Institute of Information Security Professionals v Revenue & Customs (Rev 1) [2009] UKFTT 365 (TC)

FTT-Tax
Institute of Information Security Professionals v Revenue & Customs (Rev 1)
[2009] UKFTT 365 (TC) · 2009-12-11
[1]This is an appeal against a decision of the Commissioners contained in a letter dated 4 October 2006 that the Institute of Information Security Professionals (“IISP”) is not a professional body under Schedule 9 Group 9 Item 1(b) of the Value Added Tax Act 1994 (“the Act”) or a learned society under Item 1(c) of Group 9 and consequently that its membership subscriptions are taxable at the standard rate. That decision was upheld on reconsideration for reasons given in a letter dated 29 March 2007.[2]The grounds of appeal are:
“That information to security should be considered as a profession and so subscriptions to join the Institute of Information Security Professionals should be exempt from VAT.”
Background[3]The IISP is a ‘not for profit’ un-incorporated company offering membership to people with an interest in information security. It was established in 2006 with the stated aim to “promote the study and practice of Information Security and to advance knowledge, education and professionalism therein for the benefit of the public” (see Article 16.2 of it Memorandum of Association). The law[4]Article 13A(1)(1) of the Sixth Directive 77/388/EEC provides that Member States shall exempt:
“The supply of services and goods closely linked thereto for the benefit of their members in return for a subscription fixed in accordance with their rules by non-profit-making organisations with aims of a political, trade-union, religious, patriotic, philosophical, philanthropic or civic nature, provided that this exemption is not likely to cause distortion of competition.”
[5]That exemption has been replaced in Article 132(1)(1) of the Principal Directive 2006/112/EEC which states that the exemption applies to:
“The supply of services and goods closely linked thereto, to their members in their common interest in return for a subscription fixed in accordance with their rules by non-profit-making organisations with aims of a political, trade-union, religious, patriotic, philosophical, philanthropic or civic nature, provided that this exemption in not likely to cause distortion of competition.”
[6]Schedule 9 Group 9 of the Act exempts from VAT subscriptions to trade unions, professional and other public interest bodies:
“Item No. 1. The supply to its members of such services and, in connection with those services, of such goods as are both referable only to its aim and available without payment other than a membership subscription by any of the following non-profit-making organisations – (a) A trade union or other organisation of persons having as its main object the negotiation on behalf of its members of the terms and conditions of their employment; (b) a professional association, membership of which is wholly or mainly restricted to individuals who have or are seeking a qualification appropriate to the practice of the profession concerned; (c) an association, the primary purpose of which is the advancement of a particular branch of knowledge, or the fostering of professional expertise, connected with the past or present professions or employments of its members; (d) … NOTES … (4) Paragraph (c) does not apply unless the association restricts its membership wholly or mainly to individuals or corporate bodies whose business or professional interests are directly connected with the purposes of the association.”
[7]We were referred to the following cases:[1]Case C-149/97 Institute of the Motor Industry [1998] STC 1219[2]Institute of Legal Cashiers and Administrators v Commissioners of Customs and Excise VAT Tribunal Decision 12383[3]Association of Payroll and Superannuation Administrators v Commissioners of Customs and Excise VTD 7009[4]R (on the application of the BBC v Central Arbitration Committee) [2003] IRLR 460[5]The British Institute of Cleaning Science v Commissioners of Customs and Excise (LON/85/184)[6]The Institute of the Motor Industry case before the VAT Tribunal ([1996]) V&DR 370 (No.14639)[7]Carr v Inland Revenue Commissioners (1944) 2 All ER 163[8]Committee of Directors of Polytechnics (1992) STC 873[9]Institute of Leisure and Amenity Management v Customs and Excise Commissioners [19880] STC 602[10]EMS National User Group v Revenue & Customs [2006] UK VAT V19645[11]The Commissioners for HMRC v Lt Cmd Colin Stone [2008] EWHC 1249 (Ch)[12]Brutus v Cozens [1972] 2 AER. HL 8. We were also referred to the following Government and other documents: Document Description No. of Ref No Pages 13 Parliament – House of Lords Science & Technology Committee report “Personal Internet Security”, 10 th August 2007, HL Paper 165-1, pages: frontice, Abstract and 395-396 HSP’s written evidence 4 14 HM Government – Cabinet Office Website extracts 9current September 2009) regarding HSP and report “Date handling procedures in Government Final Report, June 2008, pages: frontice, foreword 3, summary 5-7 5 15 HM Government – Treasury & HMRC Final report of Kieran Poynter “Review if Information security at HM Revenue & Customs”, June 2008, pages: frontice, preface 3-4, “Information Security not a management priority” 49, recommendations pages 68-69, 74, 78-80 and “What Progress has HMRC Made?” 89-92 14 16 Parliament – House of Commons Statement to the House by the Chancellor of the Exchequer on the Poynter review, 25 th June 2008 3 17 HM Government – HMRC Letter by Acting Chairman of HMRC Dave Hartnett to Financial Secretary to the Treasury Jane Kennedy on the Poynter review, 25 th June 2008 3 18 HM Government – HMRC Departmental Report 2009, pages: frontice, Chairman’s Statement. “Data Security” page 41 4 The Issues 9. The issues for the Tribunal can be broken down into the following questions:(i) Can the IISP properly be considered a “professional” association within Item 1(b) of the Act?(ii) What is its primary purpose? Is it either the advancement of a particular branch of knowledge and/or is it the fostering of professional expertise?(iii) Does ‘professional’ in Item 1(c) have the same meaning as in Item 1(b)?(iv) If the IISP satisfies either of the criteria in (c) above, is what it does connected with the past or present professions or employments of its members?(v) If the IISP is considered now to be exempt, was it exempt in its early years? The facts 10. It was not disputed by the Commissioners that the IISP fell within the first part of Item 1 of the Act, and it was not claimed on behalf of the IISP that it came within Item 1(a). 11. The Tribunal heard oral evidence from a Dr Robert Coles, who is a director of the IISP, is a founding member and is also its treasurer. Dr Coles has a Doctorate in Information Technology from the University of Leeds. There are undergraduate courses in the subject, for example at the University of Salford, and the IISP has recently won a bid to conduct research with University College, London, this research being funded by the Department for Business Enterprise & Regulatory Reform, which replaced the Department of Trade and Industry. Dr Coles is currently employed by the Bank of America as Head of Enterprise and Information Management. He was previously the Chief Information Security Officer for Merrill Lynch. We accept the evidence he gave, but it was unfortunate that we were not provided with a witness statement from him. In addition to his oral evidence, we were also supplied with a bundle of documents, the most relevant of which being the Code of Ethics, and the Code of Conduct, and the Memorandum and Articles of Association of the IISP. We were shown extracts from the website of the IISP, and extracts from a diary prepared by Dr Coles. 12. The Memorandum and Articles of Association are dated 20 December 2005. The Institute itself was incorporated on 21 December 2005. Clause 3 of the Memorandum sets out the object of the IISP as follows:
“The object for which the Company is established (“the Object”) are: to promote the study and practice of Information Security and to advance knowledge education and professionalism therein for the benefit of the public (within the UK or otherwise). In this Memorandum “Information Security” includes without limitation information assurance and any related discipline.”
[13]The Articles of Association have under the heading “Members” the following clauses:
“2. The Company must keep a register of members as required by the Act [in this context ‘the Act’ means the Companies Act 1985]. The members are: 2.1 The subscribers to the Memorandum and Articles of Association; and 2.2 Any other person admitted as members pursuant to Article 3. 3. The Board shall admit to membership such persons or organisations as it shall think fit and the Board may from time to time prescribe (and vary) the criteria for membership. The Board shall not be obliged to give reasons for refusing to accept any person as a member.”
[14]The Code of Ethics and the Code of Conduct predate the Memorandum and Articles of Association, being dated 3 to 5 June 2005 in the version before the Tribunal. The introduction to the Code of Ethics states as follows:
“ A profession is distinguished by certain characteristics, including: · Mastery of a particular intellectual skill, acquired by training, education and experience; · Adherence by its members to a common set of values and Code of Conduct; and · Acceptance of a duty to society as a whole.”
Under the heading ‘Values’ it states:
“In order to achieve the objective of the information security profession, the Institution for Information Security Practitioners has identified four core values that all members shall be required to observe: · Honesty · Diligence · Objectivity · Integrity”
[15]The Code sets out ten different matters which it states are intended to guide members in their professional and personal conduct. These include a requirement that members of the IISP shall “support the professional education and development of other members in the profession and other individuals involved in information security”.[16]In the early correspondence with the Commissioners during 2006 to 2007 various descriptions of the IISP and its aims were pointed to by Miss Mitrophanous on behalf of HMRC as indicating that it did not regard itself as a professional association at that time. HMRC relied in particular on a letter dated 23 May 2006 in which the organisation’s manager of corporate services, Miss Helen Crowe, had referred to the IISP as an organisation “in the early stages of being a professional association”, similarly in a letter dated 31 January 2007 Miss Crowe had referred to the membership being restricted “mainly to people whose employment is in Information Security and want to participate in creating a profession to advance the Information Security Sector.” In the same letter Miss Crowe concludes by saying:
“I do hope the information I have provided has clarified the situation as regards why we believe the Institute of Information of Security Professionals is a professional associated (sic).”
Miss Mitrophanous also pointed to a letter dated August 2006 in which Miss Crowe wrote:
“I am uncertain whether the Institute of Information Security Professionals (“IISP”) would be accepted on the grounds that it is not currently regarded as a profession but may acquire that status in the future”
. In response Mr McNicholas referred us to the preceding paragraph where Miss Crowe had referred to the final part of the paragraph 11.6 of Notice 701/5 ‘Clubs and Associations’ (the relevant HMRC Notice) which states that the criteria for a profession are neither fixed nor exhaustive, and she continued “this means for example some occupations not currently regarded as a profession may acquire that status in the future.”[17]From its inception until at least June 2007 the IISP described itself as having four levels of memberships as follows:(i) affiliate – open to anyone with an interest in information security (101 members in 2007);(ii) associate – open to anyone who can demonstrate by his education and experience that he is working his way towards full membership (1,247 members in 2007);(iii) member – open to anyone who can satisfy the criteria for full membership, which are described as those with a Certified Information Systems Security Professional (CISSP) or a Certified Information Security Manager (CISM) qualification or a relevant degree or who are ‘qualified by experience’ (15 members in 2007);(iv) Fellow – open to those who can demonstrate outstanding service to Information Security (no one has yet been made a Fellow of the IISP).[18]It was accepted by Dr Coles that until some time in 2007 full membership was not possible as the procedure for admission to this level had not yet been set up. Corporate membership subsequently became possible, and initially corporate membership was free, but is not so now. A list of corporate members dated 31 March 2009 was produced. It included in addition to those members set out in para below: Barclays, the Cabinet Office, CESG, Deloitte & Touche, Diageo, DWP, Hewlett Packard, Lloyds, Merrill Lynch, Nationwide, NPIA, Pricewaterhouse Coopers, Sapphire, SOCA, Thales, Validsoft and Wipro.[19]The CISSP and CISM qualifications are awarded by rival American organisation in competition with each other. The website for the CISSP ‘Training Camp’ sets out the eligibility requirement to sit for the CISSP examination which, other than payment of an examination fee and a check on an applicant’s criminal background, a candidate must ‘assert that he or she possesses a minimum of four years of practical experience in the information security field. (Or three years … (illegible) degree for prospective candidate effective January 01, 2003). He or she must also complete a Candidate Agreement, attesting to the truth of his or her assertions regarding professional experience and legally … (illegible) to the CISSP Code of Ethics. According to the IISP, in order to qualify for certification under CISSP or CISM an individual would need either five years’ experience in the information security field or three years with additional related experience e.g, audit of two years. The certification is described as normally being the culmination of an intensive five to seven day training event or longer night school classes. The examinations themselves consisted of multiple choice questions.[20]In 2007 it was expected that all those individuals (some 6,000) who had the CISSP or the CISM qualification would wish to be members of the IISP, being eligible for membership in the UK. However in its July 2009 report, the criteria for membership of the IISP no longer makes reference to the CISSP or CISM qualifications even as an alternative to experience for entry to the Institute, it is also a fact that membership numbers have not grown as originally anticipated, but Dr Coles explained this by saying that it was not now considered that it was possible to demonstrate an individual’s competence through the tests, which were only tests of knowledge and recall. It was also found that a large number of the 6,000 had very limited experience in the field and limited ability to apply the knowledge they had. Those people tended to be computer programmers or firewall engineers. The current situation was that there were still only the fifteen full members who had been appointed early on after going through a procedure which involved an oral examination in addition to their having one or other of the above certificates. The oral examination was designed to test an individual’s ability to think as well as his competency, and was described by Dr Coles as being not just a test of recall or knowledge. During the examination questions are asked about methodology and how the individual applies his knowledge in a specific situation.[21]Information Security was described by Dr Coles as being concerned with protecting data in computer systems, for example encryption, as well as ensuring that there are processes properly in place for keeping information safe, for example the storage of paper documents, for ensuring the privacy of telephone calls, and also that the personnel are properly trained to keep matters private. Part of the job is to design a secure network solution, and to be able to design systems to recover the situation if for example there is an interruption to the IT system in the business in question. It is also part of the job to monitor the effectiveness of an organisation, and to understand any potential threats to it and to look for technology to mitigate those threats. It is not a usual part of the role of someone in the industry actually to develop the required technology, but to choose the product best suited to a particular company.[22]A report produced by the chief operations officer of the IISP on 17 July 2009 describes the principal objective of the Institute as being “to advance the professionalism of Information Security Practitioners and thereby the professionalism of the industry as a whole. By the year 2010 the Institute aims to provide a universally accepted focal point for the Information Security Profession.” Dr Coles himself said that the IISP existed to show that someone was competent in Information Security, and also to speak to the Government and Regulatory Bodies, to conduct research and to “move it forward”. He said that the first of those matters was its main purpose, which he accepted appeared to be somewhat at odds with the report of 17 July 2009. When he was being cross-examined about its object as stated in the Memorandum of Association, Dr Coles said the main object of the IISP was to promote itself. The work of the society included publishing a paper on standards for the industry, and drawing together a common body of knowledge. The intellectual property in the paper belongs to the IISP; the paper itself had taken a working group which had started before the IISP was set up three years to prepare. Research is done into what is published about the industry and what people do, as there was previously little clarity as to what information security is. The IISP also published a printed Newsletter on the membership and the activities of the Institute which include monthly lectures and working groups looking at constituting a formal graduate programme to allow people to achieve membership. It also helps to write job descriptions and to set a benchmark for salaries. It is approached from time to time by recruitment consultants about those matters. The IISP also has a defined disciplinary process which is run by a disciplinary committee. This was introduced and approved by the Board of Directors on 22 November 2007.[23]The Government-related documents which were produced to us in a separate bundle are relevant in that they show the importance the Government attaches to internet and other security. The first document we were shown is a report of the Science and Technology Committee of the House of Lords published on 10 August 2007. That report opens by saying that the responsibility for Internet security can no longer rest with the individual and that many organisations with a stake in the Internet could do more to promote personal Internet security, for example, the manufactures of hardware and software; retailers; Internet Service Providers; businesses, such as banks, that operate online; and the police and the criminal justice system. A report had been submitted to the Committee by the IISP. In preparing that submission the IISP had consulted all of its membership and had circulated the draft response to the membership for comments. It describes itself as “An organisation set out at the beginning of 2006 and representing Information Security Professionals in the UK and around the world; in addition to over 1,000 individual members, our membership includes leading companies such as Accenture, BT, BP, Camelot, CISCO, HBOS, HSBC, HP, ICI, KPMG, Vodafone, RBS, Unisys, and UBS.”[24]A Cabinet office report of June 2008 emphasises the importance of correct data handling and a Cabinet Committee on Personal Data Security was set up to report on progress. The work up to that point had been conducted in parallel with a set of independent reviews following high profile losses from Government departments, such as the loss of two disks by HM Revenue and Customs which occasioned the Poynter review into those losses, and the loss of a Ministry of Defence laptop. We were shown a copy of the Poynter final report. That report outlined two major institutional deficiencies from which many issues flowed. Those deficiencies were: · Information Security simply was not a management priority as it should have been, and · HMRC had an organisational design which was unnecessarily complex and crucially did not clearly focus on management accountability. The report continued that both of those issues had been addressed but a great deal of work would be required to bring HMRC up to and to sustain the world class standard for information security to which it now properly aspires. One of the findings of the report had been that HMRC did not employ any information security professionals at the time of the incident, and that staff received little or no training in information security. It was recommended that HMRC should appoint a chief information security officer at senior level, which, by the time of the appeal before us, had in fact been done. Mr McNicholas pointed to the fact that not only was a Mr Geoff Brooker appointed as chief information security officer but he had 120 staff working under him. He was an associate member of the IISP and his aim was that all those staff should also be members of the IISP because, according to Dr Coles who knows him, he believes that it is the only qualification which demonstrates professionalism and shows that the staff are competent to use their knowledge in practice. It was expected by Dr Coles that in time Mr Brooker would become a full member of the IISP, but the criteria for full membership were not yet established. HMRC had also accepted inter alia the recommendation that each ‘Line of Business’ identify an information security sponsor on its Management Board and should appoint an information security professional to provide leadership for information security across the ‘Line of Business’. We do not propose to set out any of the other recommendations of the report, but all 45 were accepted by HMRC and a document (undated) before us shows that progress had been made by HMRC on 39 of them, with 13 having been implemented. A statement by the Chancellor on the Poynter review dated 25 June 2008 emphasises the importance of information security.[25]Dave Hartnett CB, acting chairman of HM Revenue and Customs, by a letter dated 25 June 2008, wrote to the Financial Secretary to the Treasury stating inter alia that the loss of the Child Benefit Data was the most serious incident in the Department’s history. A further relevant Government document which we referred is a Cabinet Office Leaflet headed ‘Professional Certification in Information Assurance’. That document sets out that there has been a transference of the Infosec Training Part and Competences (ITPC) scheme to the IISP,, and that the scheme was widely recognised as a valued qualification for those working in the HM Government Information Assurance Environment. It was intended only for the first level of competent practitioner, and did not offer certification above that level. It has transferred certification to the IISP so that a single process covers certification at all levels, coupled with an annotation of competency with HMG standards. It was done in order to give a clear progression from new entrant to Associate and on to full Member and beyond, together with the ITPC annotation. The IISP itself is described in the leaflet as the “professional body for those working in Information Security and Information Assurance (IA). It has a highly-regarded skills and competence framework which forms the foundation of its professional development and qualification process. In addition, it runs a programme of activities and events to help give members a voice, build professional networks and exchange ideas and issues with fellow practitioners and colleagues, across many industry sectors”. Its benefits are described as being: · Recognised professional accreditation · Member activities and workshop · Branch meetings and lectures” · Professional community forums · Monthly newsletter” The leaflet describes the development process as being that when a person reaches the competency standard required from a practitioner he should apply to the IISP for Associate membership, indicating that he wishes to be assessed at the same time for the Government competency annotation – ITPC. A successful candidate will be permitted to use the postnominal “A.Insp. ISP”. In time it may be possible for him to apply for full membership of the IISP which would be awarded alongside the post nominal “M.Insp. ISP”.[26]The final document exhibited was a government leaflet entitled “Information Security Awareness Forum”. It was founded to enable a number of professional bodies and organisations involved in information security to come together and, inter alia, increase the level of security awareness in the UK. The IISP was one of the founding members. The forum was launched on 13 February 2008 and member representatives meet twice a month. At the time of the publication of the leaflet it had 24 corporate members. The Respondents’ case[27]The main thrust of HMRC’s’ argument was that it was inappropriate to describe the IISP as an association of professionals. There was no such profession, and the references to it being a profession and to it seeking to advance professionalism in the study and practice of information security did not make it so. Similarly the fact that the Cabinet Office refers to it as a “professional body” cannot indicate that information security is a profession nor that the members of the IISP are members of a profession. All other references to it as a profession were similarly dismissed.[28]Secondly, HMRC submit that the definition of ‘profession’ is the same for Item 1(b) and Item 1(c). Because the IISP is not a profession, it therefore cannot qualify for exemption from VAT under either 1(b) or 1(c).[29]We were referred to a variety of cases, including the British Institute of Cleaning Science Ltd in which the tribunal in considering Item 1(c) said:
“I would give those words a narrow, rather than a wide meaning. I would not regard cleaning, even referred to as science of cleaning, as a particular branch of knowledge. To my mind these words refer to a branch of science or the art in a sense in which an academic would employ it. The words are not ‘the advancement of knowledge about a particular subject’, but ‘the advancement of a particular branch of knowledge’.”
This particular passage was cited without disapproval by the High Court in the Committee of Directors of Polytechnics case. The Commissioners rely on this case to show that to satisfy Item 1(c) the advancement of knowledge by a body must be (i) its primary purpose (ii) the knowledge advanced must be an academic branch of knowledge rather than of a particular subject and (iii) as one of many authorities which holds that ‘professional’ and ‘profession’ in Item 1(b) and 1(c) are to be given a consistent meaning. Therefore, they conclude, that the requirement of showing that a body is ‘fostering professional expertise’ in Item 1(c) can only be met by a body that has members who are members of a profession within Item 1(b).[30]Another case relied on by the Commissioners is the Institute of Leisure and Amenity Management . In that case the High Court noted without disapproval:
“It is accepted by counsel for the Institute that if he fails to establish that the Institute was a professional association, he cannot succeed under the second limb of Item 1(c) of Group 9, which refers to the ‘fostering of professional expertise’”
. Miss Mitrophanous also cited an earlier passage where Pill J (as he then was) stated:
“The skill or technique concerned, management of leisure facilities, is one relevant to the particular industry and not, as in the case of the traditional professions, a skill or technique of general application although of course the traditional professions do have specialist as well as general professional bodies. The industry – and I use the word in a neutral sense – provides a focal point for the association. The fact that the association was set up to serve the needs of a particular industry, the leisure industry, makes it more difficult, in my judgment, to regard it as a professional body as compared with a body serving all those with a skill or technique of general application.”
HMRC submit that Information Security is a very specialised field and the IISP was set up to serve the interests of that particular industry.[31]The Commissioners drew a distinction between professions which usually require a broad-based knowledge from which specialisation can occur and non-professions which usually required knowledge over a very limited subject area. For this they relied on the case of The Association of Payroll and Superannuation Administrators (a tribunal decision). That case was also relied on for the tribunal conclusion that if employment is not regarded as the practice of a profession in Item 1(b), then Item 1(c) cannot apply. The case of the Committee of Directors of Polytechnics , a High Court decision, was particularly relied on by HMRC for the conclusion of the High Court that the absence of a qualification for membership was fatal to inclusion within Item 1(b). The case of the Institute of Legal Cashiers and Administrators , (a tribunal decision) involved an organisation whose membership was restricted to those seeking or holding a relevant qualification, those qualifications being examinations set by the Institute in conjunction with an independent party, it had a disciplinary committee, a code of ethics, a journal and a newsletter. The tribunal found that the body was not one of professionals within Item 1(b) on the basis of the severely technical and very constricted nature of the skill which its members acquired which they held was “inconsistent with the character of a profession as it is normally understood in England”. It was submitted that information security is similarly technical and narrow and therefore not a profession.[32]The final case relied on by HMRC was the I nstitute of the Motor Industry , another tribunal decision. The tribunal held in that case that the Institute fell short of being a professional institution “because its members were drawn from too diverse a range of activities. The only common factor is that all of them are employed, in the wide sense of that word, in the retail motor industry”. It was submitted that this was similar to the information security industry which, on the basis of Dr Coles’ evidence, includes a wide variety of practitioners from those with very limited and narrow technical knowledge to those of broader competence in the field. In particular, no special qualifications are required by the IISP for membership, which was fatal to its inclusion within Item 1(b). In that case, too, the tribunal had accepted that, as the Institute could not be one of professionals under Item 1(b), then it could not be said to be fostering professional expertise under Item 1(c).[33]The principal reasons for HMRC not accepting that the IISP falls within Item 1(b) are that the Institute has no requirement for a qualification, and in any event it is not a profession as understood by the courts in the authorities cited. HMRC also do not accept that IISP comes within Item 1(c), and the arguments advanced for this are that there is no evidence to support the view that the IISP has as it main purpose the advancement of a branch of knowledge at all, even if this is understood simply to mean the advancement of knowledge, technical or otherwise. Miss Mitrophanous submitted that ‘branch of knowledge’ should in any case be understood as referring to knowledge of a recognised branch of science or the arts, rather than a more technical and limited knowledge of a particular subject such as that of information security. Given Dr Coles’ evidence, she argued that the IISP cannot claim that the advancement of academic knowledge of information security is its primary purpose.

(b) The Appellant’s case

[34]Mr McNicholas’ principal argument was that the IISP was a professional body within Item 1(b). Further or in the alternative he relied on Item 1(c). He pointed to:(i) The object clause in the Memorandum of Association(ii) The membership criteria in the Articles of Association(iii) Recognition by the Cabinet Office as the professional body for Information Security Professionals(iv) The Code of Ethics and of Conduct(v) Industry recognition in the form of training providers and job advertisements.[35]The Tribunal was invited to take judicial notice of the periodic breaches or failures of information security in all areas, private as well as the public sector, in particular the failure to protect the data regarding child benefit by the HMRC. It was suggested that we should take account of the vital need for a modern information security profession. Furthermore, information security should not be regarded as a subject of computer programming, because it was a complex area. We were asked to consider the penetration of the Pentagon’s database by Gary McKinnon: an Asperger’s sufferer, who had breached the security systems which were clearly inadequate. It was suggested by Mr McNicholas that, had an information security person such as Dr Coles subjected the systems to a penetration test, the possibility of a breach would have been discovered and the breach would not have occurred.[36]It was submitted that the IISP fell four-square within the UK law definition of a profession in Item 1(b) and/or an association for the advancement of knowledge in 1(c), as the legislation uses ordinary English words in both Item 1(b) and 1(c), as well as the Notes to Item 1, which are given no special or extraordinary meaning. Item 1 and the Notes should be construed accordingly, following the well known dicta Brutus v Cozens . We were also referred to the case of Carr v Inland Revenue Commissioners , in which Du Parcq LJ said:
“Ultimately one has to answer this question: would the ordinary man, the ordinary reasonable man, the man, if you like to refer to an old friend, on the Clapham omnibus – say now, in the time in which we live, of any particular occupation, that it is properly described as a profession?”
Du Parcq then went on to refer to the fact that the work of the surgeon used to be carried on by the barber, whom nobody would have considered a professional man, and also the profession of chartered accountant had grown up comparatively recently. It was suggested that the Tribunal should look afresh at each profession. An analogy was drawn between a doctor who diagnoses using his professional skill, and then prescribes medication, and the security professional who diagnoses the problem in a particular industry and then prescribes the measures to cure the problem. The doctor does not make the medicines, and the security professional does not write the software programmes. With regard to the suggestion by HMRC that the fact that the examinations for qualification consist of multiple choice questions suggests that the test is of knowledge rather than the ability to think and analyse, it was submitted that multiple choice questions were a common feature of testing entry to a profession including the Bar. Also all professions were to one degree or another practical, in particular architecture was essentially practical, the word ‘academic’ was not in the legislation and should not be a requirement. Mr McNicholas pointed to the fact that the Internet was a comparatively recent introduction, and that it was not necessary, as had been suggested by HMRC in the Statement of Case that the phrase ‘branch of knowledge’ needed to relate to a recognised branch of science or the arts, as was recognised in the case of Carr . Furthermore, Parliament had not intended knowledge in general, this is why the phrase ‘branch of knowledge’ is used in 1(c).[37]The Tribunal was invited to look at what the IISP in fact does, and take account of the fact that, it is not the law that a profession must be based in academe; it was the application of knowledge that was the hallmark of a profession, and the IISP was in fact a regulatory body. With regard to the authorities relied on by the Commissioners, Mr McNicholas sought to distinguish them all in a variety of ways. In particular, the Committee of Directors of Polytechnics was distinguished on the basis that in that case the Directors all automatically became members; the Association of Payroll and Superannuation Administrators was distinguished on the basis that the members were highly specialised, which was not the case here; and the Institute of Leisure and Amenity Management on the basis that a concession had been made in that case by Counsel which was not made here. In the Institute of Legal Cashiers and Administrators it had been said that it was not the Crown’s case that:
“only the traditional learned professions were included in the term and the Commissioners accepted that times would change perceptions of what was and was not a profession …”
Mr McNicholas urged that times had now changed sufficiently for the IISP to be regarded as a professional body.[38]If the Tribunal did not accept that the IISP was a profession in Item 1(b), then the Institute was fostering professional expertise, connected with past or present professions or employment of its members within Item 1(c). We were invited to deconstruct Item 1(c), and take account of the fact that the separate requirements in 1(c) are disjunctive, and not to require the IISP to satisfy all the elements. Reasons for decision[39]Ms Mitrophanous had submitted lengthy and detailed closing submissions on behalf of HMRC. We do not propose to deal with those aspects of her submissions which deal with the Sixth Directive or the Principal Directive because it was no part of either 11SP’s nor of the Respondents’ case that the United Kingdom legislation did not properly reflect the Directive and we accept that position. Nor do we intend to deal with any of her arguments in respect of Item 1(a) of the UK legislation for similar reasons. The only aspect of European law which we do take into account is that the terms used to specify the exemptions envisaged in Article 132 of the Principal Directive are to be interpreted strictly as they constitute exceptions to the general principle that VAT applies.[40]We concur entirely with the remarks of the chairman of the Tribunal in the case of the Institute of Legal Cashiers and Administrators where he said:
“It is unfortunate that Parliament has left so arguable and difficult a question without offering the tribunal any guidelines on the way in which it should be addressed, still less adopting any more prescriptive a manner of implementing the EC Directives. As the law stands, there is we believe no alternative following the approach adumbrated by Du Parq LJ to which reference have already been made. We have every sympathy with the desire to bring some objectivity to the application of the law which Mr Smouha [who appeared on behalf of the appellant] have urged upon us by adopting more or less the criteria used by the Monopolies Commission in 1970, but we do not see ourselves as entitled to do more than bear those criteria in mind. Nor, on that basis, is it a matter of attempting meticulously to align the facts of this case with those of earlier decisions, though the public interest in consistency of decisions must nonetheless weigh with us heavily.”
[41]In the above case, membership was restricted to those seeking or holding a relevant qualification, and the qualifications for membership were examinations set by the Institute in conjunction with an independent party, the University of South West England, and were externally marked. It had a disciplinary committee, a code of ethics, a journal and a newsletter. The Tribunal did not accept that the type of work done by Institute members was part of the professional skill of solicitors and was thus in itself in the nature of a professional activity. It was stated that the solicitors will use the skills of the cashiers and accountants in their practices, but will have overall responsibility for that work. Furthermore the Institute members did not, in the words of the Tribunal, have “in any realistic way a fiduciary relationship with clients.” The Tribunal found that the body was not one of professionals under Item 1(b) primarily on the basis of the “severely technical and very constricted nature of the skill which its members acquire is inconsistent with the character of a profession as it is normally understood in England.” In respect of Item 1(c), the Tribunal held that it did not find that it could conclude that “severely practical matters with which the Institute is concerned make up a branch of knowledge.”[42]In the present case the qualifications for membership are not yet fully defined in the way they were in the above case, and such qualifications as were originally required, namely the CISSP and CISM certificates, are now not considered appropriate, being obtainable by people with restricted knowledge of the subject. There is no academic qualification for membership required at present, and, although we accept Mr McNicholas’ submission that the word ‘academic’ appears nowhere in the legislation, an ‘appropriate qualification’ is required by Item 1(b). All currently recognised professions do require some form of written test or examination for entry. Dr Coles himself recognised that the CIISP and CISM qualifications previously required for membership were too narrowly based. We do not regard an oral examination, even together with experience, however considerable in the field, can satisfy the requirement of Item 1(b), particularly bearing in mind the requirement that exemptions from VAT are construed narrowly. The fact that we were provided with no evidence beyond Dr Coles’ oral testimony of two institutions where information security could be studied is a matter of concern to us. Whilst not of itself necessarily indicating a basis on which the IISP’s appeal must fail, we can think of no profession which cannot be studied at a very large number of places throughout the country. To us this indicates that the IISP does not yet warrant being counted as a profession, albeit may one day become one.[43]We have set out at length the submissions made by Miss Mitrophanous on behalf of HMRC with regard to Item 1(b), and we accept those submissions. Mr McNicholas’ attempted to distinguish the various authorities on which she relied but, as we have stated above, this case is essentially a question of fact, and those authorities are no more than guidance as to how to interpret those facts. We do however have regard to Mr McNicholas’ submission that the various elements of Item 1(c) should be looked at disjunctively, which seems to us to be the correct approach. We can see no logical reason why the fact that we find that the Appellant does not come within Item 1(b) necessarily entails that it cannot bring itself within Item 1(c). We do not take the authorities cited by Miss Mitrophanous to mean that. We do accept that the word ‘professional’ in (c) must be interpreted in the same way as it is in (b), but that does not entail accepting that, because the IISP is not yet a profession, it cannot bring itself within (c). Whilst the IISPs members are not employed in a recognised profession, the intention of the IISP is to foster professional expertise within that employment in order that in time it may be recognised as a profession. If Parliament had intended that Item 1(c) could only be met by a body that has members who are members of a profession within (b) as Miss Mitrophanous submitted, it could have said so. As it is, (c) makes a specific distinction between ‘profession’ and ‘employment’[44]In deciding whether or not the IISP can bring itself within (c), we follow the decision of the tribunal in the case of EMIS National User Group (Decision 19645) where it said at paragraph 33 that:
“We readily accept Mr Morgan’s submission that for this purpose the tribunal must look at what the Appellant actually does in practice, in order to determine its primary purpose, and that we must consider what the Appellant actually provides to its members, rather than what the members do on their own account aided by the support of the Appellant.”
It is for us to decide on the facts what IISP’s primary purpose is, and it is not simply a matter of what any one connected with it may say, and we do not consider the fact that, as set out above, there is some distinction between the various descriptions of its purpose as given by those connected with it to mean that it has no discernible primary purpose. We further accept the decision of the tribunal in the case of EMIS where it said:
“40. The Appellant can have only one primary purpose. The advancement of a particular branch of knowledge connotes, in the tribunal’s judgment, the promotion of an academic study primarily for its own sake. We accept that such advancement or promotion is likely to have practical advantages as well, but in our view any such advantages are incidental to the promotion of the academic study. On the other hand, the fostering of professional expertise is essentially a practical matter, and this conclusion is reinforced, in the tribunal’s view, by the connection in the legislation itself between fostering and professional expertise and the past or present professions or employment of the organisations members.”
The tribunal in that case concluded that the activities of the appellant were essentially practical rather than theoretical, and then considered whether its primary purpose was the fostering of professional expertise, and concluded that its primary purpose was “… to assist and encourage its members to acquire and utilise the knowledge, skills and tools, which enable information to be collected, managed, used and shared to support the delivery of health care and promote health. This is done exclusively in the context of the use of EMIS software, and if, we accept, a practical and pragmatic purpose, but it is nonetheless one which we consider can fairly be described as the fostering of medical professional expertise connected with the appellant’s members profession.” The tribunal went on to allow the appeal in that case. That case was decided in 2006 and has not been appealed.[45]In this case we are particularly persuaded by the Cabinet Office’s view of the IISP as being an organisation fostering professional expertise, and endorsing its activities. Whilst Dr Coles is undoubtedly a very competent man, and experienced in information security, we do not accept his evidence that the main object of the IISP was to promote itself. We prefer the evidence of the chief operations officer as contained in the report of 17 July 2009 (see paragraph 21 above). This evidence coincides with Dr Coles’ evidence as to the work the Society does, and is consistent with Dr Coles’ evidence that the IISP existed to show that someone was competent in information security and that another of its purposes was to speak to the government and regulatory bodies. When looked at as a whole, in our judgment, taking all the evidence together, we conclude that its primary purpose is to advance the professionalism of information security practitioners and thereby the professionalism of the industry as a whole.[46]For the above reasons we allow this appeal to the extent that we find that the Appellant has brought itself within Item (c).[47]The Respondents to pay the Appellant’s costs but liberty to the Respondents to address us further on that issue if they wish to. MISS J C GORT TRIBUNAL JUDGE RELEASE DATE: 11 December 2009

Cited in 1 later judgment