authority granted by the Minister took account of the fact that Thailand maintained the death penalty and that in the absence of assurances about the possible punishment that might be imposed at the end of the trial the officers assigned to go to Thailand were to undertake, in essence, a listening or observer role. The authority emphasised the need to avoid “straying in the area of advice and support”. Evidence before the Court included that from Ms Cressida Dick, an Assistant Commissioner with the MPC seconded to the Foreign Office but at the time an Assistant Commissioner responsible for Specialist Crime and Operations. She has explained that because assurances about the death penalty were not forthcoming “…the s26 authority was prepared on the basis that the initial stage of his [DCI Lyons’s] deployment would be comprised of observational work which would serve the family liaison function, and the wider needs of the families”.

[11]In paragraph 15 of her witness statement Ms Dick has explained that “… the Commissioner of the RTP had sought and obtained express agreement from DCI Lyons at the outset that his observations of the deployment, as set out in the Report, would only be shared with the Miller and Witherbridge families, and would not be disclosed any further”.

[12]There are three further points which arise from this evidence. These are: that agreements of this sort are routine; that they are considered to be “essential”; and, that without them the engagement would simply not occur. The Assistant Commissioner thus explains that in her experience “… agreements of this kind are commonplace and essential where foreign governments and policing authorities provide us with access to their information, and vice versa, whether on an ad hoc or routine basis. I was content that DCI Lyons’s agreement was wholly appropriate, and it is my view that without such agreement, it would not have been possible for DCI Lyons’s team to achieve any of their objectives”.

[13]The purpose of the engagement was therefore not that the MPS could conduct its own investigation. Further, because the MPS will not, as a matter of as a matter of settled policy, assist foreign authorities to pursue investigations where there is a risk of the imposition of the death penalty, the purpose of the inquiry was also not to enable the MPS to provide advice to the Thai authorities. In further consequence the Report has not been provided to the Thai authorities.

[14]Nonetheless as is evident from the documents that I have read, the Thai authorities and the RTP cooperated fully with DCI Lyons and his team who were, in consequence, able to produce a comprehensive report on all aspects of the investigation. This has enabled the MPS to provide reassurance to the families of the victims. The RTP was of course fully aware of the reaction of the international media. The evidence of Ms Dick indicates that the Thai authorities were sensitive to the risk that a report might be used to engender further public criticism but also, and importantly, that it could if publicised prejudice the trial planned to be held in Thailand. This latter point was uppermost in the thinking of the MPS. Assistant Commissioner Dick was concerned that the MPS’s work could inadvertently prejudice the trial. She wished to ensure that any work undertaken by DCI Lyons and his team did not “become part of the Thai evidential chain”. Had this occurred it risked placing the MPS, its officers and the UK “… at extreme legal and reputational risk”. In paragraphs 18 and 19 of her statement Assistant Commissioner Dick states:

“18. It would be a significant and I believe a damaging step to provide the Report or parts of it to the suspects to use in their defence when we were not willing to give it to the Thai authorities. I believe that it would significantly undermine the Thai authorities’ relationship with UK law enforcement, if not the wider relationship between the two governments given the very high-profile nature of the case. In future cases, it would have a significant impact on Thai cooperation with UK police investigations and would affect the wide variety of cases where UK citizens, businesses and interests because drawn into the Thai criminal justice system, whether as victims, suspects, witnesses or family members. The reputation of UK policing and “Scotland Yard” in particular is very high internationally. This enables significant success and support around the world which benefits UK citizens and interests. I am concerned that the breach of trust involved in releasing the report in this manner would affect the UK police and MPS reputation beyond Thailand. 19. Whenever we approach sharing or receiving information internationally we will always consider the issue of confidentiality. If we do not receive the appropriate assurances about how our information will be treated within another country we cannot cooperate with them. Equally, we would not expect another agency in another country to cooperate with us if they did not receive the assurances they may receive about how their information may be used.”

[15]Later Assistant Commissioner Dick expressed the opinion that if the legal risks of deployment of teams abroad included the risk of subsequent disclosure pursuant to the DPA 1998 then this would: “… make it very difficult for the MPS to give assurances the foreign authorities require to preserve the integrity of their own criminal procedures”.

[16]Detective Superintendent John Sweeney of the Homicide and Major Crime Command in the MPS also gave detailed evidence but I will only summarise the overarching themes. He gave evidence about his extensive experience of arranging and conducting foreign engagements of this sort. He echoed the concerns of Assistant Commissioner Dick. He also gave evidence about the practical difficulties of securing deployment in foreign jurisdictions given that invariably the very reason why a deployment takes place is because the incident abroad is complex or controversial. This in turn invariably implies a high level of sensitivity on the part of the foreign authority as to the use to which any resultant report might be put; “acute diplomacy” is the order of the day and securing the trust of the foreign authorities is an important and often difficult task for the MPS. (iv) The Report of DCI Lyons

[17]DCI Lyons duly produced his Report and he gave a detailed verbal summary to the families

[18]I propose now to summarise the Report. I am conscious of the need not, in effect, to disclose the Report incidentally through this judgment. It is however necessary to say what I can about the Report because it lies at the heart of this case and because I should do what I can to explain to the Claimants (and also to the public) the basis of my judgment. In describing the Report I have therefore relied upon the evidence in the public domain given by the MPS itself as to the contents of the Report. I have also relied upon information as to its contents from press reports including press statements issued about the Report by the families via the Foreign and Commonwealth Office (“FCO”). I have, of course, had full sight of the actual Report and drafts thereof and all other material which contains “personal data” about the Claimants. I am clear that the description that I give below preserves confidentiality. DCI Lyons in his Witness Statement to the court provided a summary of the Report and that is the starting point. The Report sets out the background to the deployment of DCI Lyons and his team to Thailand. It records the misgivings that were circulating in the media about the investigation though of course the Report does not indicate that these misgivings were accepted. Instead of referring to the Report for details of these “misgivings” I can explain them by reference to material in the public domain in the form of press coverage and witness statements and other evidence placed before me in this case. Zaw Lin says in his statement that when he was arrested he was stripped naked and exposed to extremely cold air from an air conditioning unit. He says he was beaten, kicked and punched. He says that the police held a plastic bag over his head and neck to suffocate him. He says there were threats to kill him, electrocute him and burn him and he denies that he had a lawyer or translator present when interviewed and that he was deprived of food until he eventually signed a confession because he could not withstand any further mistreatment. Wai Phyo has also given a witness statement to this court. He makes the same complaints, in more or less identical language. These allegations are strenuously denied by the RTP. In referring to these allegations I reiterate: I am doing no more than recite evidence that is in the public domain. I can also refer to a letter from Mr Ross Allen, head of Consular assistance, the FCO, dated 27th November 2014 to Ms Maya Foa (who has given evidence in this case for the Claimants) of the Death Penalty Team at Reprieve. Mr Allen acknowledges the concerns of the Government about allegations of corruption and mistreatment of the accused and says that these concerns have been raised with the RTP. He explains that the Prime Minister had also had discussions with the Thai Prime Minister about the matter. He explains that because of these concerns “... we exceptionally agreed that a UK Police team should review the Thai investigation”. This I believe suffices to explain the background to the Report. The Report also refers to the fact widely reported in the press that the reconstruction of the crime scene had been insensitive to the families as had the release of photographs of the victims on the beach.

[19]The Report describes the victims and their characters in glowing terms: they were talented and blameless young people who were brutally murdered whilst on holiday.

[20]The Report summarises the evidence collected by the RTP. It includes summaries of physical evidence collection relating to the accused. It summarises the witness evidence relating to the movements of the accused and their activities. DCI Lyons makes the comments that “[a]s may be expected” (ie in a report which describes an investigation into a crime) “... much of this material also contains thepersonal details of third parties, namely witnesses, other identified individuals (including members of the families of Hannah and David), Thai police officers, translators and lawyers.” I have emphasised the words “as may be expected” because it highlights the point that in many respects what is being described in the Report is no more than the routine conduct of a serious crime investigation. This is not a Report which contains, for instance, state secrets.

[21]In his Witness Statement DCI Lyons describes his approach to the Report as being, in effect, one of studied neutrality. He says: “It is not, and was never intended to be, an attempt to present a case for or against any particular suspect. It is a summary of the RTP investigation, the evidence collected and the lines of enquiry pursued so far as we saw from our observations. It was my role to approach the RTP with an open mind, and this was the way in which I approached the drafting of my Report”.

[22]The Report describes the approach adopted by the MPS in preparing for its inquiry. It then addresses the details of the crimes. It chronicles the events leading up to the discovery of the bodies. The Report sets out in detail the steps taken by the RTP in investigating the crime and in pursuing suspects and leads. It provides an account of how evidence was collected such as the performance of mass DNA testing, the identification and retrieval of CCTV footage from across the island, and the retrieval and collation of cell phone data etc. It describes the autopsy results. It records the third party witness evidence collected.

[23]With regard to the accused the Report describes the events leading up to their arrest and it records their interviews including their confessions. In particular the Report makes reference to the fact that confessions were made at more than one time. DCI Lyons points out that he cannot comment upon the allegations made later that the confessions were procured by torture “in an open statement” but he does say that the accused repeated their confessions in court before the judge in the presence of their own lawyers. He also says that the accused have not adduced medical or other evidence which might corroborate their torture claim. I should add for the sake of completeness that the Claimants did not accept the accuracy of all of these statements.

[24]The report sets out in some detail relevant Thai criminal law procedures. It chronicles meetings with the families. It makes a very limited number of recommendations concerning matters of procedure and, for instance, in respect of the handling of relations with the families. It does not comment qualitatively upon the Thai investigation in any material sense.

[25]It is thus fair to say that in very large measure the Report is descriptive and contextual. It does not contain value judgments about the Thai authorities. Even where it does refer to the evidence that forms the core of the prosecution case it is largely general or merely summarises what is in documents which the MPS team were shown. Very roughly I estimate that the percentage of information contained in the overall Report which would amount to personal data which would even in principle be subject to disclosure under the DPA 1998 would be in single digits. It is apparent from the above that the preponderant part of the Disputed Information could not ever be subject to disclosure under the DPA 1998.

[26]The description that I have given above is of the Report as a whole; not the “personal data” therein. It will be clear however that the personal data that is found within the Report relates to the above matters. Of course it does not follow that in relation to any given, specific, item of personal data that it is necessarily a comprehensive or cogent piece of stand-alone evidence. (v) The submission of subject access requests under the DPA 1998 and subsequent events

[27]As I set out at the start of this judgment on 19th November 2014 each Claimant submitted a subject access request to the MPS under section 7(9) DPA 1998.

[28]In their Witness Statements before this court the Claimants have explained why they consider their applications to be valid. Each makes essentially the same points:(i) that the information contained in the Report might be incorrect;

(ii) that at the time the Report was prepared the accused had not then been shown any of the evidence that the MPS team had sight of;

(iii) that the MPS team had access to at least part of the case that the RTP was going to advance;

(iv) that the Report might contain information that was useful to the accused as part of their defences;

(v) that were many false statements made in the press about the accused and these might be perpetuated in the Report;

(vi) that these falsehoods might be given greater publicity if the Report was made public ie the information shared.

[29]Much of the reasoning is focused upon establishing that the Report must contain “personal data”. This is not now an issue in dispute. The MPS accepts that it does. The Claimants have endeavoured to clothe their arguments in the somewhat technical language of the DPA. It seems to me that the bottom line of these arguments, stripped bare of technical garb, can be put in two ways. First, the views of the MPS carry weight. Scotland Yard has an international reputation. If the Report is seen as favourable to the prosecution and contains material supportive of the RTP investigation (which is in effect how the Claimants say it has been presented in public by the families) then they should have the right to see the personal data so they can correct any misapprehensions. Secondly, that in any event they should be able to use any personal data which is favourable to their defence.

[30]The MPS refused the requests upon the basis that the Disputed Information that was held by the MPS which would otherwise be subject to disclosure was exempt from disclosure under section 29 DPA 1998. This provides an exemption from disclosure in relation to data relating to criminal enforcement activities. In a letter of 19th December 2014 the MPS contended that: the UK officers deployed to Thailand had not conducted any investigation into the murders; that the Thai authorities permitted the MPS officers to have observer status only; that the MPS did not provide advice or assistance to the RTP; that the MPS did not take physical possession of any evidence; that the RTP provided to the MPS an interpreter who translated some of the documents for the MPS; that the MPS subsequently visited the families of the deceased to explain verbally limited aspects of the investigation as well as the judicial process in Thailand; that none of the MPS officers conducted or participated in or assisted in any witness interviews nor were present during interviews; that the officers did not take photographs or measurements of any crime scene; and that no officers conducted, assisted or observed any test or analysis carried out.

[31]The MPS sent letters dated 23rd December 2014 to the Claimant’s legal representatives in which it was stated that disclosure would be likely to prejudice the prevention and detection of crime and/or the apprehension or prosecution of offenders.

[32]The position of the Claimants as now pleaded in the Particulars of Claim can be summarised in the following way. The Claimants are concerned that because of the very high profile nature of the case they risk not receiving a fair trial in Thailand. They refer to media coverage which is, they submit, hostile to them. In particular they cite the public reaction of the families of the victims to the report given to them by the MPS. Specifically they refer to the fact that the FCO issue a joint statement on behalf of the families on 6th December 2014 in which the families said they were confident in the work carried out by the Thai authorities and that from what they had seen the suspects had a difficult case to answer. The statement included these words:

“the evidence against them appears to be powerful and convincing”

. The statement however also says this:

“They [i.e. the accused] must respond to these charges and their arguments must be considered with the same scrutiny as those of the prosecution…”

The Claimants also cite the public reaction of the Thai authorities to the favourable response given by the families following receipt of the MPS verbal summary:

“Relatives of the deceased in the UK have stated that they are confident in the evidence in the Koh Tao case and the evidence was clear beyond a shadow of a doubt”

. This material was covered in the Thai press.

[33]They submit that having access to their own personal data would not undermine the prosecution but would remove or reduce the risk of prejudice of unfairness created by the MPS sharing the Claimants’ personal data with the families and the dissemination of the gist of the report into the public domain. They say that they could correct inaccuracies in that data. (vi) The issue

[34]The action is brought under section 7(9) DPA 1998. The action raises an important point about the extent to which police authorities, which are cooperating with foreign police authorities, either to further the latter’s inquiries or to gather information for their own purposes, must make the fruits of their labour available in so far as it contains personal data which falls within the scope of the DPA 1998.

[35]The relevant legal framework which governs this question derives from both EU and domestic law; and there is also a strong input from the European Convention on Human Rights (“the Convention”). The relevant EU measure is Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard tothe processing of personal data and on the free movement of such data (“The Directive”). The domestic implementing measure is the DPA 1998.

[36]The dispute between the parties boils down to a relatively narrow compass which concerns the powers of the MPS to withhold data. In short there is significant common grounds between the parties which means that it is agreed that prima facie the Claimants are entitled to disclosure of personal data about them contained in the Disputed Information unless the MPS can invoke an exemption from disclosure. It is thus common ground that:(i) the MPS is a data controller within the meaning of section 1(1) DPA 1998;

(ii) the Claimants are data subjects within section 1(1) of the Act;

(iii) the Disputed Information contains some material that amounts to personal data; and

(iv) but for the operation of any exemption the MPS would be bound to disclose to the Claimants that personal data. The issue thus turns on whether the MPS has a lawful right to refuse access. The Directive in two places (Articles 3 and 13) sets out that it does not apply to matters outside the scope of EU law (which in large measure includes international criminal law enforcement matters) and in any event even where EU law applies Member States are empowered to introduce into national law exemption from disclosure based upon (loosely) considerations of criminal law enforcement. The heart of the dispute in this case is about whether, on the facts of this case, the MPS was entitled to withhold access.

[37]I should at this stage briefly address a concern that the Claimants have about the identification by the MPS of specific items of “personal data” in the Report. In oral argument Mr Facenna for the Claimants submitted that I should be sceptical of the claim by the MPS that the amount of personal data in the Report was small. I heard submissions about the scope and effect of sections 1 and 2 DPA 1998. Mr Facenna in particular submitted that a Report that was about a crime allegedly committed by the two Claimants should in very large measure be treated as personal data, more or less in its entirely. He referred me to the Guidance issued by the Information Commissioner “Determining what is personal data”. On pages 16 and 17 the following is stated: “It is important to remember that it is not always necessary to consider ‘biographical significance’ to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is ‘obviously about’ an individual. Alternatively, data may be personal data because it is clearly ‘linked to’ an individual because it is about his activities and is processed with the purpose of determining or influencing the way in which that person is treated. You need to consider ‘biographical significance’ only where information is not ‘obviously about’ an individual or clearly ‘linked to’ him. When considering ‘biographical significance’, what is important is whether the data go beyond recording the individual’s casual connection with a matter or event which has no personal connotations for him. Does the processing of this data affect, or is it likely to affect, the individual? Data may, for example, have personal connotations for an individual if it provides information about an individual’s whereabouts or actions at a particular time. Example Where an individual is listed as an attendee in the minutes of a meeting then the minutes will have biographical significance for the individual in that they record the individual’s whereabouts at a particular time. The fact that an individual attended the meeting will be personal data about that person. However, this does not mean that everything in the minutes of that meeting is personal data about each of the attendees. Example Where an individual is listed as an attendee in the minutes of a meeting then the minutes will have biographical significance for the individual in that they record the individual’s whereabouts at a particular time.

[38]I do not go so far as to construe the whole Report as constituting personal data. Whilst it is correct that it was compiled after the Claimants were arrested as suspects it is nonetheless a report about an investigation as a whole and it contains a good deal of information about matters which are not directly or indirectly about the Claimants. It is possible that the MPS has erred on the side of caution, rather that adopting an expansive interpretation of personal data. In the extremely limited time available I have not been able to perform a very detailed item by item analysis of the exact and true parameters of the personal data. But I have been very alive to the fact that the identification on the part of the MPS might, in all good faith, be conservative and I have certainly borne this in mind when reviewing the actual evidence and have, as I explain more fully below, given the Claimants the benefit of the doubt where I have been uncertain. B. The procedure to be adopted to determine the dispute

[39]The issue that I have to decide gives rise to troubling and significant problems of procedural fairness. I have been provided with a copy of the Disputed Information on a closed basis for my inspection, in other words it has been shown to me but not to the Claimants or their representatives. I have power under section 15(2) DPA 1998 to receive information which is not shown to the Claimants. This provides: E+W+S+N.I. “(2) For the purpose of determining any question whether an applicant under subsection (9) of section 7 is entitled to the information which he seeks (including any question whether any relevant data are exempt from that section by virtue of Part IV) a court may require the information constituting any data processed by or on behalf of the data controller and any information as to the logic involved in any decision-taking as mentioned in section 7(1)(d) to be made available for its own inspection but shall not, pending the determination of that question in the applicant’s favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery (or, in Scotland, recovery) or otherwise.”

[40]Section 15(2) thus empowers me to “inspect” the information in issue but I have no power to compel the MPS to provide it to the Claimants. The MPS has moreover made it very clear that it will not provide the Report voluntarily to the Claimants.

[41]Prima facie, if the MPS is correct and the material is immune from disclosure because of a statutory exemption then it would defeat the purpose of the statutory exemption if the Claimants were to be given sight of the material for the purposes of advancing their arguments.

[42]On the other hand if the Claimants are denied access they are hindered in their ability to advance arguments both in rebuttal of those advanced by the MPS and, equally, to advance a positive case as to the probative and forensic value of the data to their defence. The issue before me is unlike a traditional PII application brought in the course of criminal proceedings where the court, if it considers that the material the prosecution wishes to withhold from disclosure (eg about an informant) would be of value to the defence, can in effect put the prosecution to an election: disclose or withdraw. In the present case I do not have the prosecution in the Thai proceedings before me and do not have power to put them to that election and of course they do not possess the personal data anyway. The present case is also unlike the closed material hearings that occur in security and terrorism cases in this jurisdiction where special advocates may be instructed to appear to represent the interests of the accused.

[43]I note that the Court of Appeal in Durant v Financial Services Authority

[2003] EWCA Civ 1746

(“Durant”) was also shown the disputed information in issue is that case (cf at paragraphs [2] and [12]) and it was the subject of witness statement evidence from officials within the FSA. No particular procedure seems to have been adopted to enable the applicant to advance submissions cognisant of the content of the Disputed Information. However the facts of that case were a very far cry indeed from those before me.

[44]I cannot, in these proceedings, ignore the fact that this is a death penalty case. I confess to profound unease at a procedure whereby a disclosure exercise is being conducted with the accused arguing with their eyes covered. It was essentially for this reason that I convened the case management hearing on 19 August 2015. At that hearing the following became clear: - First, the MPS is adamant that it will not disclose the Disputed Information to the Claimants or their legal advisers on a voluntary basis (even subject to a confidentiality ring) and I cannot compel them to do so. Mr Facenna for the Claimants in any event expressed his disquiet at the prospect of being in such a ring (had it been offered). He pointed out that whilst such cases were common place in commercial and regulatory litigation this being a death penalty case the inability to take instructions from his clients or their legal advisers in Thailand and the potential conflict of interest that might arise if he had to gve an undertaking to this court and could not therefore communicate freely with his clients, were very troubling limitations. It was one thing to be in a ring with a limited ability to take instructions in a commercial or regulatory case but quite another to be so in a death penalty case. In any event because the MPS was not prepared to release the Disputed Information (as was their right) this option was academic. - Secondly, Ms Proops for the MPS submitted that pursuant to section 15(2) DPA 1998 if I had serious questions to pose about individual items of information then I could do so in a closed hearing which would entail the public and the Claimants being excluded from the court room. She submitted that my right to question the MPS was a necessary concomitant of the right of “inspection” which the court had under section 15(2). I agree that in principle this must be so. If I have the right to inspect the Disputed Information that must imply a right to seek assistance so as to be able to understand it. For instance if the Disputed Information had been expressed as an algebraic formula it might have made little sense to me unless I could seek an explanation of it. Mr Facenna submitted however that the right to “inspection” was just that - a limited right for a judge to inspect, and it did not carry with it a further right to seek explanations and clarifications from the representatives of the authors of the information. He also submitted that there was no express power in the DPA 1998 for any form of closed procedure to take place. In my judgment the Court has an implied power flowing from section 15(2) to seek clarification from the representatives of the authors of the material but also the inherent jurisdiction to seek clarification as to the evidence before it. I do not therefore accept Mr Facenna’s analysis. I do however have an objection to using a closed procedure from the perspective of natural justice, heightened in a case such as this involving the death penalty. I can conceive of little which is more inimical to the perception and practice of open and fair justice than that the Judge should be alone in a court with a State body discussing whether a death penalty accused should receive or be denied (potentially relevant) disclosure in circumstances where the lawyers of the accused were excluded from the dialogue. This is especially so when the essential nature of the information being discussed is not, for instance, related to terrorism or national security but, on the contrary, is common place summaries of routine criminal procedures – it is not sensitive material per se. For this reason I was not attracted to the notion of any sort of closed procedure. - Thirdly, it was submitted by both parties that if I were really concerned that there was injustice which I was incapable of addressing myself then I should consider the appointment a special advocate who could appear to represent the interests of the accused. I gave serious consideration to this. If this case had not been so urgent I would have considered this option more closely. No suggestion was however made by the Claimants that the Court should appoint a special advocate it being considered that there was no clear power so to do. At all events given the urgency and the time constraints there was no basis upon I could sensibly have delayed this hearing given the progress of the trial in Thailand, the urgent need for me to hear the case and deliver a judgment, and the equally urgent need for the losing party to have a chance to pursue an appeal and therefore for the Court of Appeal to have time to convene and determine any appeal.

[45]I ultimately came to the conclusion that, given the exigencies of the situation, the best way to proceed was for me to raise any questions and queries that I had about individual pieces of information contained in the Disputed Information in open court articulating my queries and questions in the abstract ie without disclosing the specific information in issue. This way Mr Facenna could at least (I hoped) respond by reference to my generic description of the information and according to principle. Further, I sought to mitigate further possible prejudice to the accused by seeking to accord to them the benefit of any doubt that there might exist. The performance of this actual task was however complicated by two matters. First, the Claimants have not put before the Court any information as to the state of play in the Thai proceedings. I am told that communicating with the Thai lawyers (who work pro bono) is difficult and that, not being able to see the Disputed Information, the Claimants did not consider it would be meaningful to the Court to have a comparison. Nonetheless for the purpose of assessing whether any personal data might be useful in the context of the defence it has made life much more difficult that I know very little indeed about the actual Thai proceedings. Secondly, Ms Proops objected to my even attempting to pose in abstract terms questions to Mr Facenna for him to answer about the relevance of what might be in the Report to the defence in the Thai proceedings. When I said to her that I had no intention to letting the cat (ie the Report) out of the bag but that I could see no objection to putting before Mr Facenna the odd hair from its back she nonetheless said that even a highly limited and (frankly) innocuous disclosure like this would be objectionable and contrary to section 15(2) DPA 1998. I invited Mr Facenna to identify (over the lunch adjournment) the information that was now in the public domain about the prosecution case (which was nearing completing in the Thai proceedings) and as to the evidence that was in fact in the possession of the Claimants. This proved not to be possible.

[46]For the record I consider that the way in which I have been required to form a judgment in this case to be deeply unsatisfactory. In a future case which involves analogous sensitivities (which of course not all DPA 1998 cases will do) a consideration of the procedure to be adopted should occur well before the actual hearing; the onus must be on the parties to address this at the earliest possible stage. C. Relevant legal framework

[47]I turn now to the legal context. In this section I set out the relevant legislative and legal framework. There are two sets of legislative measures which are of prime relevance to the dispute, namely the Directive and the DPA 1998. The latter is the first port of call with the former existing as a source of guidance as to the construction of the DPA 1998. The Convention arises because it has been prayed in aid by the Claimants, in effect, to stiffen the sinews of the Court in the application of any necessity or proportionality weighing exercise.

[48]The parties advanced detailed written and oral submissions about the correct approach to be adapted to the construction of the DPA in the light of the Directive and the Convention. There are a number of points of difference between the parties. These focus upon the scope and effect of section 29 DPA 1998. First, the Claimants submit that personal data obtained for the purposes of a report used for family liaison purposes does not fall within the scope of the exception in section 29 DPA 1998; whereas the MPS submit that construed purposively it does. Secondly, the MPS submit that viewed literally section 29 DPA 1998 does not involve a weighing or proportionality exercise which requires it to weigh the importance of its public policy in not disclosing against the Claimants’ public policy in disclosure. On this occasion the MPS does not favour a broad purposive construction and the Claimants do. I therefore need to set out my conclusions on the correct way in which to construe section 29. (i) Common law principles of construction: Application of anxious scrutiny to the facts under the common law

[49]In my view not much actually turns upon an invocation of broader principles of EU or Convention law. I do not consider that there is a need for the sinews of the Court to be stiffened. In my judgment the common law, and in particular the principles of natural justice and fairness, would in a case such as this which involves the right to life, and the right to a fair trial, as well as powerful countervailing issues of public interest, compel the court to apply the most intense level of anxious scrutiny to the facts to ensure that the accused were not prejudiced. In my view the common law leads inexorably to a purposive construction of section 29 DPA 1998 which permits of intensive scrutiny of all relevant interests arising and which injects a proportionality exercise into the weighing process. The common law takes account of context and adjusts accordingly.

[50]In Kennedy v Information Commissioner

[2014] UKSC 20

AC 455 the Supreme Court (at paragraphs [56], [92], [132] and [136] concluded that the strictness of a proportionality review would not materially differ depending upon whether a case was brought under the EU law. Lord Mance stated: “The common law no longer insists on the uniform application of the rigid test of irrationality once thought applicable under the so-called Wednesbury principle... The nature of judicial review in every case depends on the context” (ibid. paragraph [51]).

[51]In Pham v Home Secretary

[2015] UKSC 19

;

[2015] 1 WLR 1591

the observations about the common law in Kennedy were endorsed (at paragraphs [59], [60], [98] and [108] - [110]. Lord Carnwath observed (ibid. paragraph [60]) that the intensity of a judicial review and the weight to be accorded to a decision maker were context driven and that such considerations “apply with even greater force ... where the [act in question] concerns the removal of a status as fundamental [in law] ... as that of citizenship.” In other words the more important the fundamental right being potentially intruded upon the greater and more intensive the level of judicial scrutiny. It is perfectly plain from both Kennedy and Pham that the common law, EU law and the Convention can walk side by side when protecting rights.

[52]The present case is not a judicial review. It is nonetheless a determination by this court of the legality of the decision of a public body. The mere fact that the DPA 1998 mandates a different procedure to that of judicial review cannot in my view make a difference; form cannot triumph over substance. The key point is that this Court is determining the legality of the decision of a public body and that the facts and issues arising engage very important fundamental rights. (ii) The Directive: Relevant principles of interpretation

[53]I should add that ultimately both parties agreed that under the common law an intensive review of the relevant public interests arising was fully justified and that there was most unlikely to be any real difference to outcome based upon a common law, Convention based or EU driven approach to construction.

[54]Nonetheless, I will address the main points of EU law arising. The practical relevance of this argument arises because the MPS argues that the facts of the present case do not engage EU or Convention law at all and since the DPA 1998 was adopted to implement the Directive that is highly relevant to the interpretation of the DPA 1998. In particular no reliance could be placed on EU law or the Convention to assist the Claimants.

[55]The DPA 1998 was introduced in order to implement the Directive. As a measure implementing EU law it must, so far as possible, be construed in conformity with the Directive so as to achieve its purpose. See for a detailed summary of the relevant principles of interpretation and its limits: R (Nutricia Ltd) v The Secretary of State for Health

[2015] EWHC 2285 (Admin)

at paragraphs [114] – [120]. In Campbell v. MGN

[2002] EWCA Civ 1373

;

[2003] QB 633

(“Campbell”), Lord Phillips of Worth Matravers, MR, said at paragraph [96]: "In interpreting the Act it is appropriate to look to the Directive for assistance. The Act should, if possible, be interpreted in a manner that is consistent with the Directive. Furthermore, because the Act has, in large measure, adopted the wording of the Directive, it is not appropriate to look for the precision in the use of language that is usually to be expected from the parliamentary draftsman. A purposive approach to making sense of the provisions is called for.

[56]In the present case, submits the MPS, even though the DPA 1998 was indeed introduced to implement the Directive, the facts have nothing at all to do with EU law. In their written submissions the MPS submitted that the Directive was about the completion of the internal market and that fact provided an important backdrop against which to measure the Claimants’ application which was about criminal proceedings in Thailand which it was said was about as far away from the internal EU market as it was possible to be. In their skeleton argument they submitted:

“The presence of the MPS in Thailand and the production of the Report as a result, was an activity in the area of criminal law and public security. Moreover, these activities fell squarely outside the scope of Community law. The European Community has no competence over the relationship and cooperation between police forces of Member States and non-member States. Whilst some inter-Member State enforcement activity falls within the scope of Title VI (referred to in article 3(2) (police and judicial cooperation in criminal matters), it makes no provision for interactions with non-Member states [Title V relates to the EU’s common foreign and security policy provisions]. For the avoidance of doubt although article 3(2) refers to the scope of Community law, nothing in the subsequent Treaty on the Functioning of the European Union, or the Treaty on European Union would require any different answer, even if article 3(2) were to be read more broadly as relating to the scope of Union law.”

[57]In relation to the Convention (and therefore the Directive which is in large measure intended to reflect

Article 8 of the Convention

) Ms Proops relies upon the judgment of the Supreme Court in R(Sandiford) v Secretary of State for the Foreign and Commonwealth Affairs

[2014] UKSC 44

;

[2014] 1 WLR 2697

(“Sandiford”) which, she submitted, showed that a state’s jurisdictional competence under the Convention was primarily territorial. I do note that this case is not exclusively extra-territorial: the victims were British and their families are based in this jurisdiction; the statutory authority for the MPS to engage with the Thai authorities was under a domestic statute and was between a Minister in this jurisdiction and the MPS also in this jurisdiction; the Report is physically in this jurisdiction; the briefing to the victim’s families occurred in this jurisdiction. Because of my conclusion that the common law affords no lesser protection than EU law or the Convention it is not necessary for me to determine the correctness of the argument advanced by the MPS. I will however address only one issue which concerns the extent to which the Directive (and ergo the DPA when construed to as to achieve the purpose of the Directive) is premised upon fundamental rights.

[58]First, the Directive has multiple objectives only one (and not the most important) of which is focused upon the internal market. Critically, the Directive is also about wide ranging fundamental rights. This is manifest from the recitals to the Directive. Recitals 1-3 of the Directive refer to a range of social and human rights as well as economic desiderata as justifying the measure:

“(1) Whereas the objectives of the Community, as laid down in the Treaty, as amended by the Treaty on European Union, include creating an ever closer union among the peoples of Europe, fostering closer relations between the States belonging to the Community, ensuring economic and social progress by common action to eliminate the barriers which divide Europe, encouraging the constant improvement of the living conditions of its peoples, preserving and strengthening peace and liberty and promoting democracy on the basis of the fundamental rights recognized in the constitution and laws of the Member States and in the European Convention for the Protection of Human Rights and Fundamental Freedoms; (2) Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy, and contribute to economic and social progress, trade expansion and the well-being of individuals; (3) Whereas the establishment and functioning of an internal market in which, in accordance with Article 7a of the Treaty, the free movement of goods, persons, services and capital is ensured require not only that personal data should be able to flow freely from one Member State to another, but also that the fundamental rights of individuals should be safeguarded …”

[59]Article 1 spells out that the objective of the Directive is conceived broadly with “fundamental rights and freedoms” of which the “right to privacy” is an illustration:

“Article 1 Object of the Directive 1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. 2. Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1.”

Object of the Directive

[60]It follows that the Directive must be construed with the broad range of fundamental rights well in mind. These are not to be narrowly construed. I do not think that (and setting aside for the moment the MPS’s argument about the lack of a territorial nexus between the facts of the present case and the Directive) it can be argued that in construing the Directive and therefore implementing legislation such as the DPA 1998 one can simply ignore as irrelevant rights as fundamental as the right to life, which is engaged in this case.

[61]And even if the Directive were to be construed (artificially) with only privacy in mind that would still lead to a broad and purposive construction. In Campbel (ibid) Lord Philips MR stated at paragraph [73] that the legislation was to protect individuals against “prejudice” flowing from the processing of their personal data:

“The Directive was a response to the greater ease with which data can be processed and exchanged as a result of advances in information technology. Foremost among its aims is the protection of individuals against prejudice as a consequence of the processing of their personal data, including invasion of their privacy…” (Emphasis added)

(Emphasis added)

[62]The 41st recital to the Directive emphasises the right of an individual to verify the accuracy of data relating to him. The Court of Justice has linked this right of verification with the fundamental right to a private life (under Article 8) which is materially wider than the right to privacy. In Cases C- 141/12 & C-372/12 YS v Minister voor Immigratie (17th July 2014) the European Court of Justice emphasised, at paragraph [44] and by reference to this recital, that:

"the protection of the fundamental right to respect for private life means ... that that person may be certain that the personal data concerning him are correct and that they are processed in a lawful manner"

. This was cited by Dingemans J with approval in Kololo v MPS

[2015] EWHC 600 (QB)

;

[2015] 1 WLR 3702

at paragraph [22]. The right to private life under Article 8 can indeed extend to a wide range of private interests. It has in some cases before the Strasbourg Court been linked to Articles 2 and 3: See eg MC v Bulgaria

(2005) 40 EHRR 20

paragraphs [150] – [153]) which linked the right to private life under Article 8 to the protection of a person’s physical integrity and the thoroughness of police investigations.

[63]So far I have focused upon the rights of individuals against the state; but the Directive also recognises that states have important rights which may trump the individual’s rights. Article 3 of the Directive defines the “scope” of the Directive but importantly recognises exceptions thereto including in relation to “criminal law”: “Scope 1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system. 2. This Directive shall not apply to the processing of personal data: - in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law, - by a natural person in the course of a purely personal or household activity.” (An issue arose between the parties as to whether the reference in Article 3 to criminal law was a reference to it simply being outside the scope of EU law ratione materiae; or whether it was referring to a self-contained exception even if it was within the purview of EU law. In this regard questions arose as to how Article 3 was to be construed given that since the adoption of the Directive, EU law has evolved and assumed responsibility for certain aspects of criminal law. I have not in this judgment however considered it necessary to examine this complex issue).

[64]Recital 13 is in the following terms: (13) Whereas the activities referred to in Titles V and VI of the Treaty on European Union regarding public safety, defence, State security or the activities of the State in the area of criminal laws fall outside the scope of Community law, without prejudice to the obligations incumbent upon Member States under Article 56 (2), Article 57 or Article 100a of the Treaty establishing the European Community; whereas the processing of personal data that is necessary to safeguard the economic well-being of the State does not fall within the scope of this Directive where such processing relates to State security matters…”

[65]Finally, Article 13 provides a broad and free standing exception for criminal law enforcement activities. The basic rights granted to citizens to obtain access to data are set out in, inter alia, Article 6 (relating to data quality) Article 10 (information to be given to data subjects) Article 12 (the data subjects right of access to data) and Article 21 (the duty on Member States to publicise their data production activities). Article 13 empowers Member States to introduce domestic legislation creating exceptions in certain identified areas which includes criminal law enforcement. In relevant part it provides:

“Article 13 Exemptions and restrictions 1. Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measure to safeguard: (a) national security; (b) defence; (c) public security; (d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;…”

Exemptions and restrictions

[66]The Directive thus in two places provides exceptions of exemptions for “the activities of the State in areas of criminal law” (Articles 3), and “the prevention, investigation, detection and prosecution of criminal offences” (Article 13).

[67]I should also mention the recent judgment of the Supreme Court in R(Catt) v Association of Chief Officers of England & Wales

[2015] UKSC 9

;

[2015] AC 1065

(“Catt”). This is significant because it makes clear that there are important policy considerations on both sides of the public interest equation when it comes to balancing police interest with those of individuals. Lord Sumption held, in relation to the DPA 1998, that it provided a comprehensive scheme of enforcement and regulation which reflected, not just EU law, but also the Convention:

“8. The exercise of these powers is subject to an intensive regime of statutory and administrative regulation. The principal element of this regime is the Data Protection Act 1998. The Act was passed to give effect to Directive 95/46/EC on the protection of individuals with regard to the processing of personal data… a harmonisation measure designed to produce a common European framework of regulation ensuring a "high level of protection" satisfying (among other standards) article 8 of the Convention: see recitals 10 and 11. On ordinary principles of statutory construction the Act will as far as possible be interpreted in a manner consistent with that objective.”

[68]Later in paragraph [12] Lord Sumption stated:

“12. The Data Protection Act is a statute of general application. It is not specifically directed to data obtained or stored by the police. But it lays down principles which are germane and directly applicable to police information, and contains a framework for their enforcement on the police among others through the Information Commissioner and the courts. It deals directly in section 29 and in Schedule 2, paragraph 5 with the application of the principles to law enforcement. The Data Protection Principles themselves constitute a comprehensive code corresponding to the requirements of the EU Directive and the Convention.”

[69]Where does all of this lead to? It leads simply to the conclusion that when construing the DPA 1998 (whether through common law or European eyes) decision makers and courts must have regard to all relevant fundamental rights that arise when balancing the interest of the State and those of the individual. There are no artificial limits to be placed on the exercise. (iii) DPA 1998

[70]I turn now to the DPA 1998. Section 1(1) DPA defines “personal data” as ““personal data” means data which relate to a living individual who can be identified—(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual…”

[71]Section 2 makes clear that there can be a subset of “personal data” comprising “Sensitive personal data” which may be confidential because it consists of information as to “...the commission or alleged commission [of a person] of any offence” or “... any proceedings for any offence committed or alleged to have been committed by [that person]”. Mr Facenna pointed out that simply because information held by the police related to crime was not a reason for it to be treated as sacrosanct and immune from disclosure.

[72]Section 7 DPA sets out the basic provision governing the rights of data subjects to access of personal data: “Right of access to personal data.E+W+S+N.I.(1) Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled - (a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller, (b) if that is the case, to be given by the data controller a description of— (i) the personal data of which that individual is the data subject, (ii) the purposes for which they are being or are to be processed, and (iii) the recipients or classes of recipients to whom they are or may be disclosed, (c) to have communicated to him in an intelligible form— (i) the information constituting any personal data of which that individual is the data subject, and (ii) any information available to the data controller as to the source of those data, and (d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.

(2) A data controller is not obliged to supply any information under subsection (1) unless he has received— (a) a request in writing, and (b) except in prescribed cases, such fee (not exceeding the prescribed maximum) as he may require.

(3) Where a data controller— (a) reasonably requires further information in order to satisfy himself as to the identity of the person making a request under this section and to locate the information which that person seeks, and (b) has informed him of that requirement, the data controller is not obliged to comply with the request unless he is supplied with that further information.

(4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless— (a) the other individual has consented to the disclosure of the information to the person making the request, or (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.

(5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.

(6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to— (a) any duty of confidentiality owed to the other individual, (b) any steps taken by the data controller with a view to seeking the consent of the other individual, (c) whether the other individual is capable of giving consent, and (d) any express refusal of consent by the other individual.

(7) An individual making a request under this section may, in such cases as may be prescribed, specify that his request is limited to personal data of any prescribed description.

(8) Subject to subsection (4), a data controller shall comply with a request under this section promptly and in any event before the end of the prescribed period beginning with the relevant day.

(9) If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.

(10) In this section— “prescribed” means prescribed by the Secretary of State by regulations; “the prescribed maximum” means such amount as may be prescribed; “the prescribed period” means forty days or such other period as may be prescribed; “the relevant day”, in relation to a request under this section, means the day on which the data controller receives the request or, if later, the first day on which the data controller has both the required fee and the information referred to in subsection (3).

(11) Different amounts or periods may be prescribed under this section in relation to different cases. (a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller, (b) if that is the case, to be given by the data controller a description of— (i) the personal data of which that individual is the data subject, (ii) the purposes for which they are being or are to be processed, and (iii) the recipients or classes of recipients to whom they are or may be disclosed, (c) to have communicated to him in an intelligible form— (i) the information constituting any personal data of which that individual is the data subject, and (ii) any information available to the data controller as to the source of those data, and (d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking. (b) except in prescribed cases, such fee (not exceeding the prescribed maximum) as he may require. (a) reasonably requires further information in order to satisfy himself as to the identity of the person making a request under this section and to locate the information which that person seeks, and (b) has informed him of that requirement, the data controller is not obliged to comply with the request unless he is supplied with that further information. (4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless— (a) the other individual has consented to the disclosure of the information to the person making the request, or (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual. (5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise. (6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to— (a) any duty of confidentiality owed to the other individual, (b) any steps taken by the data controller with a view to seeking the consent of the other individual, (c) whether the other individual is capable of giving consent, and (d) any express refusal of consent by the other individual. (7) An individual making a request under this section may, in such cases as may be prescribed, specify that his request is limited to personal data of any prescribed description. (8) Subject to subsection (4), a data controller shall comply with a request under this section promptly and in any event before the end of the prescribed period beginning with the relevant day. (9) If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request. (10) In this section— “prescribed” means prescribed by the Secretary of State by regulations; “the prescribed maximum” means such amount as may be prescribed; “the prescribed period” means forty days or such other period as may be prescribed; “the relevant day”, in relation to a request under this section, means the day on which the data controller receives the request or, if later, the first day on which the data controller has both the required fee and the information referred to in subsection (3). (11) Different amounts or periods may be prescribed under this section in relation to different cases.

[73]It will be noted that the jurisdiction of the High Court to rule on the correctness of decisions taken under the DPA 1998 by bodies such as the MPS is created under section 7(9).

[74]It will also be noted that the DPA 1998 does not create two separate exceptions based upon Articles 3 and 13 of the Directive but combines those provisions into a single exception found in section 29. Article 13 of the Directive does not compel Member states to introduce exceptions; it introduces a power (“may”) exercisable where “necessary to … safeguard”, inter alia, criminal law enforcement. Section 29 provides, so far as relevant to the present case: “29 Crime and taxation.E+W+S+N.I.(1) Personal data processed for any of the following purposes— (a) the prevention or detection of crime, (b) the apprehension or prosecution of offenders, or (c) the assessment or collection of any tax or duty or of any imposition of a similar nature, are exempt from the first data protection principle (except to the extent to which it requires compliance with the conditions in Schedules 2 and 3) and section 7 in any case to the extent to which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection.

(2) Personal data which— (a) are processed for the purpose of discharging statutory functions, and (b) consist of information obtained for such a purpose from a person who had it in his possession for any of the purposes mentioned in subsection (1), are exempt from the subject information provisions to the same extent as personal data processed for any of the purposes mentioned in that subsection.

(3) Personal data are exempt from the non-disclosure provisions in any case in which— (a) the disclosure is for any of the purposes mentioned in subsection (1), and (b) the application of those provisions in relation to the disclosure would be likely to prejudice any of the matters mentioned in that subsection.

(4) Personal data in respect of which the data controller is a relevant authority and which— (a) consist of a classification applied to the data subject as part of a system of risk assessment which is operated by that authority for either of the following purposes— (i) the assessment or collection of any tax or duty or any imposition of a similar nature, or (ii) the prevention or detection of crime, or apprehension or prosecution of offenders, where the offence concerned involves any unlawful claim for any payment out of, or any unlawful application of, public funds, and (b) are processed for either of those purposes, are exempt from section 7 to the extent to which the exemption is required in the interests of the operation of the system.

(5) In subsection (4) — “public funds” includes funds provided by any EU institution; “relevant authority” means— (a) a government department, (b) a local authority, or (c) any other authority administering housing benefit or council tax benefit. (a) the prevention or detection of crime, (b) the apprehension or prosecution of offenders, or (c) the assessment or collection of any tax or duty or of any imposition of a similar nature, (a) are processed for the purpose of discharging statutory functions, and (b) consist of information obtained for such a purpose from a person who had it in his possession for any of the purposes mentioned in subsection (1), (a) the disclosure is for any of the purposes mentioned in subsection (1), and (b) the application of those provisions in relation to the disclosure would be likely to prejudice any of the matters mentioned in that subsection. (a) consist of a classification applied to the data subject as part of a system of risk assessment which is operated by that authority for either of the following purposes— (i) the assessment or collection of any tax or duty or any imposition of a similar nature, or (ii) the prevention or detection of crime, or apprehension or prosecution of offenders, where the offence concerned involves any unlawful claim for any payment out of, or any unlawful application of, public funds, and (b) are processed for either of those purposes, (a) a government department, (b) a local authority, or (c) any other authority administering housing benefit or council tax benefit.

[75]Limits are imposed upon persons collecting data. The collection and retention process must accord with certain overarching principles set out in Schedule 1 to the Act. These are not in dispute in the present case. I refer to them to observe that one governing principle is fairness (cf Principle 1). A further point of relevance is Principle 8 which prohibits the transference of personal data to a country or territory outside of the EU unless that territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

[76]Section 29 permits derogation from the disclosure obligation in section 7 in defined circumstances. As I have already set out the MPS accepts that the Report prepared by DCI Lyons contains personal data. The question for the High Court is whether the MPS is entitled to withhold that personal data from the Claimants because the personal data was “processed” for the purpose of “(a) the prevention or detection of crime,(b) the apprehension or prosecution of offenders”? If the answer to this is in the affirmative then a secondary question arises which is whether granting access would be “likely to prejudice any of the matters mentioned in this subsection”. Even if the subject matter of the personal data is within the confines of an exempted subject matter withholding that data from the relevant person is only permitted “to the extent” that disclosure would cause the prejudice to the interests referred to in the section.

[77]Protection is thus not absolute. It is a qualified protection. This conclusion accords with the language of Article 13 of the Directive which introduces a necessity test and permits a refusal to grant access only where the refusal is “necessary” to “safeguard” the purpose.

[78]Although section 29 DPA 1998 and Article 13 use different language they are in my view consistent. They require a balancing exercise to be performed between the individual’s right to access and the data processor’s right to refuse. In my judgment this calls for a classic proportionality balancing exercise to be performed.

[79]It was submitted by Ms Proops, for the MPS, that in fact section 29 did not call for a proportionality balancing exercise. She submitted (boldly) that provided that the MPS could show a legitimate reason for withholding disclosure then the weight and importance of the personal data and the impact of its non-disclosure on the individual was immaterial. In response to my question whether in the view of the MPS there would be any difference in the outcome where the personal data was(a) the applicant’s date of birth or

(b) information which could exculpate completely a defendant in a death penalty case, she said that it would made no difference; provided the MPS had a valid reasons for withholding then that was the end of the matter.

[80]This argument is not sustainable. If it were correct then it would in effect reduce to nought the relevant individual’s right to privacy or any other right including the even more fundamental right to life. The argument is inconsistent with (inter alia):(a) the Directive and the plain reference to the fundamental rights of the individual concerned;

(b) the raison d’etre of the DPA 1998 as a protector of an individual’s fundamental rights;

(c) the view taken by the Court of Justice that derogations from the individual’s fundamental rights had to be construed narrowly and in this regard see by way of illustration

Case C-473/12

IPI v Englebert et ors

[2014] 2 CMLR 9

at paragraph [39] where the Court emphasised that derogations from the fundamental right to privacy “... must apply only insofar as is strictly necessary” (this being thetraditional language of the Court of Justice when it is referring to a proportionality exercise);

(d) the judgment of Mr Justice Munby in Lord at paragraph [99]: see below at paragraph [84] and with his explanation that because of the importance of the policy of protecting individual rights the burden of proof lay on the State to justify derogation to a high standard of proof; and

(e) the judgment of Lord Sumption in Catt at paragraph [8]. D. Issues: Analysis and conclusions

[81]In the light of the analysis above I turn now to identify the issues and then to an assessment of the merits of the case.

[82]There is a preliminary issue to address, namely the burden and standard of proof (issue I).

[83]There are then two substantive issues to be determined. First, was the personal data in the Report “processed” for purposes of(a) the prevention or detection of crime or

(b) the apprehension or prosecution of offenders (Issue II)? Secondly, would granting access be likely to prejudice any of those matters (Issue III)? (i) Issue I: Who has the burden of proof of proving both the right to invoke the exemption? What is the standard of proof?

[84]These issues were considered by Munby J (as then was) in R(Lord) v Secretary of State of the Home Department

[2003] EWHC 2073 (Admin)

(“Lord”). The judge held that because of the importance attached to the rights of the individual it was the data controller who had the burden of proof to establish the right to refuse access and that the standard of proof was a relatively high one. At paragraphs [99] and [100] the judge, relying upon the Directive as a source of interpretative inspiration, stated: “99. I accept that "likely" in section 29(1) does not mean more probable than not. But on the other hand, it must connote a significantly greater degree of probability than merely "more than fanciful". A "real risk" is not enough. I cannot accept that the important rights intended to be conferred by section 7 are intended to be set at nought by something which measures up only to the minimal requirement of being real, tangible or identifiable rather than merely fanciful. Something much more significant and weighty than that is required. After all, the Directive, to which I must have regard in interpreting section 29(1), permits restrictions on the data subject's right of access to information about himself only (to quote the language of recital (43)) "in so far as they are necessary to safeguard" or (to quote the language of Article 13(1)) "constitute a necessary measure to safeguard" the prevention and detection of crime (emphasis added). The test of necessity is a strict one. The interference with the rights conferred on the data subject must be proportionate to the reality as well as to the potential gravity of the public interests involved. It is for those who seek to assert the exemption in section 29(1) to bring themselves within it, and, moreover, to do so convincingly, not by mere assertion but by evidence that establishes the necessity contemplated by the Directive. 100. In my judgment "likely" in section 29(1) connotes a degree of probability where there is a very significant and weighty chance of prejudice to the identified public interests. The degree of risk must be such that there "may very well" be prejudice to those interests, even if the risk falls short of being more probable than not. “

[85]The burden of proof is thus upon the MPS in this case to show its entitlement to refuse access and it must do this with significant and weighty grounds and evidence. (ii) Issue II: Was the personal data in the MPS report “processed” for purposes of(a) the prevention or detection of crime or

(b) the apprehension or prosecution of offenders?

[86]Mr Facenna submitted that the personal data was not subject to the exceptions in section 29 because a purpose of family liaison was not a purpose for which exemption from disclosure could be claimed.

[87]I do not accept this argument. The pursuit of an investigation for the purpose of family liaison is within the scope of section 29. Of course the paradigm case is where the foreign engagement is for the purpose of collecting evidence to be used in this jurisdiction as part of a criminal investigation or for advising and assisting in a foreign prosecution. However, modern thinking is to accept that the criminal justice system is not exclusively about pursuing and punishing the guilty; it is also about protecting the victims and this can include their families. There are numerous illustrations of this.

[88]First, in murder (and of course in other) cases impact statements are routinely accepted from the families and form part of the evidential basis for sentencing.

[89]Secondly, at the EU level, legislation has been adopted which explicitly recognises the position and standing of victims’ families in criminal proceedings: see eg Directive 2012/29/EU of the European Parliament and of the Council of 25 October 2012 establishing minimum standards on the rights, support and protection of victims of crime, and replacing Council Framework Decision 2001/220/JHA (“the Victims Rights Directive”). Under that directive a victim is defined to include: “family members of a person whose death was directly caused by a criminal offence and who have suffered harm as a result of that person's death” (cf Article 2(1)(a)(ii)). I would add that under Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the Area of Freedom, Security and Justice, annexed to the TEU and to the TFEU, the United Kingdom has notified its wish to take part in the adoption and application of the Victims Rights Directive.

[90]Thirdly, the rights of families are recognised as an important interest worthy of protection in cases where a person is under the control or custody of the State and dies. The rights of the family to participate in subsequent investigations (for example inquiries and inquests) into how a death occurred is recognised under

Article 2 of the Convention

on the right to life: See R (Letts) v Lord Chancellor

[2015] EWHC 402 (Admin)

and the cases cited therein. The following was stated at paragraph [59]:

“The right or legitimate interest of the next-of-kin to involvement in the procedure is viewed as a concomitant of the imperative for there to be an element of public scrutiny of the investigation in order to secure accountability. This in turn is an ingredient of the overriding need to maintain public confidence in the adherence of the State to the rule of law and to prevent any appearance of collusion in or tolerance of unlawful acts. It necessarily follows that the right of the individual to participate, which triggers the consequential obligation upon the State to consider whether legal aid is needed, is an integral part of the Article 2 duty.”

[91]In R (Amin) v Home Secretary

[2003] UKHL 51

;

[2004] 1 AC 653

("Amin"), Lord Bingham identified five different purposes behind the duty to investigate a death in custody and he emphasised the rights of relatives in that of the deceased process. One of the purposes behind the right of families to participate was to ensure “ that suspicion of deliberate wrongdoing (if unjustified) is allayed”: "31. The state's duty to investigate is secondary to the duties not to take life unlawfully and to protect life, in the sense that it only arises where a death has occurred or life-threatening injuries have occurred …. It can fairly be described as procedural. But in any case where a death has occurred in custody it is not a minor or unimportant duty. In this country … effect has been given to that duty for centuries by requiring such deaths to be publicly investigated before an independent judicial tribunal with an opportunity for relatives of the deceased to participate. The purposes of such an investigation are clear: to ensure so far as possible that the full facts are brought to light; that culpable and discreditable conduct is exposed and brought to public notice; that suspicion of deliberate wrongdoing (if unjustified) is allayed; that dangerous practices and procedures are rectified; and that those who have lost their relative may at least have the satisfaction of knowing that lessons learned from his death may save the lives of others". (Emphasis added) (Emphasis added)

[92]Fourthly, the Directive envisages in Article 3 exceptions to the disclosure obligation in “areas of criminal law”. The personal data in the Report is most certainly in the “area of criminal law” since it describes a criminal investigation. The reassuring of the families of the victims of a murder is also in the “area of criminal law”. In my view Article 3 is valid as a source of guidance to the interpretation of Article 13, and in due course, the DPA 1998. It is a reason to give to the language of the exception in section 29 a broad construction.

[93]Fifthly, a general policy of treating families well is increasingly recognised as integral to a policy of engendering trust in prosecution authorities which, in turn, is critical in creating a climate where victims and witnesses will come forward to the police and assist in enquiries. Looking after families is thus an increasingly important component of the broad creation of a policy of facilitating the effectiveness of police operations.

[94]In my view construing section 29 purposively by reference to these considerations leads to the conclusion that the MPS, when it compiled the Report, was processing data for a legitimate purpose under section 29 DPA 1998. (iii) Issue III: Would granting access be likely to prejudice any of those purposes?

[95]I turn now to the weighing, proportionality, exercise.

[96]I should start by setting out some general observations about the approach I adopt to this.

[97]First, it is apparent from section 7(9) DPA 1998 that my first task is to determine whether the MPS acted unlawfully. If I so find then I must form my own judgment about the issues:

[98]Secondly, it has been observed that when a court exercises its own judgment under section 7(9) that power is “general and untrammelled”: Kololo (ibid) paragraphs [24] and [32] citing Munby J in Lord (ibid) at paragraph [160]. Ms Proops submitted that if I found an error on the part of the MPS then I had a broad and unfettered discretion which was not limited by the strictures of the Act. For instance if I found that processing personal data for family liaison reasons was not a legitimate purpose I could still, in the exercise of my discretion, permit the MPS to refuse access despite this being outside of the scope of the exemption in section 29. The effect of this submission was that if the MPS acted unlawfully under the DPA 1998 I could simply overlook that unlawfulness and apply a broad discretion ignoring the strictures of the Act. As such the MPS would obtain the benefit of a broader discretion to be exercised in its favour specifically by virtueof its prima facie unlawful refusal. In my judgment section 7(9) cannot support that construction. If Parliament had intended to confer such a broad residual discretion on the court then, in my view, it would have used far more specific language in section 7(9) than in fact it did. In any event I do not understand the observations in the authorities referred to above to suggest that if I find that the MPS has erred that I should simply make up and then apply whatever test I see fit. If I find an error on the part of the MPS such that I must form my own view then I should do in accordance with the principles set out in the DPA 1998 and taking account of the relevant background principles in the Directive and the Convention. My discretion is unfettered by the decision that has gone before, and which I find unlawful, but I cannot depart from Parliament’s intent.

[99]Thirdly, it will be apparent from the tenor of this judgment that I consider that in applying the weighing / proportionality test, I must take fully into consideration that this is a death penalty case. It follows that on the specific facts of this case I should apply an “anxious” and intensive review of the evidence and the approach adopted by the MPS in arriving at its refusal decision. I shall accord the MPS no material margin of appreciation or discretion. It of course follows that in another case where the interests at stake are less acute the intensity of the approach adopted by the Court might be different.

[100]With these general observations in mind I turn to the factors advanced by the parties as relevant to the weighing exercise.

[101]The starting point – the Claimant’s prima facie right to the personal data: The starting point is that the Claimant’s are entitled in law to the data unless the MPS can meet its burden and standard of proof by persuading the Court that there is a fully justified reason for withholding the personal data. This presumption in favour of disclosure should be viewed as a strong and weighty factor. The fact that the courts have placed the burden of proof on the data processor and raised the standard of proof is also a reflection that the default position is one of disclosure. The numerous references to fundamental rights of individuals as the basis for this legislation underscore the proposition that the right of access is a strong right.

[102]The intrinsic strength of the MPS’s legitimate objectives: The next question is whether the MPS has legitimate objectives which it can raise relating to law enforcement to be set against the individual’s strong right of access. I have set out above that I accept that the MPS is entitled, under section 29, to advance the various general policy arguments about criminal law enforcement referred to in paragraphs [11] – [16] above. The follow-on question is how heavily these should weigh in the proportionality scales. If they were valid but of little weight then it would not take much, in a death penalty case, to persuade me that these objectives could be outweighed. I address below each of the policy purposes identified by the MPS.

[103]Family liaison: I have no doubt but that protecting the interests of families is an important consideration. Nonetheless, in a death penalty case if there was (say) personal data which could, when verified, potentially benefit the accused then it is hard to see how or why the families could or would object to the accused having a fair trial and being able to deploy genuinely relevant evidence. I have set out at paragraph [32] above the statement issued on behalf of the families by the FCO in which the families state that they wish all relevant evidence to be placed before the Thai court and reviewed fairly. I cannot imagine for one moment that the parents of Hannah and David would wish to see the wrong persons found guilty or subjected to an unfair trial. This is thus an important objective but the weight it attracts will depend upon the particular importance of the personal data to the accused especially in the context of the criminal proceedings.

[104]Chilling effect: I turn now to the argument based upon the chilling effect of disclosure. I accept that this is, in law, a valid consideration for the MPS to take into account and raise. This is so even though the purpose does not relate to the proceedings in issue but to other future and unidentified proceedings.

[105]An issue arising in Lord (ibid) was whether data could be withheld from disclosure on the basis of wider public interest considerations which went beyond the case in issue. The Judge held that it was for the data controller to show that the statutory objective was likely to be prejudiced in the case in which the issue arose (paragraph [94]). But importantly he held further (at paragraph [122]), in an observation of direct significance to the present case, that the focus of attention was not just on the facts of the instant case but could also take account of the impact on other cases:

“122. Moreover, I can accept that, although section 29(1) requires that the issue of whether disclosure is likely to prejudice the prevention or detection of crime has to be determined in relation to the particular and individual case in which disclosure is being sought, this does not mean that one can simply ignore the consequential effect that disclosure in the particular case may have in others.”

[106]In my judgment this observation must be correct. Nothing in the Directive provides support for a conclusion that the exemption can only be invoked if the data controller can establish that disclosure would be prejudicial in the narrow confines of the instant case. The rationale behind non-disclosure must go wider. Article 13 of the Directive is concerned with the generic activities of prevention, investigation, detection and prosecution of criminal offences and Article 3 refers even more broadly to “areas of criminal law”. Disclosure which is prejudicial to these tasks should, under the Directive, be capable of being immune from disclosure. If the disclosure would not prejudice the instant case but would set a precedent which would cause prejudice more broadly, for instance by discouraging cooperation in the future with third parties, then that is also a matter which, in my judgment, falls within the legitimate scope of the protection as a purpose which can in principle be invoked to justify a refusal in the instant case.

[107]The chilling effect argument is in my judgment a powerful argument for the MPS to deploy and I see considerable force in the points made. I accept the evidence of the MPS witnesses on this. The evidence is given by officers of the highest order who have considerable personal experience of the issue. I accept their judgment and opinion as to the risks that release of the Report would give rise to and in particular, their position on: the considerable benefit to the public interest (in relation to crime enforcement and public security) generally in the MPS (and other relevant police authorities) being able to engage with foreign authorities; the high importance that is attached by foreign authorities to confidentiality; and the risk that not being able to give strong assurances as to confidentiality would pose to the ability of the MPS and others to enter into meaningful working relationship with such overseas authorities. This is thus in my view a weighty factor in favour of non-disclosure.

[108]How strong a factor is this? The MPS adopts a very rigorous approach on this point. It accept that in theory no public interest that it advances can be wholly invincible and can never be trumped; but it does submit that the public interest considerations raised are so compelling and powerful that it can conceive of few, if any, circumstances where that public interest it could even be surpassed in importance by a countervailing interest raised by an individual. I asked the parties for their views on a hypothetical situation: A foreign prosecutor fails to disclose to a defendant a key piece of evidence of great value to the defendant in a criminal case. This item is however recorded in an MPS report and amounts to personal data. The report explains that there is compelling evidence that the foreign forensic scientists employed by the police abroad have mixed up DNA samples. It also records that the prosecution are nonetheless seeking to rely in court upon the wrong DNA evidence to inculpate the accused. This entry might be pivotal to the defence and might quite literally represent a matter of life or death. In those circumstances does the Court sacrifice the accused for the wider principle of comity and trust between authorities? Ms Proops for the MPS submitted that such was the power and force of the public interest objectives the MPS advanced that even in such extreme circumstances the public interest would still trump the private interest. Though as observed she accepted that in theory it was not open to the MPS to adopt a blanket approach refusing access come what may. Mr Facenna submitted that this position on the part of the MPS was absurd and showed simply that the MPS in truth wished to adopt a stonewall, blanket policy, of non-disclosure which was a position he submitted was itself unlawful as the deliberate fettering of a statutory discretion. The parties thus agree that there is in law no such thing as a universal right to refuse access; but they disagree strongly as to how and where to draw the line. I do not intend to express even a tentative view on this particular problem. Were it to arise in a future case (and it does not arise here) it would require very much closer scrutiny than has been possible in this case.

[109]I can, in the context of this case, conclude by saying that I accept that the chilling effect policy consideration is a strong point in favour of the MPS but I can leave to another day how it would be resolved in the acute hypothetical illustration referred to.

[110]There is a further point which concerns the risks associated with the disclosure of only small amounts of personal data. It is common ground between the parties (and I view I also share) that I must apply the balancing proportionality test to each item of personal data. There is no one cap that fits all. A good deal of the MPS’s core concerns related to disclosure of the Report as a whole. However, there is no prospect of the Report being disclosed: the issue is whether some or all of the personal data contained within in the Report would be disclosed. The position of the MPS is however that the disclosure of even a small portion of the Report would have a serious chilling effect because even a minor release could be seen by foreign counterparties as reflecting a more systemic risk that the ability to enter into confidentiality arrangements would be subject to override by the Courts. I accept broadly the evidence of the MPS on this. However, this is of course already a risk and the MPS accepts, as it must, that it has no right to ignore the law. Evidence was put before this court from the MPS (by DSU Sweeney) which makes clear that the MPS already take account of domestic law when discussing and negotiating conditions with foreign authorities. DSU Sweeney said in relation to conditions sought to be imposed by foreign authorities as a pre-requisite of engagement:

“Such conditions will usually be agreed to by the MPS unless they fall foul of UK legal principles or are otherwise considered to be appropriate in the circumstances, in which case the deployment may not be undertaken”

. Overall, the risk of a chilling effect may be one of scale and degree; but I do accept that there may be a real risk to the public interest of the disclosure of even small amounts of data. In other words it is not necessarily an answer for an applicant to say - disclosure relates only to a small amount of personal data.

[111]Need to avoid interfering in a foreign trial. The MPS has also raised the point that disclosure might risk undermining the Thai proceedings. The Report was not given to the Thai authorities. The MPS team was conscious that they should in no way become part of the evidence chain (see paragraph [10] above). If I acceded to the application I would in effect be giving disclosure according to a set of rules which may be inconsistent with Thai rules on disclosure in criminal cases. As such I could be taking a step which might risk interfering with the criminal law procedure of a foreign sovereign state. That state has its own rules of disclosure; they might very well not be the same as apply in this jurisdiction and there is in fact evidence in this case that in some significant ways they are not the same: for instance I understand that there is no right on the part of the defence to access unused material, and there are different rules as to the prosecution’s duty of disclosure of material they propose to rely upon in court. But that does not mean that this court should assume a stance of procedural superiority. It is significant that in this case no evidence has be put before me that the judge in the actual trial is acting improperly or unfairly or that the accused have been unable to avail themselves of all the rights normally open to defendants in Thai criminal proceedings. This somewhat broad consideration against disclosure is underscored by practical considerations. If I order disclosure of the personal data I would risk giving a sliver of the Report which might be misleading because it is taken out of context. It is clear from my reading of the Disputed Information that on some occasions the items of personal data in and of themselves do not have a clear self-contained logic to them. The references may be stray matters included as part of a wider issue which is being discussed in the Report. I can well understand why both the MPS and RTP would wish to avoid a situation where personal data was released and then used but the wider context (the relevant part of the Report) was not in evidence. Quite how far this all goes is however unclear. I have not had detailed evidence placed before me of the Thai court procedures or as to the state of play in the trial. If I ordered disclosure that does not necessarily mean that the judge would rule that data to be admissible. At the end of the day I consider this to be a serious policy consideration which the MPS is entitled to rely upon.

[112]The right for the Claimants to use personal data as part of a defence: There was some debate as to the right of the Claimants to use the personal data for a purpose such as their rights of defence. In my view the Claimants have a perfectly proper right to seek access to the personal data for the purpose of using it subsequently in their defence in criminal proceedings. The DPA is about fundamental rights. The right to a fair trial and the right to life are fundamental rights. The right of access is a fundamental right and it does not lose that character simply because the data, once obtained, is then used to protect a further fundamental right. Reference was made in argument to Durant v Financial Services Authority

[2003] EWCA Civ 1746

;

[2004] FSR 28

(“Durant”) where the Court of Appeal was concerned with an application under the DPA 1998 by a Mr Durant to the FSA for access to personal data about him held on the FSA’s computers. At paragraph 31 Auld LJ criticised the applicant for making an application which was perceived to be in support of a litigation strategy:

“In short, Mr. Durant does not get to first base in his claim against the FSA because most of the further information he sought, whether in computerised form or in manual files, is not his "personal data" within the definition in section 1(1). It is information about his complaints and the objects of them, Barclays Bank and the FSA respectively. His claim is a misguided attempt to use the machinery of the Act as a proxy for third party discovery with a view to litigation or further investigation, an exercise, moreover, seemingly unrestricted by considerations of relevance.” (Emphasis added)

(Emphasis added)

[113]At paragraph [27] Lord Justice Auld disassociated the right of access from any purported right to participate in legal proceedings: “In conformity with the 1981 Convention and the Directive, the purpose of section 7, in entitling an individual to have access to information in the form of his "personal data" is to enable him to check whether the data controller's processing of it unlawfully infringes his privacy and, if so, to take such steps as the Act provides, for example in sections 10 to 14, to protect it. It is not an automatic key to any information, readily accessible or not, of matters in which he may be named or involved. Nor is to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against third parties. As a matter of practicality and given the focus of the Act on ready accessibility of the information - whether from a computerised or comparably sophisticated non-computerised system - it is likely in most cases that only information that names or directly refers to him will qualify. In this respect, a narrow interpretation of "personal data" goes hand in hand with a narrow meaning of "a relevant filing system", and for the same reasons (see paragraphs 46-51 below). But ready accessibility, though important, is not the starting point.

[114]It is right to observe that Lord Justice Auld was referring to an altogether different context where a person seeks access to data to facilitate that person bringing civil proceedings. In the present case the nexus between the application for access, the personal data and the criminal proceedings is very close to the point of being indistinguishable. The Claimants are facing a capital charge in Thailand. The personal data was collected in the specific context of criminal proceedings and, furthermore, refers to evidence in the case, including that against the accused. There is a powerful connection therefore between the personal data and extant criminal proceedings. As such I do not see how the observations of Lord Justice Auld can have application in the present case. In other words the fact that the application in the High Court is couched in terms of the use to which the data might be put in the criminal proceedings in Thailand does not mean in my view that it is being sought for an improper purpose.

[115]Observations on the importance of the personal data references in the Report: In my view this case ultimately turns upon the intrinsic relevance of the personal data to the defence in the criminal proceedings when set against the interests of the MPS in non-disclosure. The crux of the matter is to take each individual item of personal data and determine whether it is such that it could in any realistic sense provide support for the defence. If a particular piece of personal data does have this quality then it must be balanced against the interests of the MPS. Such a piece of data will attract considerable weight in the scales but there are yet weighty counter points to be placed on the other side of the scales. A delicate balancing exercise then ensues.

[116]In the text below I set out my conclusions on the weight to be attached to the personal data in the Report. I am unable in this judgment to describe in any detail the personal data that is in issue. I think however that in actual fact an alert reader could readily deduce from the description that I have been able to give of the Report what the personal data therein related to.

[117]The approach that I have taken is as follows. I have reviewed (“inspected”) each item of personal data in the Report very carefully and I have focused upon the possible value that the item in question could have for the accused in the trial. I have adopted a cautious, pro-accused, view. I have already explained that I am materially hampered in this exercise because the Claimants have not put before me an account of the evidence already tendered in the Thai proceedings, or any indication of what their defence is or might be to the murder charge against them. Nonetheless, it is fairly obvious what the prosecution case is and as I understand matters that case has now very largely been advanced in court and the defence has seen the evidence against the accused and has had a chance to cross examine upon it. On my reading of the Report I have, I therefore consider, a good idea of how the prosecution evidence will have been organised and presented and I believe that I can form a fair view of how the personal data will fit into that case. This means that I can form a view as to whether it is likely to be helpful to the accused were it to be disclosed to them.

[118]The principles that I have applied to the items of personal data in the Report are as follows.

[119]Data harmful to accused: I have been able relatively easily to identify items of personal data which would not be helpful to the accused. I am assuming in any event that inculpatory evidence has already been adduced to the court as part of the prosecution case and, in the unlikely event that it has not, then that omission will have caused no prejudice to the accused. I am therefore concerned essentially with evidence which might be adverse to the prosecution and helpful to the accused. Therefore, I take the position that where I conclude that the personal data in the report is adverse to the accused then I consider that the policy arguments of the MPS outweigh the Claimants interest in disclosure.

[120]Data neutral to accused: If the data is neutral then in my view the legitimate objectives identified by the MPS will trump the disclosure obligation; this is not a case where one would say:

“the personal data is neutral and therefore why not disclose it”

. In fact one would say the opposite. The sort of data which might fall into this category would include data references along the lines of: “X is in custody”, or “this is a photograph of the accused” or “the accused lives at Y”, or, “these are the main steps in the court procedure to date in relation to the suspects”, etc.

[121]Summaries of other evidence: I also identified whether the items of personal data were a summary of other evidence collected by the police. In fact a high percentage of the personal data references reflect summaries of other evidence. This is not at all surprising given the limited observer role played by the MPS. They were not collecting evidence; they were recording in summary form the evidence collected by the RTP. Thai criminal procedure governs the access given to the accused. Although I do not know for certain (because this evidence has not been put before me) I surmise that the underlying evidence that forms the basis of the personal data will have been tendered in court so will be in the possession, in a form permitted by Thai law, of the accused and their lawyers

[122]Level of detail: I have also formed a view as to the level of detail inherent in the personal data. Generally speaking the more general the item of information the less valuable it is going to be as part of the defence of the accused.

[123]Personal data placed in the public domain by the FCO on behalf of the families and deployed adversely to the Claimants in Thailand: The Claimants submit that the personal data has already caused them prejudice because the FCO, on behalf of the families, has stated publically that the evidence was “powerful and convincing” and the Thai authorities have referred in public in Thailand to this as strong support from the families and/or UK Government for the prosecution case. It is said that this risks prejudicing the trial in Thailand. I attach some weight to this. But it is not compelling. First, the FCO did not disclose personal data; they (at its highest) provided a very high level statement about the strength of the evidence generally. Secondly, there has also been extensive press media critical of the Thai authorities, especially in the light of the allegations by the accused that they had been tortured and were subject to unfair procedures – the media coverage was not therefore one way traffic. Thirdly, and importantly, the trial is presided over by a judge about whom no complaint has been made to me in these proceedings. Any adverse comment in the Thai press can, I am bound to assume, be addressed by the judge applying normal, objective, standards.

[124]Observations on the personal data: With these general considerations in mind I would make the following observations about the items of personal data in the Report: a) The references are frequently brief, descriptive, and broad brush. b) There are some exceptions to this where personal data is compiled in tabular form. But even here it is not much more than a series of terse statements in abbreviated form eg a summary of the main points in the chronology leading up to a suspect’s arrest. In such cases whether the items are viewed in isolation or as part of a wider picture (the table as a whole) it is all information that the accused will already be aware of. c) A good deal of the personal data relates to the observations of the MPS on documents or video recordings that they were permitted to read and review. As such since (as I understand matters) the accused will have had access during the trial to the same material then the references in the Report would, at this stage, add nothing to the sum of knowledge held by the defence team on these matters. d) To the extent that the personal data refers to such matters as whether the accused had access to legal representation during interviews and/or translators these are matters within the knowledge of the accused and their lawyers in Thailand even if, as is said in the evidence before me in this case, there is a dispute about such matters. e) The personal data is not, as I have already observed, analytical and does not perform an evaluation of the prosecution evidence or case. f) I have not identified any material exculpatory personal data in the Report.

Conclusion

[125]My ultimate conclusion is that there is nothing in the personal data which would be of any real value to the Claimants. I have not identified any particular piece of information to which I would attribute any really substantial weight to be set against the MPS’s objectives. As such I accept that the objections to disclosure raised by the MPS to defeat the application are valid and, on the facts of the case, suffice to outweigh the claimants’ otherwise strong interest in access.

[126]In coming to this end result I nonetheless feel very considerable unease. I sit at a long distance from the seat of the trial and I do not have a true “hands on” feel for the way the evidence has been tendered in the trial to date or how the accused might structure their defences. I have not been assisted by the lack of evidence about the Thai proceedings or as to the evidence that has in fact been tendered by the prosecution or as to the main lines of the defence. I have had to work these out for myself doing, as the parties put it, “the best I could”. This has not been a comfortable process. E. Conclusion

[127]For the above reasons the application does not succeed. The MPS did not err in its application of section 29 DPA 1998.

[128]There has been no need for me to exercise an independent judgment under section 7(9) DPA 1998. Had I done so in view of my conclusions about(i) the strength of the MPS’s legitimate objectives and

(ii) the intrinsic value of the personal data to the accused, I would not in any event have arrived at a different decision.

Cited in 13 later judgments

and 4 more of the most senior