Campbell v Secretary of State: [2018] UKUT 372 (AAC); [2019] AACR 12 [2018] UKUT 372 (AAC)

UPPER TRIBUNAL
ADMINISTRATIVE APPEALS CHAMBER
[2018] UKUT 372 (AAC)Case No GINS/5065/2014
Between
CampbellAppellantSecretary of StateRespondent
Date 8 November 2018Category: Tribunal procedure and practiceSubcategory: Information rights data protection, Tribunal procedure and practice lapsing of appeals, Tribunal procedure and practice tribunal jurisdiction
[1]applying the definition provided by Diplock LJ in Letang v Cooper, the appeal brought by Mr Campbell under section 28(4) of the DPA was not a “cause of action”. It did not represent "a factual situation the existence of which entitles one person to obtain from the court a remedy against another person." Rather, the section 28(4) procedure is no more than a statutory appeal route, a procedural mechanism, for challenging the issue of a national security certificate in the substantive section 7 subject access request proceedings (paragraph 29);[2]Mr Campbell’s rights under section 7 of the DPA were purely personal rights which did not survive his death as a cause of action. They were more akin to the rights under the matrimonial causes legislation than to other statutory rights which may pass to the estate (such as under discrimination law) (paragraph 32). The UT struck out the appeal for want of jurisdiction. DECISION OF THE UPPER TRIBUNAL (ADMINISTRATIVE APPEALS CHAMBER) The DECISION of the Upper Tribunal on the preliminary issue is to strike out the appeal under case reference GINS/5065/2014 (Mr D. Campbell, Deceased) for want of jurisdiction. This decision is given under section 28 of the Data Protection Act 1998 and rules 5(3)(e) and 8(2)(a) of the Tribunal Procedure (Upper Tribunal) Rules 2008 (SI 2008/2698). REASONS FOR DECISION The preliminary issue arising on these appeals[1]The immediate issue arising for determination in this appeal can be posed relatively simply: in the context of section 28(4) of the Data Protection Act 1998 (“the DPA”), does a data subject’s right of access to his personal data and to bring an appeal against the Secretary of State’s national security certificate survive his death? Although the question itself may be put shortly, the answer to that question is rather more complex.[2]We are treating this as a preliminary issue under rules 5(3)(e) and 8(2)(a) of the Tribunal Procedure (Upper Tribunal) Rules 2008 (SI 2008/2698). We are conscious that the outcome of this appeal will also have an impact on other similar cases. Section 28 of the Data Protection Act 1998[3]Section 28 of the DPA, so far as is material, provides as follows:
‘28.— National security (1) Personal data are exempt from any of the provisions of— (a) the data protection principles, (b) Parts II, III and V, and (c) sections 54A and 55, if the exemption from that provision is required for the purpose of safeguarding national security. (2) Subject to subsection (4), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in subsection (1) is or at any time was required for the purpose there mentioned in respect of any personal data shall be conclusive evidence of that fact. (3) A certificate under subsection (2) may identify the personal data to which it applies by means of a general description and may be expressed to have prospective effect. (4) Any person directly affected by the issuing of a certificate under subsection (2) may appeal to the Tribunal against the certificate. (5) If on an appeal under subsection (4), the Tribunal finds that, applying the principles applied by the court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may allow the appeal and quash the certificate.’
[4]Section 28 of the DPA, along with virtually all the rest of that Act, has now been repealed by section 211(1) of, and paragraph 44 of Schedule 19 to, the Data Protection Act 2018. However, transitional provisions stipulate that such repeal “does not affect the application of those provisions after the relevant time with respect to the processing of personal data to which the 1998 Act (including as it has effect by virtue of this Schedule) applies” (paragraph 17(1) of Schedule 20 to the Data Protection Act 2018; see also section 213(1)). It follows that we determine the present appeal by reference to the provisions and principles of the 1998 Act. We have no reason to think the position will be otherwise under the 2018 Act. The context of these appeals[5]The Upper Tribunal has before it three test case appeals, brought by Mr Don Campbell (now deceased; GINS/5065/2014), Mr Robert Fryers (GINS/5304/2014) and Mr Seamus Hogg (GINS/478/2015). All three men (“the Appellants”) were interned without trial in Northern Ireland in the early to mid-1970s. The present appeals relate to their efforts to gain access to the official records relating to their detention at that time. The Public Records Office Northern Ireland (PRONI) holds the documentary internment records under the superintendence of the Minister for Communities and subject to both the Public Records (Northern Ireland) Act 1923 and the DPA (as noted above, now replaced by the Data Protection Act 2018).[6]On 10 July 2013 the Appellants wrote to PRONI and made subject access requests under section 7 of the DPA, seeking “any legal papers and documentation you may have in relation to [our] detention and internment”. PRONI consulted with the Department of Justice and the Secretary of State for Northern Ireland before responding to the subject access requests.[7]On 2 October 2014, and in each of the three cases, the Secretary of State issued a certificate under section 28(2) of the DPA, certifying that exemption from the usual DPA rights was “required for the purpose of safeguarding national security” (see also section 28(1) of the DPA). Thus, this certification was on the basis that disclosure of some of the material contained within the PRONI records would, if disclosed, have serious adverse repercussions for national security. In due course PRONI responded to the Appellants’ subject access requests by providing copies of the documents it held, but with copious redactions. The redactions fell into three categories, namely those which were said to be covered by:(1) the certified national security exemption under section 28 of the DPA;(2) the exemption for prejudice to the prevention and detection of crime under section 29 of the DPA; and(3) compliance with other DPA obligations (e.g. to protect third party personal information). The Appellants’ present appeals are only concerned with the first category of exemption.[8]On 17 October 2014 each of the Appellants lodged an appeal under section 28(4) of the DPA.[9]On 17 January 2015 Mr Campbell, the appellant in the appeal with case reference GINS/5065/2014, died. The parties’ representatives subsequently agreed that the cases of Mr Campbell, Mr Fryers and Mr Hogg should proceed as test cases for a cohort of around 100 other cases in which the Secretary of State had issued section 28(2) certificates in response to subject access requests made by those who had been interned without trial during the same period. We return later to the nature of that agreement in the context of Mr Campbell’s own case. In practice the appeal has been maintained by Mr Campbell’s widow.[10]On 23 October 2014 Judge Nicholas Warren, the then Chamber President of the General Regulatory Chamber of the First-tier Tribunal, transferred Mr Campbell’s appeal to the Upper Tribunal as required by rule 19(1A) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (SI 2009/1976), as amended). The parties’ submissions in outline[11]We heard oral argument at a hearing in Belfast on 6 and 7 June 2018 which was followed by further detailed written submissions from the parties. In this part of our decision we do no more than summarise the main thrust of the parties’ respective contentions by way of setting the scene. We deal with the nuances in the advocates’ arguments in our analysis below.[12]Mr Paul McLaughlin, for the Secretary of State, submitted that the right of access conferred by section 7 of the DPA 1998 can only be exercised by a living individual, a principle evidenced both by the plain wording of the DPA and its broader scheme (including Directive 95/46/EC). As Mr Campbell is now deceased, Mr McLaughlin argued that neither his estate nor his next of kin could invoke section 7 DPA rights on his behalf. The right of appeal against the issue of a national security certificate was simply part of the procedure by which data subjects could enforce their section 7 rights; as section 7 rights did not survive the death of the data subject, the right of appeal also fell away. Furthermore, the statutory right of appeal under section 28(4) was not a “cause of action” within the meaning of section 14(1) of the Law Reform (Miscellaneous Provisions) Act (Northern Ireland) 1937 and so did not survive for the benefit of the estate. It followed that Mr Campbell’s appeal did not get to first base and should be struck out and dismissed by the Upper Tribunal.[13]Ms Fiona Doherty QC, for Mr Campbell’s widow, submitted to the contrary that the Upper Tribunal had jurisdiction to hear her late husband’s appeal. As is evident from the chronology above, Mr Campbell had been alive(i) when the section 7 subject access request had been made;(ii) when the Secretary of State’s section 28(2) certificate had been issued; and also(iii) when the Appellant’s section 28(4) appeal had been lodged. Neither section 28(4) or (5) is concerned with “personal data” as such, and the focus of section 28(5) (i.e. the test that the Upper Tribunal must apply) is on the date that the ministerial certificate was issued (“… the Minister did not have reasonable grounds for issuing the certificate …” (emphasis added)), a date when Mr Campbell was alive. Furthermore, and in any event, the relevant cause of action survived for the benefit of Mr Campbell’s estate by virtue of section 14(1) of the Law Reform (Miscellaneous Provisions) Act (Northern Ireland) 1937. The legislative framework for subject access requests[14]Section 1(1) of the DPA provides that ‘“data subject” means an individual who is the subject of personal data.’ So far as the latter term is concerned, section 1(1) further provides as follows: ‘“personal data” means data which relate to a living individual who can be identified—(a) from those data, or(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual’.[15]Section 7 of the DPA then sets out the individual’s right of access to personal data. ‘7.— Right of access to personal data(1) Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled— (a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller, (b) if that is the case, to be given by the data controller a description of— (i) the personal data of which that individual is the data subject, (ii) the purposes for which they are being or are to be processed, and (iii) the recipients or classes of recipients to whom they are or may be disclosed, (c) to have communicated to him in an intelligible form— (i) the information constituting any personal data of which that individual is the data subject, and (ii) any information available to the data controller as to the source of those data, and (d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his credit worthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.(2) A data controller is not obliged to supply any information under subsection (1) unless he has received— (a) a request in writing, and (b) except in prescribed cases, such fee (not exceeding the prescribed maximum) as he may require.(3) Where a data controller— (a) reasonably requires further information in order to satisfy himself as to the identity of the person making a request under this section and to locate the information which that person seeks, and (b) has informed him of that requirement, the data controller is not obliged to comply with the request unless he is supplied with that further information.(4) Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless— (a) the other individual has consented to the disclosure of the information to the person making the request, or (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.(5) In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.(6) In determining for the purposes of subsection (4)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard shall be had, in particular, to— (a) any duty of confidentiality owed to the other individual, (b) any steps taken by the data controller with a view to seeking the consent of the other individual, (c) whether the other individual is capable of giving consent, and (d) any express refusal of consent by the other individual.(7) An individual making a request under this section may, in such cases as may be prescribed, specify that his request is limited to personal data of any prescribed description.(8) Subject to subsection (4), a data controller shall comply with a request under this section promptly and in any event before the end of the prescribed period beginning with the relevant day.(9) If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.(10) In this section— “prescribed” means prescribed by the Secretary of State by regulations; “the prescribed maximum” means such amount as may be prescribed; “the prescribed period” means forty days or such other period as may be prescribed; “the relevant day”, in relation to a request under this section, means the day on which the data controller receives the request or, if later, the first day on which the data controller has both the required fee and the information referred to in subsection (3).(11) Different amounts or periods may be prescribed under this section in relation to different cases.’ The Upper Tribunal’s analysis[16]We start with a hypothetical. Let us accept for the sake of argument that, contrary to what happened, the Appellants made no section 7 subject access requests to PRONI on 10 July 2013. We also assume, as indeed was the case, that Mr Campbell died on 17 January 2015. In such a hypothetical we further assume that the section 7 requests were made four years later than was actually the case, i.e. on 10 July 2017, and were made by Mr Campbell’s widow, by Mr Fryers and by Mr Hogg. In those circumstances it is clear to us that Mrs Campbell’s purported section 7 request would be invalid. In making a request in 2017 for legal papers and other documentation about her late husband’s internment, she would not be making a request for “data which relate to a living individual” within section 1(1). Rather, her request would be targeted at data which related to a deceased individual and so would fall outside the ambit of section 7 on the plain words of the section. There is no need to invoke Directive 95/46/EC in support of that proposition. In short, in this scenario Mrs Campbell would have no standing under the DPA to make a section 7 subject access request on behalf of her late husband. She would, of course, as Mr McLaughlin pointed out, have been able to make a request under the Freedom of Information Act 2000 (“FOIA”) for relevant information held by the public authority in question. It is only right to say that were she to do so, as Mr McLaughlin recognised, PRONI might well seek to rely on one or more of several absolute or qualified exemptions under FOIA so as to resist disclosure, including exemptions relating to national security. We did not understand Ms Doherty to dissent from that analysis of the hypothetical scenario we describe.[17]The central question for us is whether that analysis is also applicable to the actual situation that has arisen in this case. As Ms Doherty reminded us, the present appeal is factually not the same as our hypothetical in several respects. Mr Campbell was undoubtedly alive at the time he made his section 7 request – he was also alive when the Secretary of State issued her section 28 certificate and indeed when the section 28(4) appeal to the Tribunal was lodged. Does the fact that his appeal was already on foot enable us to distinguish the hypothetical case and lead to a different result? As Ms Doherty correctly notes, neither the DPA itself nor the Tribunal Procedure (Upper Tribunal) Rules 2008 (SI 2008/2698) specifically deals with these circumstances, although rule 9(3) of the 2008 Rules does provide that “a person who is not a party may apply to the Upper Tribunal to be added or substituted as a party”. However, that discretionary power as to procedure provides no answer to the jurisdictional question as to whether in the first place the right of appeal under section 28 survives the appellant’s death. In the absence of a bespoke statutory answer to that question, it follows that we are thrown back onto consideration of first principles. In that context, and in support of her contention that Mr Campbell’s appeal survived his death, Ms Doherty’s submissions focussed first specifically on the terms of section 28 of the DPA and then more generally on the wider picture as regard the survival of causes of action.[18]So far as section 28 is concerned, Ms Doherty reminded us of the terms of subsections (4) and (5):
‘(4) Any person directly affected by the issuing of a certificate under subsection (2) may appeal to the Tribunal against the certificate. (5) If on an appeal under subsection (4), the Tribunal finds that, applying the principles applied by the court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may allow the appeal and quash the certificate.’
[19]Ms Doherty’s argument ran as follows. Mr Campbell, when alive, had exercised his right of appeal under section 28(4) as “any person directly affected by the issuing of a certificate” under section 28(2). There was no reference within section 28(4) to the notion of “personal data”. The Tribunal is now bound to apply the test in section 28(5), which again makes no mention of “personal data”. Rather, section 28(5) requires the Tribunal to focus on the circumstances as they were at the date when the section 28(2) certificate was issued. Accordingly, the test is whether at that time (when Mr Campbell was alive) “the Minister did not have reasonable grounds for issuing the certificate”. For all those reasons the section 28 appeal survived the death of Mr Campbell.[20]However, we do not consider the absence of any reference to “personal data” within section 28(4) and (5) leads to the conclusion that Ms Doherty invites us to reach. Nor does the backward-looking nature of the test in section 28(5) assist, as that is no more than being entirely consistent with the judicial review approach mandated by that provision. The fundamental difficulty with Ms Doherty’s submissions is that they do not address the true nature of the section 28 procedure. Mr Campbell, as with the other data subjects, had no freestanding right to lodge an appeal under section 28(4). He could only do so because the Secretary of State had issued him with a national security certificate under section 28(2) in response to his section 7 request. The effect of that certificate was to restrict the scope of his section 7 subject access rights. As Mr McLaughlin put it, the section 28(4) appeal procedure does not have an independent existence separate from the underlying section 7 subject access rights. The section 28(4) appeal procedure is wholly ancillary to, and parasitic upon, the data subject’s rights under section 7.[21]Is there another way in which Mr Campbell’s appeal rights may be seen as surviving his death? In terms of the wider picture, Ms Doherty prayed in aid section 14(1) of the Law Reform (Miscellaneous Provisions) Act (Northern Ireland) 1937 (which is in the same terms as section 1(1) of the Law Reform (Miscellaneous Provisions) Act 1934 in Great Britain) as to the survival of causes of action. Section 14(1) and (1A) provide as follows:
‘14 Effect of death on certain causes of action (1) Subject to the provisions of this section, on the death of any person after the commencement of this Act all causes of action subsisting against or vested in him shall survive against, or, as the case may be, for the benefit of, his estate: Provided that this sub-section shall not apply to causes of action for defamation. (1A) The right of a person to claim under Article 3A of the Fatal Accidents (Northern Ireland) Order 1977 (bereavement) shall not survive for the benefit of his estate on his death.’
[22]As Ms Doherty noted, the expression “cause of action” itself is not defined in the 1937 Act. Ms Doherty therefore relied in part on the following broad definitions in section 120 of the Judicature (Northern Ireland) Act 1978: ‘“action” means a civil proceeding commenced by writ or in such other manner as may be prescribed by rules of court, but does not include a criminal proceeding by or in the name of the Crown; … “cause” includes any action, suit or other original proceeding between a plaintiff and a defendant, and any criminal proceeding by or in the name of the Crown; … “defendant” includes any person served with any writ of summons or process or served with notice of, or entitled to attend, any proceedings; … “plaintiff” includes every person asking any relief (otherwise than by way of counter-claim as a defendant) against any other person by any form of proceeding, whether the proceeding is by action, suit, petition, motion, summons or otherwise;’.[23]Ms Doherty further relied on the judgment of Diplock L.J. (as he then was) in Letang v Cooper [1965] 1 QB 232 (her emphasis added):
‘A cause of action is simply a factual situation the existence of which entitles one person to obtain from the Court a remedy against another person. Historically the means by which the remedy was obtained varied with the nature of the factual situation and causes of action were divided into categories according to the "form of action" by which the remedy was obtained in the particular kind of factual situation which constituted the cause of action. But that is legal history, not current law. If A., by failing to exercise reasonable care, inflicts direct personal injury upon B., those facts constitute a cause of action on the part of B. against A. for damages in respect of such personal injuries. The remedy for this cause of action could before 1873 have been obtained by alternative forms of action, namely, originally either trespass vi et armis or trespass on the case, later either trespass to the person or negligence. (See Bullen & Leake, 3rd Edition). Certain procedural consequences, the importance of which diminished considerably after the Common Law Procedure Act of 1852, flowed from the plaintiff's pleader's choice of the form of action used. The Judicature Act of 1873 abolished forms of action. It did not affect causes of action; so it was convenient for lawyers and legislators to continue to use, to describe the various categories of factual situations which entitled one person to obtain from the Court a remedy against another, the names of the various "forms of action" by which formerly the remedy appropriate to the particular category of factual situation was obtained. But it is essential to realise that when, since 1873, the name of a form of action is used to identify a cause of action, it is used as a convenient and succinct description of a particular category of factual situation which entitles one person to obtain from the Court a remedy against another person. To forget this will indeed encourage the old forms of action to rule us from their graves.’
[24]Ms Doherty also relied upon the commentary on section 14(1) of the 1937 Act in Valentine, All Laws of Northern Ireland, which notes the old common law rule as being to the effect that actio personalis moritur cum persona (‘a personal right of action dies with the person’). However, Valentine then qualifies that statement of principle in two important respects. First, according to Valentine “an action or application based on a statutory right is not an actio personalis and does not abate on death” (citing Benson v Secretary of State [1976] NI 36 (CA)). Second, Valentine further notes that as a result of section 14 “all causes of action by or against a person survive on death to or against his estate (even if damage arose at or after death), except actions for defamation”, and that a statutory claim for compensation for unlawful discrimination survives death (see Harris v Lewisham and Guy’s Mental Health Trust [2000] 3 All ER 769 (CA)).[25]We do not consider that the common law maxim, however venerable, is a sensible starting point for the proper construction of a modern statutory scheme and in particular section 28 of the DPA. Nor do we accept one facet of Mr McLaughlin’s submissions, which was that the scope of section 14 of the 1937 Act is limited to civil proceedings in tort and for that reason alone has no purchase in the present context. However, on closer analysis nor do we consider that the two qualifications set out in Valentine’s commentary assist Ms Doherty’s case.[26]First, in Benson the Northern Ireland Court of Appeal held (according to the headnote, with emphasis added) that “where a claim to compensation is based on a statutory right, the right survives the death of the claimant and passes to his personal representative; and it is not necessary to consider whether the claim came within section 14 of the Law Reform (Miscellaneous Provisions) Act (Northern Ireland) 1937.” In our view that statement of principle in the headnote properly reflects the true ratio of the judgments of both Jones and Gibson LJJ in Benson, whereas the bald statement in Valentine ̶ “an action or application based on a statutory right is not an actio personalis and does not abate on death” ̶ is expressed with rather too broad a brush.[27]Second, the statement that section 14 means that “all causes of action by or against a person survive on death to or against his estate” merely begs the question as to what is a “cause of action” in the first place. In this context it is instructive to consider in more detail Harris v Lewisham and Guy’s Mental Health Trust, where the Court of Appeal in England and Wales held that a complaint brought under the then Race Relations Act 1976 survived the death of the complainant (Mrs Andrews), and so could be pursued by her personal representative (her daughter, Mrs Harris) against the complaint’s employer (the Trust). Mummery LJ set out the position with characteristic great clarity thus (with emphasis as in the original): ‘30. The legal position is as follows:[1]On the death of Mrs Andrews all causes of action vested in her survived for the benefit of her estate: section 1 (1) Law Reform (Miscellaneous Provisions) Act 1934.[2]The 1934 Act excludes certain causes of action, such as defamation, but the Act does not contain any express exclusion applicable to this case.[3]In the absence of a statutory definition of "cause of action " in the 1934 Act that expression bears its ordinary meaning of "... a factual situation the existence of which entitles one person to obtain from the court a remedy against another person." See Letang v Cooper [1965] 1 QB 232 at 243 per Diplock LJ.[4]Mrs Andrews' claim was a cause of action in that sense. In her originating application she set out facts in support of her complaint of race discrimination against the NHS Trust. If she established her claim the Tribunal had power to order the NHS Trust to pay compensation to her, if it considered it just and equitable to do so. The amount of the compensation awarded would correspond to the damages which the county court could have ordered in civil proceedings in like manner as a claim in tort. See sections 56 (1) (b) and 57 (1) (b) of the 1976 Act.[5]A claim for compensation for the commission of a "statutory tort", as a complaint under the Discrimination Acts has been described, does not fail to qualify as a "cause of action" because the Employment Tribunal has exclusive jurisdiction to adjudicate upon it. Diplock LJ's reference to a "court" is not confined to courts of law in the narrow or traditional sense. For the reasons given by Rose LJ in Peach Grey & Co v Sommers [1995] ICR 549 at 557, 558 an Employment Tribunal is a "court" in which specified statutory causes of action in the employment field are enforceable.[6]The fallacy in the Trust's submission is that it fails to give full force and effect to section 1(1) of the 1934 Act , which made "comprehensive provision" for the survival of causes of action "over the whole field" to which the old common law maxim on the demise of the "actio personalis" had applied: Ronex Properties Ltd v John Laing Construction Ltd [1983] QB 398 at 405 F-G. It is wrong to hark back to the pre-1934 position and to apply the common law maxim by asking whether the rights conferred by, and actions under, the 1976 Act are "personal actions" and whether they are assignable by operation of law. The Appeal Tribunal characterised rights under the 1976 Act as "of a largely personal nature which Parliament has not deemed fit to provide should devolve on the estate." That approach is wrong because it disregards the fundamental change in the law made by the 1934 Act. The point is not whether the action is "personal" or whether it is assignable, but whether the person who has died had a "cause of action." If he had a cause of action, the benefit of it passed to his estate. The correct question is whether the complaint by Mrs Andrews under the 1976 Act was a "cause of action" within the meaning of the 1934 Act. If it was, the benefit of it passed to her estate whether it was a "personal action" or not. This does not mean that all benefits conferred by or recoverable under all statutes survive death. See, for example, D'Este v D'Este [1983] Fam 55 at 59 (Application for financial provision under the matrimonial causes legislation not a "cause of action"). It is necessary to decide in each case whether the person who has died had a "cause of action" within the meaning of the 1934 Act.[7]There is no provision in the 1976 Act precluding a complaint of the kind made by Mrs Andrews from being a cause of action or from devolving on her estate. The NHS Trust relied on section 53 (1) which restricts proceedings for breach of the 1976 Act to those provided by the Act. That sub-section does not exclude or disapply the provisions of the 1934 Act. The proceedings started by Mrs Andrews were under Part II of the Act. The death of Mrs Andrews does not mean that they have ceased to be proceedings under the 1976 Act. Mrs Harris, as personal representative, is entitled to continue the subsisting proceedings under that Act as a result of the vesting in the estate of the cause of action under the Act.[8]There is no procedural obstacle of the kind suggested by the Trust to substituting Mrs Harris as the personal representative of her late mother and giving her leave to carry on the existing proceedings. Rule 13 of the 1993 Rules is wide enough to empower the Chairman to make the order he made on 6 November 1998.[9]The Trust's submission, if accepted, would result in anomalous situations which Parliament probably did not intend to create. It is not uncommon for the circumstances of a dismissal to give rise to three claims:(a) unfair dismissal contrary to the Employment Rights Act 1996 ;(b) wrongful dismissal at common law; and(c) discriminatory treatment contrary to the 1976 Act (or the Sex Discrimination Act 1975 or the Disability Discrimination Act 1995). It is accepted by the NHS Trust that claims (a) and (b) would survive death. I can think of no rational ground on which Parliament would intend that claim (c) arising out of the very same facts should perish with the victim. The death of the victim may add to the problems of proving discrimination, but that would also be true of claims for unfair and wrongful dismissal based on the alleged discriminatory conduct of the employer.’[28]So, adapting a passage from paragraph 30(6) of the judgment of Mummery LJ to the present context:
‘The point is not whether the action is "personal" or whether it is assignable, but whether the person who has died had a "cause of action." If he had a cause of action, the benefit of it passed to his estate. The correct question is whether the [appeal by Mr Campbell under section 28(4) of the DPA] was a "cause of action" within the meaning of the [1937] Act. If it was, the benefit of it passed to [his] estate whether it was a "personal action" or not.’
[29]Applying the definition provided by Diplock LJ in Letang v Cooper, the appeal brought by Mr Campbell under section 28(4) of the DPA was not in our view a “cause of action”. It did not represent "a factual situation the existence of which entitles one person to obtain from the court a remedy against another person." Rather, the section 28(4) procedure is no more than a statutory appeal route, a procedural mechanism, for challenging the issue of a national security certificate in the substantive section 7 subject access request proceedings. As noted above, there is no freestanding right to bring a section 28(4) appeal; it presupposes that a section 7 request has been made and a section 28(2) certificate has been issued.[30]The question then is whether the section 7 request itself can be seen as giving rise to a “cause of action” within the meaning of section 14(1) of the 1937 Act. We do not consider that it can. As Mummery LJ observed, the 1934 Act (and so likewise the 1937 Act) “does not mean that all benefits conferred by or recoverable under all statutes survive death”. Mummery LJ cites, by way of example, an application for financial provision under the matrimonial causes legislation: D'Este v D'Este [1983] Fam 55. There Ormrod J held that the court had no jurisdiction to entertain an application by the administratrix of the deceased's estate (whether under the Matrimonial Causes Act 1965, s.17, or the Matrimonial Proceedings and Property Act 1970, s.4), because the legislation implied that the parties to a marriage should be alive at the hearing of an application for variation of settlements. Likewise, Ormrod J held that the 1934 Act had no relevance to the personal jurisdiction derived from the matrimonial causes legislation (at 59B-D):
‘It seems to me, first of all, in broad principle that the Act of 1934 was passed to deal with a particular anomalous ruling or common law rule which had existed for centuries, and it was directed essentially to that. It seems to me that one must be extraordinarily cautious in extending or widening the meaning of the phrase "cause of action," particularly when one is asked to extend it into a completely different section of the law. In my judgment, the real answer to this application is this, that the whole of the matrimonial causes legislation, right back to 1857, is essentially a personal jurisdiction arising between parties to the marriage or the children of the marriage. The death of one or other of the parties to the litigation has nothing whatever to do with the old common law rule which was abrogated by the Act of 1934. The fact that these applications abate by death derives, in my judgment, from the legislation which created the rights, if they are rightly called "rights," and from no other source. If that is correct, then it is not necessary to examine very closely whether or not the administratrix in this case has something which could be called, by any stretch of imagination, a cause of action.’
[31]As the commentary in Valentine also notes, a divorce petition abates on death, but not all ancillary proceedings (see Purse v Purse [1981] Fam 143). Similarly, a claim under the Inheritance (Provision for Family and Dependants) (Northern Ireland) Order 1979 abates on the claimant’s death (see by analogy Whytte v Ticehurst [1986] Fam 64; see also Re Bramwell (Deceased); Campbell v Tobin [1988] 2 FLR 263), but not the right to payments under an interim order that was made before the claimant’s death (O’Reilly v Mallon [1995] NI 1). As Booth J held in Whytte v Ticehurst, “the claim that may be made on the death of one party is personal to the survivor. Upon the death of both parties to the marriage the claim must cease to exist” (at 70F). Furthermore, as Wall LJ subsequently observed, “to treat unresolved applications for matrimonial financial relief as causes of action under the 1934 Act which could be continued after the death of the deceased would run wholly counter to the statutory scheme, and could cause substantial difficulties in practice” (Harb v King Fahd Bin Abdul Aziz [2006] 1 WLR 578 at 595B).[32]We conclude that Mr Campbell’s rights under section 7 of the DPA were purely personal rights which did not survive his death as a cause of action. They are more akin to the rights under the matrimonial causes legislation than to other statutory rights which may pass to the estate (such as under discrimination law). We reach that conclusion for the following reasons. Section 7(1) is pre-eminently an individual and personal right. This much is plain from the terms of section 7 itself. In particular, section 7(1)(c) provides that the individual has the right “to have communicated to him in an intelligible form— (i) the information constituting any personal data of which that individual is the data subject” (emphasis added). As Mr McLaughlin submitted, the section 7 right is a right the individual data subject has as against the data controller. Thus, the data controller is entitled to be satisfied of the identity of the particular data subject making the subject access request (see section 7(3)). Section 7(4) likewise reinforces the bilateral and personal relationship between data controller and data subject. The very premise of section 7 is that it establishes a personal right for the data subject to have access to his or her own personal data. It is not a right for a third party, however close to the deceased, to be granted such access.[33]The characterisation of the data subject’s subject access rights under section 7 of the DPA as being personal in nature is reinforced when one considers Directive 95/46/EC (on the protection of individuals with regard to the processing of personal data and on the free movement of such data). Thus Article 1 of the Directive requires Member States to “protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data”. To the same end, Recital 41 to the Directive declares that “any person must be able to exercise the right of access to data relating to him which are being processed, in order to verify in particular the accuracy of the data and the lawfulness of the processing”.[34]It follows that even if the proper focus is section 7 of the DPA, and not the procedural appeal rights under section 28(4), we are satisfied that there is no cause of action which survives for the benefit of Mr Campbell’s estate under the 1937 Act. The parties’ previous agreement[35]It was only at the hearing on 6 June 2018 that the Respondent took the point that Mr Campbell’s appeal should be dismissed simply on the basis that it had not survived his death. The background to this very late change of position was as follows.[36]On 9 February 2015 Mr Campbell’s solicitor notified the Upper Tribunal of his death (on 17 January 2015) and asked if a family member could continue the appeal on his behalf.[37]On 26 April 2016 an Upper Tribunal Registrar wrote to the parties as follows:
‘The lead case of Mr Campbell (deceased) The Tribunal notes (Mr Ó Muirigh’s letter of 9 February 2015) that Mr Campbell has sadly passed away, and Mr Ó Muirigh asks whether a family member can continue that appeal on his behalf. The starting point is that in principle a personal representative can pursue an outstanding appeal before the Tribunal on the deceased’s behalf. There is a potential complication in that in this case the data in question will no longer be personal data under the 1998 Act. However, it seems the issue for the Tribunal is rather whether or not the Minister had reasonable grounds for issuing the certificate at the relevant time, and not the status of the disputed information in question. There appears to be no express provision in the Rules dealing with such an eventuality. However, and without the benefit of argument, it would appear on the basis of general principles that Mr Campbell’s personal representative can continue the action (see section 1(1) Law Reform (Miscellaneous Provisions) Act 1934 and e.g. Barder v Calouri [1988] AC 20). Nonetheless, in the light of this it would be helpful if (i) Mr Ó Muirigh can confirm that there is a personal representative for Mr Campbell who is available to continue the action (or, if not, steps can be put in train to appoint one); and (ii) both parties’ representatives can confirm that notwithstanding Mr Campbell’s demise they are agreed that his appeal remains an appropriate one to be one of the three lead cases in these proceedings more generally.’
[38]The Registrar’s letter was followed by e-mail correspondence between the parties’ representatives. On 6 June 2016 the Secretary of State’s representative e-mailed in the following terms: “I confirm that my client has no objection to Mr Campbell’s case remaining one of the lead cases”.[39]In those circumstances, Ms Doherty argues that in any event Mrs Campbell should be permitted to proceed with the appeal by way of substitution under rule 9. As she explained:
‘The Appellant sought the consent of the SoS [Secretary of State] to stand in the place of her husband and, after a considerable time when the matter was presumably the subject of careful consideration, the SoS did so consent (as did the Tribunal). In the particular circumstances of the present case, where Mrs Campbell has prosecuted this matter for several years and had all of the usual anxieties which are inevitably attendant with litigation; that is, she attended with solicitors, received and responded to their letters, provided instructions, attended consultations and hearings and generally concerned herself with this case.’
[40]So, Ms Doherty submits, ‘In light of the background of her engagement with these proceedings and the steps taken by her having relied upon the SoS’s consent (and that of Tribunal), the Tribunal should, we submit, consider that she has a legitimate expectation that she can stand in her husband’s place and therefore, irrespective of the general position, that she has accrued status as a party to the proceedings.’[41]That argument is understandable on a human level. The Respondent’s very belated change of position is certainly less than satisfactory. However, if on a true analysis there is as a matter of law no such appeal to continue to prosecute, as we have now determined following detailed submissions, it follows that Mrs Campbell cannot be nominated to act in place of her late husband. It does not seem to us that any procedural expectation created by the Respondent in this respect is capable in itself of conferring the necessary powers on this tribunal. Conclusion[42]We therefore find that Mr Campbell’s appeal under section 28(4) did not survive his death. It follows that it is appropriate that we strike out the appeal in GINS/5065/2014 under rule 8(2)(a) for want of jurisdiction. Even if we are wrong in our conclusion on the question of jurisdiction, in the circumstances there would in our judgment be no reasonable prospect of Mr Campbell’s widow or any other representative obtaining any substantive relief as part of this appeal so that, applying judicial review principles, we consider that there would be no reasonable prospect of the appeal succeeding and the certificate being quashed. In those circumstances we would in any event strike the appeal out in our discretion under rule 8(3)(c).

Cited in 2 later judgments