Fryers and Hogg v Secretary of State for Northern Ireland: [2019] UKUT 22 (AAC) [2019] UKUT 22 (AAC)

UPPER TRIBUNAL
ADMINISTRATIVE APPEALS CHAMBER
[2019] UKUT 22 (AAC)Case No GINS/5304/2014, GINS/478/2015, GINS/5065/2014
Between
Fryers and HoggAppellantSecretary of State for Northern IrelandRespondent
Before
Purchas QCWikeleyDate 17 January 2019Category: Tribunal procedure and practiceSubcategory: Information rights data protection, Tribunal procedure and practice lapsing of appeals, Tribunal procedure and practice tribunal jurisdiction
[1]The present two appeals – the cases of Mr Robert Fryers (GINS/5304/2014) and Mr Seamus Hogg (GINS/478/2015) – arise out of the practice of internment in Northern Ireland in the early to mid-1970s.[2]In 2013 the two Appellants, along with many others who were similarly interned, wrote to the Public Records Office Northern Ireland (PRONI) making subject access requests under section 7 of the Data Protection Act 1998 (“the 1998 Act”). They requested “any legal papers and documentation you may have in relation to [our] detention and internment”.[3]PRONI responded to the Appellants’ subject access requests by providing copies of the documents it held, but with copious redactions. The redactions fell into three categories, namely those which were said to be covered by:(1) the national security exemption under section 28 of the 1998 Act;(2) the exemption for prejudice to the prevention and detention of crime under section 29 of the same statute; and(3) compliance with other obligations under that legislation (e.g. to protect third party personal information). The Appellants’ present appeals are only concerned with the first category of exemption.[4]In tandem the Secretary of State for Northern Ireland issued certificates under section 28(2) of the 1998 Act, certifying that exemption from the usual DPA rights was “required for the purpose of safeguarding national security” (see also section 28(1) of the 1998 Act). This certification was on the basis that disclosure of some of the material contained within the PRONI records would, if disclosed, have serious adverse repercussions for national security. The Appellants lodged appeals against those certificates with the First-tier Tribunal (see section 28(4) of the 1998 Act), along with about 100 other affected individuals.[5]The then Chamber President of the General Regulatory Chamber of the First-tier Tribunal, transferred the appeals to the Upper Tribunal, as required by rule 19(1A) of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (SI 2009/1976), as amended). The parties’ representatives subsequently agreed that three appeals should proceed as test cases for the whole cohort of cases in which the Secretary of State had issued section 28(2) certificates. The three appeals were the present two appeals and a third appeal lodged by Mr Don Campbell (now deceased; GINS/5065/2014).[6]We held an oral hearing of those three appeals in Belfast on 6 and 7 June 2018. It is fair to say the Appellants’ case, which had originally been pleaded primarily on the basis of a claimed breach of their Convention rights, changed tack at a very late stage. As put at the oral hearing, the Appellants’ submission was that that the certificates were based on a mistake of fact or a failure to take account of a relevant consideration, namely prior disclosure of the information requested. It was further argued that the issue of the certificates was irrational, not least as relevant papers in the case of at least one other Fryers and Hogg v Secretary of State for Northern Ireland [2019] UKUT 22 (AAC) GINS/5304/2014 and GINS/478/2015 2 internee had been released without redactions (an argument that the Appellants had maintained throughout). Following that adjourned hearing, we issued further case management directions to the parties on 13 June 2018, concerning the submission of additional evidence and further written submissions relating to both(i) the preliminary issue arising in GINS/5065/2014 (namely whether Mr Campbell’s appeal survived his death) and(ii) the substantive issues raised by all three appeals. We set a final hearing date of 20 September 2018.[7]On 24 August 2018 the Respondents wrote to the Upper Tribunal in the following terms, referring for the first time to the impact of the 2018 Act:
‘During the interim period, the Respondent has given careful consideration to the new grounds of challenge and also to the fact that, following the recent commencement of the Data Protection Act 2018, she will be required to review all existing DPA certificates and, if appropriate, issue fresh certificates before 25 May 2019 (failing which the existing certificates will cease to have effect). In the light of these changing circumstances, the Secretary of State has decided that she wishes to carry out a review, now, of the certificates currently under appeal in Fryers and Hogg … as required under the DPA 2018. Following this review she will withdraw the existing certificates and, if she decides that an exemption under the Data Protection Act 2018 (which is in substantively the same terms as that under section 28 of the DPA) continues to be required in order to safeguard the interests of national security, she will decide whether to issue a fresh Certificate, in relation to some or all of the information. In the cases of Fryers and Hogg, the Respondent therefore proposes to withdraw the certificates under appeal, following the forthcoming review, with the result that it is not considered that it is necessary for the appeal to continue.’
[8]That letter concluded by stating that the Respondent “has decided not to file any further substantive evidence and it will not invite the Court to rule upon the underlying issues in the appeal”. It is unclear to us why we were not referred to the 2018 Act at the hearing in June.[9]On 6 September 2018 the Appellants responded, opposing the course of action proposed by the Respondent, and urging the Upper Tribunal to proceed to determine all three appeals. The Appellants pointed out that the certificates were still in force and no indication of a date for their withdrawal had been given. The Appellants further noted that the appeals had already been running for nearly four years and the Upper Tribunal’s ruling would provide guidance both for the determination of all the stayed appeals and for any new appeals against subsequent certificates.[10]The Respondent replied by letter dated 11 September 2018, reporting that it was anticipated the reviews in the cases of Mr Fryers and Mr Hogg would be completed by 10 October 2018, which would result in the existing certificates being withdrawn. The Respondent further argued that any ruling on the wording of the existing certificates would be redundant as the certificates in the stayed cases would also be withdrawn in the coming months. The Respondent submitted that the further hearing “could not result in any meaningful remedy – the Tribunal cannot quash a certificate no longer in place”. Fryers and Hogg v Secretary of State for Northern Ireland [2019] UKUT 22 (AAC) GINS/5304/2014 and GINS/478/2015 3[11]The Appellants replied promptly by letter dated 12 September 2018, maintaining their position and noting the risk of further significant slippage in the timescales. On the same day we issued further directions vacating the hearing scheduled for 20 September 2018 and requiring the Respondent “by 10 October 2018 to lodge a statement with the Upper Tribunal confirming whether the current DPA national security certificates in respect of the Appellants in the test cases have been withdrawn and new certificates issued”.[12]On 10 October 2018 the Respondent lodged such a statement. This revealed that the existing statements for Mr Fryers and Hogg had been withdrawn and new certificates had been issued in both cases on 8 October 2018. These are in similar but by no means identical terms to the original certificates.[13]On 8 November 2018 we issued a decision on the preliminary issue arising in GINS/5065/2014 (see Campbell v Secretary of State [2018] UKUT 372 (AAC)). Our decision was that Mr Campbell’s appeal under section 28(4) of the 1998 Act did not survive his death on 17 January 2015. We accordingly struck out his appeal under rule 8(2)(a) of the Tribunal Procedure (Upper Tribunal) Rules 2008 (SI 2008/2698) for want of jurisdiction.[14]That leaves us with the appeals by Mr Fryers and Mr Hogg to determine. The starting point must be the 1998 and the 2018 Acts. Section 28 of the 1998 Act, along with virtually all the remainder of that Act, has now been repealed by section 211(1) of, and paragraph 44 of Schedule 19 to, the Data Protection Act 2018 (“the 2018 Act”). Sections 27, 79 and 111 of the 2018 Act make provision for ministerial national security certificates in terms which are materially the same as section 28 of the 1998 Act. The repeal of section 28 itself was effective from 25 May 2018 (see regulation 2(2)(g) of the Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018 (SI 2018/625)). However, section 213(1) of the 2018 Act provides that Schedule 20 thereto “contains transitional, transitory and saving provision”. Part 5 of Schedule 20 deals specifically with national security certificates, and paragraph 17 makes specific provision for certificates issued under the 1998 Act:
‘National security certificates: processing of personal data under the 1998 Act 17(1) The repeal of section 28(2) to (12) of the 1998 Act does not affect the application of those provisions after the relevant time with respect to the processing of personal data to which the 1998 Act (including as it has effect by virtue of this Schedule) applies. (2) A certificate issued under section 28(2) of the 1998 Act continues to have effect after the relevant time with respect to the processing of personal data to which the 1998 Act (including as it has effect by virtue of this Schedule) applies. (3) Where a certificate continues to have effect under sub-paragraph (2) after the relevant time, it may be revoked or quashed in accordance with section 28 of the 1998 Act after the relevant time. (4) In this paragraph, “the relevant time” means the time when the repeal of section 28 of the 1998 Act comes into force.’
[15]Thus, the repeal of section 28(2) to (12) of the 1998 Act “does not affect the application of those provisions after the relevant time with respect to the processing of personal data” under the 1998 Act (paragraph 17(1) of Schedule 20 to the 2018 Act). In particular, a national security certificate issued under section 28(2) of the 1998 Act lives on after the demise of section 28 itself (see paragraph 17(2); “the relevant time” for the purpose of paragraph 17(4) being 25 May 2018). However, this is but a temporary reprieve, as any such Fryers and Hogg v Secretary of State for Northern Ireland [2019] UKUT 22 (AAC) GINS/5304/2014 and GINS/478/2015 4 certificate “may be revoked or quashed in accordance with section 28 of the 1998 Act after the relevant time” (paragraph 17(3)).[16]Further “transitional, transitory and saving provision” for section 28 certificates is made by paragraph 18 of Schedule 20 to the 2018 Act:
‘National security certificates: processing of personal data under the 2018 Act 18(1) This paragraph applies to a certificate issued under section 28(2) of the 1998 Act (an “old certificate”) which has effect immediately before the relevant time. (2) If and to the extent that the old certificate provides protection with respect to personal data which corresponds to protection that could be provided by a certificate issued under section 27, 79 or 111 of this Act, the old certificate also has effect to that extent after the relevant time as if— (a) it were a certificate issued under one or more of sections 27, 79 and 111 (as the case may be), (b) it provided protection in respect of that personal data in relation to the corresponding provisions of this Act or the applied GDPR, and (c) where it has effect as a certificate issued under section 79, it certified that each restriction in question is a necessary and proportionate measure to protect national security. (3) Where an old certificate also has effect as if it were a certificate issued under one or more of sections 27, 79 and 111, that section has, or those sections have, effect accordingly in relation to the certificate. (4) Where an old certificate has an extended effect because of sub-paragraph (2), section 130 of this Act does not apply in relation to it. (5) An old certificate that has an extended effect because of sub-paragraph (2) provides protection only with respect to the processing of personal data that occurs during the period of 1 year beginning with the relevant time (and a Minister of the Crown may curtail that protection by wholly or partly revoking the old certificate). (6) For the purposes of this paragraph— (a) a reference to the protection provided by a certificate issued under— (i) section 28(2) of the 1998 Act, or (ii) section 27, 79 or 111 of this Act, is a reference to the effect of the evidence that is provided by the certificate; (b) protection provided by a certificate under section 28(2) of the 1998 Act is to be regarded as corresponding to protection that could be provided by a certificate under section 27, 79 or 111 of this Act where, in respect of provision in the 1998 Act to which the certificate under section 28(2) relates, there is corresponding provision in this Act or the applied GDPR to which a certificate under section 27, 79 or 111 could relate. (7) In this paragraph, “the relevant time” means the time when the repeal of section 28 of the 1998 Act comes into force.’
[17]It follows that a ministerial certificate issued under section 28 of the 1998 Act, which has been given an extended lease of life by virtue of paragraph 17(2) of Schedule 20 to the 2018 Act, in effect continues in existence as if made under one of the equivalent provisions in the 2018 Act (paragraph 18(1)-(3)). However, such continued effect is limited to a maximum of one year as from the relevant time (paragraph 18(5)). It follows that no such certificate can survive beyond 25 May 2019 and indeed its “extended effect” may cease at Fryers and Hogg v Secretary of State for Northern Ireland [2019] UKUT 22 (AAC) GINS/5304/2014 and GINS/478/2015 5 any time before that date as “a Minister of the Crown may curtail that protection by wholly or partly revoking the old certificate” (paragraph 18(5); and see also paragraph 17(3)).[18]Section 28(4) of the 1998 Act set out the powers of the Upper Tribunal on any appeal brought under section 28(2):
‘If … the Tribunal finds that, applying the principles applied by the court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may allow the appeal and quash the certificate.’
[19]The short point is that, as noted above, the Secretary of State has now withdrawn the original certificates in relation to both Appellants. As a result, both certificates no longer have any effect (see paragraph 18(5) of Schedule 20 to the 2018 Act). If we were minded to allow the substantive appeals, there is no effective remedy available to us. The certificates cannot be quashed as they no longer exist. It follows that these proceedings have been rendered academic and no useful purpose can be served by their continuance. Accordingly, we dismiss both appeals. Conclusion[20]We therefore dismiss both appeals. Signed on the original The Hon. Mr Justice Maguire on 17 January 2019 Upper Tribunal Judge Purchas QC Upper Tribunal Judge Wikeley

Cited in 1 later judgment