England and Wales Court of Appeal (Civil Division) Decisions

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
ADMINISTRATIVE COURT
The Honourable Mr Justice Simon
CO/4300/2012

		Royal Courts of Justice Strand, London, WC2A 2LL
		09/02/2016

Lord Justice Elias :

Introduction

1. The State has a legitimate need, for a variety of purposes, to retain and have access to personal information relating to its citizens. They in turn have a right under Article 8 of the European Convention on Human Rights to respect for their private lives which includes respect for sensitive personal information. Article 8(2) permits interference with their private lives but only where that interference can be justified; it must be no more intrusive than is needed to achieve legitimate objectives. This appeal raises the question whether, in the particular context of awarding Jobseeker's Allowance, the State has unjustifiably interfered with the right of transgender persons to have information about their gender reassignment kept private. Simon J, in judicial review proceedings, held that in certain respects government policies permitting access to this sensitive information infringed Article 8 and he made declarations accordingly. But other aspects of the Article 8 challenge were unsuccessful, as were other causes of action including direct and indirect discrimination claims made under both Convention and domestic law, and an allegation of breach of the public sector equality duty. Ms C now wishes to appeal the Article 8 and discrimination grounds on which she failed below, other than the direct discrimination claim.

The facts

2. Ms C is a transgender woman. Her transition from male to female began in 2003 and she changed her name in January 2004. She was issued with a gender recognition certificate ("GRC") in March 2006 pursuant to the Gender Recognition Act 2004 which came into force in April 2005. This Act entitles a transgender person to apply for a GRC and, if successful, an entry is made on the Gender Recognition Register which is maintained by the Registrar General. The purpose of the Register is to create a new record from which the Registrar General can produce a fresh birth certificate.
3. Section 9 deals with the consequences of receiving a GRC. In essence the acquired gender is recognised fully for the future, but the Act does not seek to rewrite history and deem the original sex to be other than it was:

"(1) Where a full gender recognition certificate is issued to a person, the person's gender becomes for all purposes the acquired gender (so that, if the acquired gender is the male gender, the person's sex becomes that of a man and, if it is the female gender, the person's sex becomes that of a woman).

(2) Subsection (1) does not affect things done, or events occurring, before the certificate is issued; but it does operate for the interpretation of enactments passed, and instruments and other documents made, before the certificate is issued (as well as those passed or made afterwards)".

4. Once a GRC is granted, that fact is automatically notified to the Department of Work and Pensions (DWP) so that the change can be recorded in the Department's records. The DWP uses a centralised database to record information relating to each of its clients. This is a vast database known as the Customer Information System (CIS) which contains the records of everyone with a National Insurance number. It currently has over a hundred million records and is updated more than a million times every day as a result of information provided by other interfacing systems. These include benefit-specific computer systems and a potentially large number of other government and quasi government bodies who interface with the CIS computer, including various government departments, local authorities and HM Revenue and Customs. In total the evidence was that there are about 140,000 business users i.e. persons authorised to access the information. In every case access is on a need to know basis.
5. The information recorded on CIS about a transgender person includes his or her current sex, the fact that he or she was previously recorded as having a different sex, and his or her current and any former titles and names. When the case was heard by Simon J the information also included, in a gender recognition field, the fact that a transgender person has a GRC. In addition any change recorded in the sex field would identify that the reason was gender reassignment where that was the explanation. However, following discussions which took place after the judgment, all references to the GRC have been masked. There is, therefore, nothing now visible to front line users which states in terms that the person whose record is under consideration has had a gender reassignment. Even so, in most cases that will be the obvious inference to draw from the information which is still recorded. A change both in the sex, the name and the title of a customer will in most cases only sensibly be explained by a gender reassignment (whether or not a GRC has been obtained).
6. The Secretary of State realistically concedes that the retention and use of gender data engages Article 8. As Lord Justice Laws observed in Wood v Commissioner of the Police for the Metropolis [2010] 1 WLR 123 para. 21:

"… an individual's personal autonomy makes him - should make him - master of those facts about his own identity, such as his name, health, sexuality, ethnicity, his own image … He is the presumed owner of these aspects of his own self; his control of them can only be loosened, abrogated, if the State shows an objective justification for doing so."

7. Section 22 of the Gender Recognition Act seeks to regulate access to and disclosure of sensitive information about transgender status. It permits such information to be acquired by someone acting in an official capacity, which includes when carrying out functions as a member of the civil service: section 22(3). But subsequent disclosure to a third party is a criminal offence unless it is made for certain legitimate purposes which include "for the purposes of the social security system or a pension scheme": section 22(4)(h). This respect for private information is reinforced by certain policies adopted by government which are designed to ensure that confidential information is only acquired and disclosed on a need to know basis, with disciplinary sanctions being applied to those who infringe the rules.

The justification for retaining the information

8. The Secretary of State advanced three reasons below why it was necessary to retain on the CIS data which would reveal the gender history of customers. One of these, to assist in planning and developing government policy, was found by Simon J not to be a legitimate reason and it is no longer relied upon. The other two objectives were, however, held to be legitimate and that conclusion has not been challenged on appeal.
9. The first objective is to enable the calculation of state pensions. The complication here is that for those born before 6 December 1953, state pension age varies by gender and will continue to do so until 6 March 2019. For that category, the calculation of their state pension is based upon national insurance contributions during a person's working life, and the number of years in which those contributions can be made in turn depend on the gender at birth. Similarly, the date from which a person is paid the state pension also depends upon gender, this time the gender at pension age. Complications arise for female to male transsexuals whose change of gender occurs after they have reached the statutory retirement age for a woman and before 6 March 2019; and for male to female transsexuals whose change of gender occurs before 6 March 2019 and before they have reached their state pension age for a man, but after they reach the state pension age in their acquired gender. The relevant legislation provides that they have the pension rights in the acquired gender from the date of the certificate: paras. 7 and 8 of schedule 5 to the Gender Recognition Act 2004. So female to male transgender persons may lose a pension entitlement which had crystallised; and male to female transgender persons may immediately become entitled to a pension which was not available to a man. The calculation of the amount is quite complex. The DWP provided evidence that this information would be needed during their life expectancy and therefore beyond 6 March 2019 for the purpose of checking and maintaining claims.
10. The second reason advanced for retaining the gender change data is that it is necessary for fraud detection. It reduces the risk of identities being stolen. Where there has been a change of identity, it is possible for a new National Insurance number to be allocated to a transgender person's original name. There was evidence before Simon J of two linked cases where fraudulent claims were based on false identities connected with GRCs with one party who had been issued with a GRC seeking to adopt the original identity of another person in possession of a GRC.

Detriment caused to the appellant

11. Notwithstanding the limitations on access to, and distribution of, the protected information, the fact that gender history is potentially available to a number of civil servants is a source of considerable distress to Ms C. She would prefer that this highly sensitive material were simply excised from her records altogether. But if there is a legitimate justification for retaining the information, she says that systems should be put in place to ensure that the number of officials who have access to it should be as few as possible. She does not accept that the current arrangements achieve this.
12. What causes her particular distress is the fact that her history is available to at least some of the DWP officials whom she has to meet face to face on a fortnightly basis when claiming her Jobseeker's Allowance (JSA). She finds it humiliating to have direct dealings with officials who know her history even when they do not mention it and behave properly towards her. For the most part they do. There were eight complaints in the period April 2012 to March 2013 by transgender customers that staff had not treated them with appropriate respect, although in the following eight months, there was only one. So she is particularly concerned that the DWP should structure its systems to ensure that officials with whom she may come into contact will not be able to access this information.
13. There has been considerable discussion between the DWP and the appellant, both before any litigation was commenced and after the judgment of Simon J, about the nature of the problems she and other transgender people face and proposed solutions. The masking of any reference to the gender recognition field is the principal change resulting from those discussions. However, the appellant believes that further modifications of the practices or policies could and should be made. Hence the reason for pursuing the appeal in an attempt to secure additional safeguards which Simon J was not willing to grant.

Systems and Policies

14. The challenge below was directed at three policies which relate to the way in which gender recognition data is stored and accessed. The policy of retaining and processing the historical gender data in respect of transgender persons who have a GRC is known as the Retention Policy. This information is retained for the life of an individual and thereafter for 50 years. The policy which led to the noting of a GRC on the CIS was known as the GRC Noting Policy. Since there is no longer any visible gender recognition field on the CIS, nor any other express reference to the fact that there has been a gender reassignment, this is no longer a live issue.
15. The third policy in issue regulates how officials in fact process the records of transgender customers. As I explain below, there are special procedures in place for dealing with such claims. The procedures are designed to ensure that sensitive information about transgender customers is given fuller protection than would otherwise be the case. Those accessing the information need to be specifically authorised; that authorised access is limited to a specific purpose or purposes; and it is for a limited time not exceeding four hours. This policy is known as the Special Customer Records policy (SCR).

Transgender customer obtaining job seekers allowance: the SCR policy

16. The focus of this case has been upon the system which is in place when a transgender person seeks JSA. Typically the official dealing with an application will have access to two computer systems, the Labour Market System (LMS) and the Job Seekers Allowance Payment System (JSAPS). The former system records information about steps taken by the customer to obtain employment; the latter records other information which enables the official to determine whether or not to authorise payment. It does not contain any of the gender history contained on the CIS.
17. Although the Secretary of State considers that there are good reasons to maintain gender information on the CIS, it is appreciated that this has to be handled with sensitivity and with respect for Article 8 rights. The SCR policy is designed to achieve this and to ensure that the intrusion into private life is kept to a minimum.
18. When the DWP receives notification from the Registrar General that a GRC has been issued with respect to someone whose information is recorded on the CIS, an SCR marking is applied automatically. Thereafter, the SCR policy applies to such persons unless they make a request in writing for the SCR marker to be removed. It is, therefore, a voluntary act to remain in the SCR system.
19. The fact that the transgender person has an SCR marking does not of itself demonstrate that he or she is a transgender person. There are other categories of persons whose names have changed who also have this more sensitive system applying to them. They include women subject to domestic violence whose identity needs protecting; persons subject to witness protection orders who are highly vulnerable to physical attack if their real identity gets known by the wrong people; and other individuals who, for one reason or another, the Cabinet Office considers should have their true identities concealed. In fact a significant proportion of SCR customers are transgender, but that will not be generally known.
20. When the LMS computer system is operated with respect to someone subject to the SCR policy, there is an automatic "pop-up". This informs the official that the information normally recorded on the LMS system has been entered manually on a clerical record and that no transaction should be recorded on the computer system itself. The paper records are kept locked and are only accessible once the requisite authority has been given. Similarly, if an official wishes to get into the JSAPS system for a transgender person, immediate access on the screen will be barred because the account has been processed as an SCR. Written authorisation from a DWP manager is needed to access the account; this is given on a temporary basis for a maximum of four hours. On entering the system, the officer will be alerted by a message saying that no other user should view the account.
21. Once access is authorised, this will still rarely involve a need to interrogate the historical gender data of the customer. This will only be necessary if the official has to delve further into the records and have access to the CIS. Typically this occurs where there is a change in relevant information, such as a change of address. Again there may be some query which could require access.
22. The information then available to the official includes the gender history, which covers previous titles and names and also the fact that the sex formerly recorded in the relevant box has changed. This does not of itself show that the customer is transgender; far more often the sex has to be changed in the record because it was incorrectly entered in the first place. But usually the change in title and name will demonstrate that the customer has changed sex.
23. Quite apart from these formal safeguards in relation to access, there is a degree of flexibility about the way the policy operates locally. So, for example, a transgender customer may be allowed to sign in through the postal service or, as in the case of the appellant, any interviews may be conducted in a separate room to prevent the parties being overheard. Moreover, staff have had specific training about the procedures and the particular need for sensitivity when dealing with transgender customers.
24. An important feature of the system is that all accounts, but especially SCR customer accounts, are monitored. A daily report is produced of all successful and attempted access to such accounts. These are checked by special security officers. An audit record is kept. It is possible from the audit trail to track when and by whom access was made, the origin of the request, and the type of access made. It should therefore become apparent if there has been inappropriate or unauthorised access and where that is established, disciplinary action may follow, depending upon the circumstances.

The appellant's objections to the SCR policy

25. There are two particular complaints about the operation of the SCR policy. First, there is no doubt - and this is conceded by the Secretary of State - that it creates some inconvenience and delay in accessing benefits. Cases are usually delayed by no more than an hour, but there is inevitably time spent in obtaining the necessary authorisation to deal with the claim and some examples of very real and prejudicial delay have been identified in the evidence. This is particularly likely to occur in those limited cases where applications are made by phone, because the officer must get back to the customer who has to be available to receive the call.
26. It is relevant to note, however, that delay is not just a problem for transgender persons using the SCR. About one third of all the complaints lodged by customers allege unacceptable delays - that is over twenty thousand such complaints per year. So even if this problem may be exacerbated for those subject to the SCR policy, it is far from being unique to them. Moreover, where there is maladministration resulting in excessive delay, consolatory payments may be awarded.
27. The second major concern raised by the appellant is that although the SCR is intended to create heightened protection for transgender customers, in practice it does not do so. If anything it exacerbates their problems by drawing attention to their special position. Whilst it is true that not all SCR customers are transgender, a significant majority of them are, and the information retained on the system, together with the fact that they are subject to the SCR arrangements, will in practice make this obvious.

The law

28. The appellant's case has been advanced on a number of fronts but the essential nature of the complaint was that the policies were unnecessarily intrusive and interfered in a disproportionate way with an important element of the appellant's private life contrary to Article 8. In addition it was submitted that the SCR policy was discriminatory on grounds of gender reassignment and was contrary to both Article 14 and the domestic law of indirect discrimination contained in section 19 of the Equality Act 2010. (An allegation of direct discrimination was advanced before Simon J but he rejected it and it has not been renewed).

Article 8

29. Article 8 is as follows:

"1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."

30. Article 8(2) lays down a test of justification. It requires that any interference must be proportionate; it must be necessary and for the purpose of achieving one of the objectives identified.
31. The proper approach to the issue of proportionality was laid down by Lord Reed in Bank Mellat v Her Majesty's Treasury (No.2) [2013] UKSC 39; [2014] AC 700 para. 74 in the following terms:

"The judgment of Dickson CJ in Oakes provides the clearest and most influential judicial analysis of proportionality within the common law tradition of legal reasoning. Its attraction as a heuristic tool is that, by breaking down an assessment of proportionality into distinct elements, it can clarify different aspects of such an assessment, and make value judgments more explicit. The approach adopted in Oakes can be summarised by saying that it is necessary to determine

(1) whether the objective of the measure is sufficiently important to justify the limitation of a protected right,

(2) whether the measure is rationally connected to the objective,

(3) whether a less intrusive measure could have been used without unacceptably compromising the achievement of the objective, and

(4) whether, balancing the severity of the measure's effects on the rights of the persons to whom it applies against the importance of the objective, to the extent that the measure will contribute to its achievement, the former outweighs the latter. … In essence, the question at step four is whether the impact of the rights infringement is disproportionate to the likely benefit of the impugned measure."

32. It is pertinent to note that Lord Reed expanded upon the proper way to approach the third criterion (para.75):

"In relation to the third of these criteria, Dickson CJ made clear in R v Edwards Books and Art Ltd [1986] 2 SCR 713, 781-782 that the limitation of the protected right must be "one that it was reasonable for the legislature to impose", and that the courts were "not called upon to substitute judicial opinions for legislative ones as to the place at which to draw a precise line". This approach is unavoidable, if there is to be any real prospect of a limitation on rights being justified: as Blackmun J once observed, a judge would be unimaginative indeed if he could not come up with something a little less drastic or a little less restrictive in almost any situation, and thereby enable himself to vote to strike legislation down (Illinois Elections Bd v Socialist Workers Party (1979) 440 US 173, 188-189); especially, one might add, if he is unaware of the relevant practicalities and indifferent to considerations of cost. To allow the legislature a margin of appreciation is also essential if a federal system such as that of Canada, or a devolved system such as that of the United Kingdom, is to work, since a strict application of a "least restrictive means" test would allow only one legislative response to an objective that involved limiting a protected right."

33. Lord Reed also emphasised (para.71) the firmly established principle that:

"… the intensity of review under EU law and the Convention varies according to the nature of the right at stake and the context in which the interference occurs."

34. It is a firmly established principle that it is for the court and not the decision maker to carry out the proportionality analysis: see the observations of Lady aleH Hale in Miss Behavin Ltd v Belfast City Council [2007] UKHL 19; [2007] 1 WLR 1420, para.31. However, the appeal court does not second guess the first instance judge. It does not carry out the balancing task afresh as though it were rehearing the case but must adopt a traditional function of review, asking whether the decision of the judge below was wrong: see the decision of the majority (Lord Wilson, Lord Neuberger, Lord Clarke; Lady Hale and Lord Kerr dissenting on this point) in re B [2013] UKSC 33.

Discrimination

35. Article 14 is concerned with discrimination. It is as follows:

"The enjoyment of the rights and freedoms set forth in this Convention shall be secured without discrimination on any ground such as sex, race, colour, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status."

36. For Article 14 to be engaged it is not necessary that there should be a breach of another Convention right, but the facts of the case must fall within the scope of a Convention right.
37. The particular aspect of Article 14 on which the appellant relies is the principle first enunciated in the case of Thlimmenos v Greece (2001) 31 EHRR 15 which established that Article 14 requires not merely that like cases should be treated alike but also that unlike cases may need to be treated differently. It may be necessary to recognise that material differences should be reflected in the policy adopted. This may sometimes require more favourable treatment of those whose circumstances justify a departure from the general policy.
38. The domestic discrimination law relied upon in the appeal is the principle of indirect discrimination. Section 29 of the Equality Act 2010 requires a service provider not to discriminate against a person requiring the service on certain proscribed grounds which include gender reassignment. The concept is defined in section 19 as follows:

"(1) A person (A) discriminates against another (B) if A applies to B a provision, criterion or practice which is discriminatory in relation to a relevant protected characteristic of B's.

(2) For the purposes of subsection (1), a provision, criterion or practice is discriminatory in relation to a relevant protected characteristic of B's if -

(a) A applies, or would apply, it to persons with whom B does not share the characteristic,

(b) It puts, or would put, persons with whom B shares the characteristic at a particular disadvantage when compared with persons with whom B does not share it,

(c) It puts, or would put, B at that disadvantage, and

(d) A cannot show it to be a proportionate means of achieving a legitimate aim."

39. The essence of indirect discrimination, therefore, is that an arrangement must disproportionately impact adversely on a particular group by subjecting them to a particular disadvantage. It is for a claimant to establish the disparate impact but thereafter the respondent has the burden of showing that the arrangement is a proportionate means of achieving a legitimate aim.

The judgment of Simon J

40. The Article 8 case was advanced by reference to the three distinct policies: the Retention policy, the GRC Noting policy; and the SCR policy. There were two elements in the Article 8 challenge. First, it was said that the Retention Policy and (still relevant at that stage) the GRC Noting Policy contravened the principle of legality, which requires any interference with Convention rights to be "in accordance with the law", as Article 8(2) itself states in terms. It is a well established principle of Convention jurisprudence that this means that the relevant rules must be clear and publicly accessible: see Sunday Times v UK (1979) 2 EHRR 245. The concept of the law in this context is very broad and includes government policies which interfere with Convention rights: R v Ashworth Hospital [2005] UKHL 58; [2005] 3 WLR 793. The second challenge was that the interference was in any event disproportionate and was not the least intrusive means of achieving the objectives sought.
41. As to the former, the judge held that the principle had been infringed in respect of the Retention Policy and the GRC Noting Policy which were not in the public domain. Indeed, there had been considerable difficulty in identifying precisely what the relevant policies were. A complete version of the Retention Policy was not produced until the second day of the trial. However, the judge did accept that it might undermine the protection which the SCR policy was designed to achieve to make that particular policy public. Accordingly he made declarations of breach of Article 8 only in respect of the other two policies.
42. The Secretary of State has not sought to challenge these findings of the judge. Indeed, the Retention policy has now been clarified, and the GRC Noting policy no longer has any application. However, that conclusion was only ever of limited value to the claimant. It does nothing to counter or ameliorate her real grievance namely how she, as a transgender person, is adversely affected by the operation of the policies, and why special arrangements should therefore be made to accommodate her concerns and those of other transgender people. It was the proportionality rather than the legality issue which engaged her real grievance and lay at the heart of her case.
43. Simon J dealt with this aspect of Article 8 by considering the Retention policy and the SCR policy separately. As to the former, the judge was satisfied that there were legitimate objectives, although he recognised, for reasons summarised above, that the justification for keeping the historic data for pension purposes would run out in time and the policy would need to be kept under review. The need to combat fraud was also a legitimate objective and therefore a blanket removal of the personal information was not justified. Indeed, this was not really disputed by Ms C. The focus of the argument below, as before us, was that the information could be masked and made available to a much more limited group of people, none of whom would meet Ms C in person.
44. The judge rejected this submission in relatively perfunctory terms. He accepted evidence from the Secretary of State that there was a real concern about fraud, and that it was the Secretary of State's considered view that it was more likely to be detected if the past records were available to those benefit officers who dealt directly with customers and might be alerted to anything suspicious.
45. Furthermore, the cost of removing the material was assessed by the Secretary of State to be in the region of £1 million, although this was a very tentative assessment. It would cost some £25,000 to carry out a feasibility study to determine the cost more accurately. Cost was, in the judge's view, a material factor supporting the other reasons for retaining the data on the CIS. Weighing all matters in the balance, he was satisfied that there was no disproportionate interference.
46. The SCR policy was separately considered. The judge was prepared to assume that Article 8 was engaged although he doubted whether it was given that the purpose of this policy was to protect privacy. He recognised legitimate concerns about the delays and the fact that the policy tended to draw attention to transgender customers thereby undermining to some extent its objective. But he was not prepared to give relief on the basis of these concerns.
47. The judge dealt briefly with the discrimination arguments, essentially because he thought they added nothing of substance to the Article 8 claims. If there was a breach of Article 8 because any interference was unjustified, it was unnecessary to establish any additional breach of Article 14. If indirect discrimination was established, again it would be unnecessary to consider Article 14. As to indirect discrimination, even if there was the necessary disparate impact on transgender customers, the policies were justified for the same reason relied upon in relation to Article 8.

The grounds of appeal

48. The appellant advances four grounds of appeal. First, she challenges the proportionality conclusions both with respect to the Retention policy and the SCR policy. In relation to both, she submits that the judge failed properly to apply the principles enunciated in Bank Mellat. As to the SCR policy, she advances the additional ground that the judge was obliged to analyse why the policy infringed Article 8(1) rather than simply assuming that it did. Without a proper appreciation of the nature of the interference, the balancing exercise which Article 8(2) requires could not be properly undertaken.
49. Second, she submits that the judge failed to understand the real gravamen of the Article 14 argument which was that different cases should be treated differently. In particular, the judge failed to consider properly the submission that the SCR policy should have been modified in the case of transgender persons, who were particularly disadvantaged by the operation of that policy.
50. Third, with respect to the indirect discrimination argument, the judge failed properly to understand the nature of the particular disadvantage to which transgender persons were subjected; again he merely assumed it but a considered and fact sensitive analysis of justification required a proper appreciation of the full nature and extent of that disadvantage.
51. Finally, the appellant submits that the judge did not properly give full effect to section 9 of the Gender Recognition Act 2004. This does not seem to have been an argument raised before the judge and he expressed no view about it.
52. I will deal with these grounds in turn.

Article 8: The Retention Policy and proportionality

53. The Article 8 proportionality analysis requires a consideration of the nature and extent of the private right, and the justification relied upon for interfering with it, applying the Bank Mellat principles in a fact sensitive way.
54. The Secretary of State conceded that Article 8 was engaged, and in my view that was plainly right. In R (Catt) v Association of Chief Police Officers of England, Wales and Northern Ireland (Equality and Human Rights' Commission and others intervening) [2015] UKSC 15 certain limited information about the respondent's involvement in public demonstrations directed against the operations of a commercial weapons manufacturer was retained on what was termed a "domestic extremism" database, maintained by the police. The Supreme Court accepted that the systematic collection and storage in retrievable form of public information about an individual was an interference with his private life, although on the facts a majority of the court considered that the retention was justified as part of police intelligence gathering in the maintenance of public order and the prevention of crime, even though the respondent himself had not committed any criminal offence. The court did not accept that he was stigmatised as a consequence, and the information was not made available to third parties.
55. There is no challenge to the judge's conclusion that the pension and fraud detection objectives are legitimate aims, and it is not suggested that the policies are not rationally connected to those aims. Accordingly, the first two of the Bank Mellat, criteria are satisfied. Any proportionality challenge to the Retention policy can only succeed if either the court is satisfied that a less intrusive way of achieving the objectives could be employed, obviating the need for the gender history on the CIS to be made available to the officials dealing with the appellant; or if the court is satisfied that given the nature of the private and public interests at stake, the latter are not of sufficient importance to justify interfering with the former at all, even if the least intrusive interference has been adopted.
56. There are certain features relating to the private right in issue which should be noted. The information is highly personal and sensitive. However, it is not private information of the kind which concerned the Strasbourg Court in S and Marper v UK (2008) 48 EHRR 1169 when it held that the blanket retention for an indefinite time of the fingerprints and DNA profiles of those suspected but not convicted of a criminal offence was a breach of Article 8 and undermined the presumption of innocence. There is some analogy with the information in the Catt case where, as Lord Sumption pointed out (para. 26), the information was about overt acts in a public place. Here that which causes the appellant distress is similarly already in the public domain. There are necessarily going to be relatives and friends, work colleagues and neighbours, who will know that the appellant's gender has changed. In Catt Lord Sumption described the interference with private life in that case as minor, and the respondent says that this fairly describes the nature of the intrusion here. I would not accept that characterisation given the highly personal and sensitive nature of the information recorded. Nevertheless, the fact that the information is perforce already widely known is in my opinion highly relevant when carrying out the Article 8 balancing exercise.
57. In my judgment, it is also material that the information will, for the most part, be a matter of no interest to those having access to it. It tells them the unsurprising fact that someone, whom they will almost certainly not know personally, is transgender. That will be the position where information is accessed by officials from departments other than the DWP who have cause to enter the CIS system. Typically they will not have face to face contact with the appellant. I appreciate that the distress and humiliation arises from those occasions when the appellant does have to have direct contact with officials who know of the appellant's gender history. But even there, whatever mild interest that information might generate in the short term, the novelty is likely in most cases to wear off and be of no continuing interest. Moreover, these officials marginally increase the size of the group of persons who personally know the appellant and her gender history. Ms Mountfield said that they have a greater significance than that: the appellant could seek to remove herself from the others in that group, for example by moving to a completely different area and changing jobs, but she is forced into contact with the officials. Perhaps she could sever most of the relationships from her past, no doubt with some difficulty. But whilst there is evidence that some transgender people share the appellant's deep sense of distress that their gender history should be known, there is limited evidence that transgender people generally would experience the humiliation as deeply as she does, or would take such drastic steps to break the links with their past.
58. Some of the appellant's concerns stem from the abuse of information, with an official either seeking out information he or she is not authorised to see, or an authorised official sharing information with someone not entitled to receive it. The appellant rightly points out that there is evidence that abuse occurs, relying upon the fact that the Department has on a number of occasions had cause to discipline officers for such behaviour. But as Mr Bourne, counsel for the Secretary of State, points out, these statistics also show that the Department takes the confidentiality of the information seriously and is willing to take action when it is discovered. Moreover, in this context it is important to note that the effect of the audit trail is that if an official enters a record without authority, or having authority abuses it by looking at unauthorised material, that is capable of being identified by the authorities. Any official taking that step is at risk of being detected and thereafter disciplined.
59. It is also of some relevance that steps have now been taken to mask the specific reference to gender reassignment from the CIS. Formerly any officer entering the CIS site would immediately have been able to see that the client was transgender; that is no longer the case. I accept, however, that this is not a factor of much weight since for reasons I have given, in practice the historic gender information will in most cases reveal the transgender status.
60. If we turn to consider the nature of the public interests, it is not disputed that the Secretary of State can rely upon the two legitimate objectives of fraud detection and pension calculation. In my view, in carrying out the proportionality analysis, the court is bound to give weight to the view of the Secretary of State not only that there is an increased risk of fraud being perpetrated on the system if the information were removed entirely from the CIS, but also that fraud is more likely to be detected if the historic gender data remains visible to front line officials and therefore should not be masked from them. The considered view is that it is the front line officials who sometimes have their suspicions raised and need to be able to verify the identity of the customer by reference to the historic data. Quite independently of that, for the time being at least the need to make the pensions calculation for some transgender customers also justifies the retention of the information.
61. In my judgment, it is also relevant that the Secretary of State has given considerable thought as to how the concerns of transgender customers can be accommodated. There was consultation with relevant transgender groups when the policies were first adopted on the coming into force of the Gender Recognition Act. Thereafter there has been extensive communication between the appellant and the DWP both before and after the litigation. This in fact led to the data about the GRC being masked on the CIS. The appellant has suggested many other changes in extensive correspondence but these have been rejected with reasons given. Mr Bourne identified eight potential modifications which for various reasons were not adopted. Of course, it remains the task of the court to determine whether the interference with a Convention right is proportionate or not. But the fact that there has been a considered rejection of other options, with reasons, by those better placed than the court to assess the likely impact of these options on the ability to achieve the legitimate objectives, is in my view a matter which must carry real weight with the court.
62. Quite independently of this, the judge was plainly influenced, and in my view justifiably so, by the potential cost of removing or masking this information. It is not suggested that the figures are precise, and indeed it is asserted that it would need a feasibility study to assess the likely costs, which would itself cost £25,000. But they are the best estimate of the resources which would perforce be lost to other projects and they are substantial. The DWP is entitled to have regard to other demands on its resources when determining the extent to which it should use its funds to protect Article 8 rights: see, in a different context, R(on the application of McDonald) v Kensington and Chelsea Royal London Borough Council [2011] UKSC 33; [2011] 4 All E.R.881.
63. In my judgment, having regard to the need for retaining this information, the cost of masking it, and the nature and extent of the interference with the appellant's private life, Simon J was fully entitled to conclude that the interference was proportionate. It was no more intrusive than was necessary to achieve the objectives. Moreover, whilst recognising the genuine distress felt by this appellant, I do not think that it is seriously arguable that the limited disclosure of gender history to those who need to know is a sufficiently significant intrusion into the appellant's private life to warrant the conclusion that, notwithstanding the two legitimate objectives, no interference is justified at all. In my judgment, this is nowhere near the kind of case where the private interest is so strong that cogent public interest considerations must give way to it.

The SCR policy and proportionality

64. The justification for the retention policy shows that there is a legitimate reason for storing and making accessible this sensitive personal information on the CIS system. But that still leaves open the question whether access to the gender recognition data has been limited to the minimum number of officials possible. The SCR is in part designed to achieve that objective.
65. I accept, contrary to the view of Simon J, that the fact that the policy is intended to benefit the appellant is not of itself an answer to an Article 8 challenge. If Article 8 requires information to be revealed only to those who need to know, and the policy designed to limit access does indeed go some way towards achieving that but still permits wider access than is necessary, there remains a breach of Article 8. In those circumstances it is not the terms of the policy itself which gives rise to a breach; it is the fact that it does not go far enough. Again, the policy may at least in theory not merely fail to achieve its objective but might actually make matters worse. That would be so, for example, if the policy sought to restrict the number of people likely to have access to the information but in fact increased it. But one would hope that it would be very exceptional for a policy to be so incompetently drafted or applied.
66. In this case the Article 8 complaint about the Retention policy is indeed in part a claim that the SCR does not go far enough and is inadequate to secure proper protection of the appellant's Article 8 rights. This is the submission that the data revealing transgender history should be excised from the CIS altogether, or at least heavily masked, in which case the SCR policy would be redundant. I have rejected that submission.
67. The second Article 8 complaint with respect to the SCR is that it creates delay in processing information which in turn sometimes leads to delay in payment; and that in practice it draws the attention of officials to transgender customers which is precisely what the policy is designed to avoid.
68. In my judgment, there are two problems with this submission. First, so far as the delays are concerned, some delay is inevitable if the system of authorisation is to work properly and those authorising access are properly considering the merits of the application. Moreover, the delays are not merely experienced by SCR customers; customers assessed under the normal procedures also regularly complain that payment of the benefit is unduly delayed. In my judgment, any administrative failings in the operation of the system do not constitute a breach of Article 8. They may understandably lead to grievances which should be redressed, but they do not warrant the complaint that the interference in private life is disproportionate.
69. As to the complaint that the SCR policy is in practice drawing attention to transgender people, in some cases that may be true, although the presence of the historical gender information means that their status will in most cases be obvious in any event to those who have access to it. It is the price for seeking to ensure that access is limited and tightly monitored; and it was a scheme adopted after consultation with transgender groups. Furthermore, if a transgender person wishes to opt out of the SCR system, he or she is able to do so simply by giving notice in writing. In the light of these considerations, I do not accept that the SCR policy infringes the appellant's Article 8 rights.

Article 14

70. The Article 14 argument was put in two ways. The first and widest submission was that in accordance with the Thlimmenos principle, transgender people should be treated differently from all others claiming JSA. But that is precisely what the SCR is doing. It is treating differently all those who for one reason or another have required their change of identity to be kept private, including those who have acquired a GRC. In so far as it is said that the SCR does not go far enough and that gender data relating to transgender people should be removed altogether from the CIS, that is simply to repeat the Article 8 submission which the judge was entitled to reject.
71. Ms Mountfield also advanced a narrower Article 14 argument. She submitted that the policies should have distinguished between those transgender persons whose gender history needs to be retained for pension purposes, and the rest. The former is in fact only a small proportion of the transgender community. It is submitted that the two categories are quite distinct and the policy should differentiate between them.
72. There might be merit in this argument if the only purpose of retaining the information was to ensure that proper pension payments were made, although it is not clear how easy it would be to draw the distinction. But once it is accepted that the information can justifiably be held for fraud detection purposes in any event, this argument goes nowhere.

Indirect discrimination

73. This part of the appeal was directed only against the SCR policy. The effect of section 29, read with section 19, of the Equality Act is that the Secretary of State must not, in the exercise of his powers, commit indirect discrimination on certain proscribed grounds which include gender reassignment.
74. The first issue is whether the policy puts transgender people at a substantial disadvantage compared with cisgender people who are also subject to the policy. Is the proportion of transgender people adversely affected by the policy greater than the proportion of cisgender people who are affected? Simon J doubted that it was, and I agree. To the extent that the policy leads to delays in receiving payment and speculation about the reasons why someone falls within the scope of the SCR policy, all those subject to the policy are equally affected. The transgender customers are not disproportionately affected. The appellant contends that transgender people suffer more from the application of the policy because they also suffer psychological damage, the hurt and humiliation not experienced by cisgender people when they have to deal with officials who know of their gender history. But in my view, there is limited evidence to that effect. I accept that the appellant strongly experiences these feelings but how representative she is of transgender people in general is a very much a moot point.
75. But even if I am wrong about that, and some disparate impact could be shown, any indirect discrimination can be justified for essentially the same reason as the interference with Article 8 rights can be justified. Any psychological disadvantage which might exist could only be eliminated by either removing the information from the CIS entirely or altering the system so as to mask it from DWP officials. If the DWP is justified in not taking that step for Article 8 purposes, that justification applies equally to any potential indirect discrimination claim.
76. It is true that the judge said (para.115), in relation to a submission that the justification arguments advanced in Articles 8 and 14 applied equally here, that the Secretary of State's arguments were "not a complete answer to the claim made under Article 8 and 14 for reasons I have already given". In my view all he had in mind was that the principle of legality had not been satisfied. I do not think he was suggesting that there was an element of discrimination which had not been justified.

Section 9 of the Gender Recognition Act

77. I can deal with this argument briefly. The submission is that the appellant was not treated "for all purposes" as a female. In her interactions with the Secretary of State she was treated as a transgender person each time she claimed a state benefit. She was not accorded the full recognition of her female gender which section 9 requires.
78. In my judgment, this misconstrues the effect of section 9. The section does not require history to be rewritten. As Richards LJ noted in J v C [2006] EWCA Civ 551 para. 48, in the context of a female to male transsexual who sought to allege that a marriage to a woman prior to acquiring his GRC was invalid:

"To give effect to the undoubted fact that he did not have the male gender at the relevant time cannot possibly involve a lack of respect for his male gender as subsequently acquired."

79. The appellant historically had a different gender and to the extent that this may properly remain a material factor bearing on the application of government policy, such as in this case calculating pensions or detecting social security fraud, section 9 does not in my view require that fact to be ignored. The only question is whether it is justified to have regard to that historical fact in the particular context where it is being relied upon. Moreover, section 22 of the Gender Recognition Act plainly assumes that disclosure of past gender history may be made for social security and pension purposes. That could only be on the premise that Parliament anticipated that protected information, including information about a person's former gender, may be relevant and may need to be considered for such purposes.

Disposal

80. For these various reasons I would dismiss the appeal.

Lord Justice Patten:

81. I agree.

Lady Justice Black:

82. I also agree.