England and Wales Court of Appeal (Civil Division) Decisions

You are here: BAILII >> Databases >> England and Wales Court of Appeal (Civil Division) Decisions >> Cooper v National Crime Agency [2019] EWCA Civ 16 (22 January 2019)
URL: http://www.bailii.org/ew/cases/EWCA/Civ/2019/16.html
Cite as: [2019] EWCA Civ 16

[New search] [Printable PDF version] [Help]

		Neutral Citation Number: [2019] EWCA Civ 16
		Case Nos: A2/2017/1901 & A2/2018/1717(B), A2/2017/1901(E), A2/2017/1901(C) & A2/2018/1717

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE EMPLOYMENT APPEAL TRIBUNAL
2200215/2013
AND ON APPEAL FROM THE COUNTY COURT
AT CENTRAL LONDON CHANCERY LIST
B03CL155/ /D10CL332

Royal Courts of Justice
Strand, London, WC2A 2LL

22 January 2019

B e f o r e :

SIR GEOFFREY VOS, CHANCELLOR OF THE HIGH COURT
LORD JUSTICE SALES
and
LORD JUSTICE BAKER
____________________

Between:

	MICHAEL COOPER	Appellant
	- and -
	NATIONAL CRIME AGENCY	Respondent

____________________

Philip Coppel QC and Estelle Dehon (instructed by Bindmans LLP) for the Appellant
Catrin Evans QC, Simon Murray and Jonathan Scherbel-Ball (instructed by the Government Legal Department) for the Respondent
Hearing dates: 30, 31 October, 1 and 13 November 2018
____________________

HTML VERSION OF JUDGMENT
____________________

Lord Justice Sales:

Before the court are two appeals which arise out of the same subject matter. In each case the appellant is Mr Cooper and the respondent is the National Crime Agency, which stands in the shoes of his former employer, the Serious Organised Crime Agency. The Serious Organised Crime Agency existed until 7 October 2013, when it was replaced by the National Crime Agency. For convenience I will refer to the respondent as "SOCA". Mr Cooper was employed by SOCA, initially as an intelligence officer and latterly as a continuous improvement officer. The appeals arise out of the circumstances in which Mr Cooper came to be dismissed by SOCA in 2012.

The first appeal is from a decision of the Employment Appeal Tribunal (HHJ Eady QC) ("the EAT"). The EAT partly dismissed and partly allowed an appeal by Mr Cooper against a decision of the Employment Tribunal ("the ET") by which Mr Cooper's claim of unfair dismissal against SOCA was dismissed. SOCA dismissed Mr Cooper on grounds that his behaviour during an incident outside a public house in Hove on the night of 7 April 2012, in consequence of which Mr Cooper was arrested and charged with being drunk and disorderly in a public place and with assault on a police officer, had been a serious breach of the SOCA Code. The ET and the EAT held that SOCA was entitled to expect high standards of conduct from its officers, including when they were off-duty; that it had carried out a reasonable investigation into the incident; and that in the circumstances dismissal was within the range of reasonable responses available to SOCA as employer of Mr Cooper.

However, on reading the ET's decision, the EAT was not confident that the ET had given proper consideration to a significant aspect of Mr Cooper's case before reaching the overall conclusion that he had been fairly dismissed. The EAT therefore decided to remit the case to the same ET judge to ensure that this was done. SOCA cross-appeals against the order remitting the case to the ET: it contends that in fact it does sufficiently appear from the ET's reasoning that this aspect of the case had been properly considered by it.

The second appeal is from a judgment of HHJ Dight CBE sitting in the Central London County Court. The judge dismissed a claim by Mr Cooper against SOCA for damages for unlawful processing of sensitive personal data in relation to him, contrary to his rights under the Data Protection Act 1998 ("the DPA"), in the context of its decision to dismiss him. The sensitive personal data in question comprised materials received by SOCA from Sussex police in relation to the incident in Hove on 7 April 2012. Judge Dight held that there were a number of justifications for the processing of the data by SOCA which were available to SOCA under the DPA relating to its contractual rights as employer and its public functions as a law enforcement agency.

Factual background

Mr Cooper, who was born in 1960, is a former warrant officer, cryptologist and intelligence specialist, who served in the Royal Navy between 1977 and 2004. In January 2004 he was appointed as an intelligence officer with what was then known as the National Crime Squad. On 1 April 2006 SOCA came into existence pursuant to the Serious Organised Crime and Police Act 2005 ("SOCPA 2005") and took over the functions and staff of the National Crime Squad. On about 1 April 2006 SOCA issued Mr Cooper with a written contract of employment which Mr Cooper signed to indicate his acceptance of its terms ("the employment contract").

The employment contract included the following terms:

Clause 3.2:

"As a SOCA officer you are expected to maintain the highest professional standards. You are required to comply with all such subsisting policies, procedures and the Staff Charter for SOCA officers, as may from time to time be notified and made available to you."

Clause 16:

"16 Disciplinary procedure

16.1 SOCA expects the highest professional standards from its officers. You will be expected to comply with the Statement of Values and Staff Charter for SOCA officers, which will be made available to you.

16.2 SOCA has a disciplinary procedure, which is set out in the SOCA Misconduct and Discipline Policy, a copy of which is available for your reference in the Human Resources Department.

Clause 22.2:

"SOCA will not terminate your employment unless it has followed its own internal policies and procedures. … SOCA may only terminate your employment without notice in circumstances where you have been found to have committed an act or omission of gross misconduct."

Clause 24:

"24 Data Protection

24.1 In relation to Personal Data and Sensitive Personal Data (as defined by the Data Protection Act 1998) provided by you to SOCA, you give your consent to the holding and processing of that data for all purposes relating to your employment by SOCA.

24.2 In particular, you agree that SOCA can hold and process Personal Data and Sensitive Personal Data so that it can pay and review your remuneration and other benefits and provide and administer any such benefits, provide information to the HM Revenue and Customs and the Contributions Agency, administer and maintain personnel records (including sickness and other absence records), monitor and review data for the purpose of planning, policy development and to ensure SOCA's compliance with existing policies and legislation, carry out reviews of your performance, give references to future employers, and transfer your Personal Data and Sensitive Personal Data to countries outside the United Kingdom for the purpose of your duty, if you are either posted or travel abroad on SOCA business."

In order to work for SOCA, Mr Cooper had to have security clearance which was kept up to date. This was for obvious reasons relating to the access which he might have to highly confidential information about investigations in respect of serious organised crime.

Part 2 of the Police Reform Act 2002 ("the PRA 2002") sets out procedures for dealing with complaints about and misconduct by police officers and established the Independent Police Complaints Commission ("the IPCC"). SOCA was not a police force subject to Part 2 of the PRA 2002. However, SOCPA 2005 amended the PRA 2002 to insert a new section 26A which imposed a duty on SOCA to enter into an agreement with the IPCC to establish and maintain procedures corresponding or similar to those provided for by Part 2 of the PRA 2002 in relation to SOCA's staff. The IPCC and SOCA duly made a written agreement dated 31 March 2006 as required by section 26A ("the IPCC Agreement"). SOCA's Misconduct and Discipline Policy was adopted pursuant to this agreement.

In a section of this judgment below I set out the relevant statutory provisions and policies which established the legislative and policy environment in which SOCA conducted its affairs. The relevant policies are the Misconduct and Discipline Policy, a Security Clearance Policy and a so-called Revelation Policy governing the sharing of information about misconduct by SOCA employees with other police forces and prosecuting authorities.

Pursuant to the employment contract and, in particular, the Security Clearance Policy, Mr Cooper had an obligation to report to SOCA, as his employer, if he was arrested or became subject to any criminal proceedings.

On the evening of Saturday, 7 April 2012, Mr Cooper was drinking with a friend in the Slug and Lettuce public house in Hove. According to Mr Cooper, as explained in his defence to criminal charges eventually brought against him, he had drunk a lot and had approached women in a manner which led to him causing offence, with the result that he was punched by a man who was accompanying them.

Police officers of Sussex Police attended an incident outside the public house, involving Mr Cooper. Mr Cooper was abusive to the police and was arrested for being drunk and disorderly. He was handcuffed and placed in a police van. While being transported to Brighton police station he fell into the well of the compartment at the back of the van and while sprawled on the floor he kicked a female police officer in the leg. I should mention here that Mr Cooper's case was that his behaviour outside the public house was the consequence of being punched, which had such an effect that his behaviour was outside his control, and that the kick had been accidental, due to him trying to get back on his seat while he was handcuffed and the van was in motion.

A contemporaneous custody record was drawn up at the police station, which recorded "poor behaviour" on the part of Mr Cooper in the custody suite before being taken to the cells for the night. There was also CCTV footage of Mr Cooper in the custody suite. A transcript was made of an interview with Mr Cooper on the following day, 8 April 2012. Shortly afterwards, statements were taken from three police officers who had been involved. An incident report was also completed by the police. Like HHJ Dight, I refer to these materials together as the Brighton custody material.

In his interview on 8 April, Mr Cooper was apologetic. He told the police he was employed by SOCA. In due course he was charged with being drunk and disorderly and with assaulting a police officer, in relation to the kick to the female police officer's leg.

Mr Cooper was released on police bail after his interview. He promptly telephoned his line manager at SOCA to self-report his arrest and to explain what had happened. The Sussex Police also telephoned SOCA to inform it that one of its employees, Mr Cooper, had been arrested. On 10 April, SOCA sent an email to the Sussex Police to ask for relevant documents and CCTV footage. An investigator for SOCA, Mr Mark Kerr, emailed Sussex Police on 19 April to ask to see the transcript of Mr Cooper's interview as well.

On 10 April SOCA indicated to Sussex Police that it was considering whether to proceed in relation to the incident by way of a conduct investigation. In a reply from Sussex Police that day, the substance of the contents of the custody record was sent to SOCA. Mr David Phillips, a manager in the Conduct Unit of SOCA, was informed. He considered that it was necessary to investigate the incident for four reasons: to determine whether there should be internal disciplinary action; to determine whether Mr Cooper's conduct qualified as a "recordable conduct matter" such as might require to be notified to the IPCC under the IPCC Agreement; to review Mr Cooper's security clearance; and to consider whether the incident might need to be disclosed to the Crown Prosecution Service under the Revelation Policy, in case Mr Cooper was called as a witness in any prosecution against a third party defendant and disclosure of his misconduct was required to that defendant as a matter of fairness pursuant to the obligations on the prosecution under the Criminal Proceedings Investigation Act 1996 ("the CPIA 1996").

It was for Mr Phillips to decide whether Mr Cooper's behaviour constituted a "recordable conduct matter" for IPCC purposes. HHJ Dight found that on or about 11 April Mr Phillips considered the available information and concluded that Mr Cooper's behaviour did constitute a "recordable conduct matter": [74]. This has some relevance to the legal analysis below, as certain specified obligations to investigate arose at that point.

On 19 April, Mr Kerr was instructed to undertake an investigation into the allegations regarding Mr Cooper's conduct. On 23 April Sussex Police sent SOCA the incident report. Mr Kerr followed up on SOCA's requests for material with an email sent to Sussex Police in late April.

Sussex Police pulled together the requested materials, in the form of the Brighton custody material. On 4 May 2012 Mr Kerr, for SOCA, collected the Brighton custody material from Sussex Police.

On 6 May 2012 Mr Cooper complied with the terms of his bail by attending Crowhurst police station. He declined to accept a community disposal in relation to the matters alleged against him and so was charged with the offences of being drunk and disorderly in a public place and of assaulting a police officer.

Thereafter, Mr Kerr made use of the Brighton custody material in the course of his own investigation. In due course, it was decided that the matter could be dealt with appropriately by way of disciplinary proceedings against Mr Cooper, and that it was unnecessary to refer the matter to the IPCC. The Brighton custody material was then used by SOCA's disciplinary panel in considering a charge of gross misconduct against Mr Cooper in respect of his behaviour, resulting in his dismissal with effect from 11 October 2012. He was notified of that decision by letter dated 17 October 2012. That material was used again by SOCA's appeal panel in considering Mr Cooper's appeal against dismissal in December 2012, which was dismissed by letter dated 17 December 2012.

It is common ground that SOCA is a data controller for the purposes of the DPA; that the Brighton custody material (and the substance of the custody record and the incident report provided by Sussex Police in advance of 4 May 2012) comprised sensitive personal data of Mr Cooper (since it consisted of information "as to the commission or alleged commission by him of any offence": section 2(g) of the DPA); and that the use of those materials by SOCA, acting in particular by Mr Phillips, Mr Kerr, the disciplinary panel and the disciplinary appeal panel, constituted "processing" of those data within the wide definition of that term in section 1(1) of the DPA.

The criminal proceedings against Mr Cooper proceeded rather slowly. SOCA decided to proceed with the disciplinary charges against him without waiting for the criminal process to be concluded first. SOCA decided to proceed despite objections by Mr Cooper that by reason of the Revelation Policy and arrangements between SOCA and Sussex Police, as a fellow law enforcement agency, information given by him in answering the disciplinary charges against him would be likely to be passed by SOCA to Sussex Police and the prosecuting authorities. The ET in its decision found that this was indeed the case: ET decision at [19]-[20]. By reason of concern that this might happen, Mr Cooper received legal advice that he should not attend the disciplinary hearings held by SOCA.

On 25 May 2012 Mr Cooper appeared in the Magistrates' Court and pleaded not guilty to the charges against him. Mr Kerr attended the hearing. When asked to explain the gist of his defence, Mr Cooper said that on 7 April he had been the victim of a "mass attack" and of the actions of "over-zealous" police officers.

By this stage, Mr Cooper was off sick from work. Mr Kerr arranged to go to his home on 17 August 2012 to interview him. However, by reason of the legal advice he had received, Mr Cooper declined to answer any questions about his behaviour on 7 April. When Mr Kerr asked him if he wished to comment on whether he had brought discredit on SOCA, he offered no reply. He did, however, volunteer that he had been attacked by someone else and that he had acted as he had and said "a few bad things" because of being attacked and because he felt the incident was not being investigated by the police.

On 20 August 2012, Mr Kerr completed his investigation report. In it he reviewed the Brighton custody material. He concluded that disciplinary charges should be brought against Mr Cooper on the basis that he may have committed a criminal offence and may have behaved in a manner not expected of a SOCA officer, whether on or off duty. SOCA instituted disciplinary proceedings against Mr Cooper on the grounds identified by Mr Kerr. A disciplinary hearing was arranged and Mr Cooper was informed of his right to be accompanied at the hearing.

Mr Cooper was sent a pack of the material to be referred to at the hearing, incorporating materials from the Brighton custody material. He did not complain about the inclusion of any of this material in the pack. However, he did ask for the disciplinary hearing to be deferred until after his criminal trial, which was at that time listed for 14 November 2012, so as to allow him to participate fully in the disciplinary hearing without fear of prejudicing his defence in the criminal proceedings. That request was refused by SOCA, on the basis that the disciplinary process was concerned with his general conduct and an alleged breach of SOCA's standards of behaviour, and that findings in that process and in the criminal proceedings would not necessarily have an impact the one on the other.

The disciplinary hearing took place on 11 October 2012. Mr Cooper chose not to attend, but did not give advance notice of this. He did not arrange to be represented. He submitted no written representations. The disciplinary panel considered the materials in the disciplinary pack and viewed the CCTV footage. It decided that the disciplinary charge was made out and that Mr Cooper should be dismissed for gross misconduct. Mr Cooper was notified of this decision by a letter from SOCA dated 17 October 2012, dismissing him with effect from 11 October with eight weeks' pay in lieu of notice.

SOCA's disciplinary rules allowed for an appeal by way of review (rather than re-hearing). Mr Cooper submitted a notice of appeal, complaining procedural irregularities, improper conduct and bias, in breach of Article 6 of ECHR and the common law concept of natural justice, particularly in view of the matter being under consideration in the criminal proceedings. No complaint was made of any alleged breach of the DPA. SOCA gave Mr Cooper notice of a hearing before an appeal panel arranged for 6 December 2012, and made it clear that this panel would again consider the materials in the disciplinary pack. Again, Mr Cooper made no objection to this. Prior to the appeal hearing, he informed SOCA that his criminal trial had now been adjourned to 28 May 2013.

The appeal panel duly convened on 6 December. Mr Cooper did not attend the hearing, but arranged for his trade union representative, Mr Tully, to attend on his behalf. At the outset Mr Tully applied for a postponement of the hearing on the grounds that the criminal trial should go first, since otherwise Mr Cooper would be denied a fair hearing. The appeal panel refused that application, noting that SOCA's relevant disciplinary Operating Procedure stated that internal disciplinary proceedings can usually be conducted prior to the conclusion of a parallel criminal case.

In the substantive part of the appeal hearing, the appeal panel examined the issues and Mr Cooper's grounds of appeal in considerable detail. Mr Tully stated that, in addition to the grounds of appeal, Mr Cooper had a concern about the legal gateways which had enabled the evidence against him to be collected and relied upon at the first instance hearing. No mention was made of the DPA or the duties under it. The concern was vague and unspecific, and the appeal panel sought clarification, specifically asking if any allegation was being made whether there had been anything improper about the gathering of the evidence. Mr Tully said that Mr Cooper "would just like peace of mind that it was gathered correctly" and specifically confirmed that Mr Cooper was not alleging that the investigating officer had done anything illegal or inappropriate, but was merely seeking reassurance that what he did was legal and appropriate. The appeal panel asked Mr Kerr about this, who stated that the investigation had proceeded in an entirely conventional way, it being standard practice for information to be provided by a police force in cases of this kind, as had happened here. Mr Kerr stated that there were no data protection issues in relation to what had occurred. The appeal panel gave Mr Tully an opportunity to ask Mr Kerr questions about his investigation, and in doing so Mr Tully made no suggestion that Mr Kerr was unqualified to provide assurances on these points, nor was Mr Kerr's account challenged in any relevant manner. Before the appeal panel retired to consider its decision it gave Mr Tully a further opportunity to raise anything which had not already been considered in the hearing, but there was nothing more he wished to add; he made no suggestion that any point arose as to the legality or appropriateness of reliance on the Brighton custody material in the disciplinary proceedings, nor that there was any need for the panel to obtain legal advice about that.

The appeal panel dismissed Mr Cooper's appeal. He was notified of its decision by letter dated 17 December 2012. On 9 January 2013, he brought his claim in the ET. In his form ET1, he complained of unfair dismissal on the basis that the disciplinary proceedings had proceeded while he had been unwell; that he was concerned at the fact that Sussex Police had released to SOCA all the evidence against him in support of the criminal allegation, which had then been used as the basis of the SOCA investigation and disciplinary process, "and I challenge why this confidential information, which remains sub judice, about me has been released, without my permission and before this evidence has been tested and a decision reached"; that the existence of the criminal proceedings put him in a difficult position in responding to the disciplinary charges against him; and the sanction imposed had been too severe. No allegation was made of breach of the DPA by SOCA in its investigation and its conduct of the disciplinary proceedings.

On 15 October 2013 the Magistrates' Court heard the evidence against Mr Cooper on both the criminal charges against him, which in substance reflected what was in the Brighton custody material. Mr Kerr attended that hearing and noted the evidence. Mr Cooper was convicted on both charges and was fined. He appealed to the Crown Court.

On 14 January 2015 Lewes Crown Court reheard the case. The evidence for the prosecution again reflected what was in the Brighton custody material. On this occasion, Mr Cooper called a medical expert to say that his uncooperative conduct in relation to the police, his abuse of them and the appearance he gave of being drunk and unsteady could have been caused by the head injury Mr Cooper said he had received by being punched. Mr Kerr again attended the hearing and noted the evidence. In a detailed oral judgment given by HHJ Hayward, the Crown Court allowed the appeal and quashed the convictions. This was not a ringing vindication of Mr Cooper. The Court found that Mr Cooper had drunk more than he admitted, was "certainly disorderly", was uncooperative with the police, was swearing appallingly in a public place, and appeared unsteady and to have slurred speech. However, in light of the medical evidence, HHJ Hayward said that, "with some reservation" the Court could not exclude the possibility that the injury which Mr Cooper sustained to his head, in combination with what he had drunk, was a significant cause of his acting in this way, such that the appeal in respect of the drunk and disorderly charge should be allowed. The appeal was allowed in relation to the assault charge because the Court felt unable to exclude the possibility that Mr Cooper had kicked the police officer by accident while trying, when handcuffed, to get up off the floor of the police van.

A considerable time later, on 18 November 2015, Mr Cooper issued his claim form in the County Court against both Sussex Police and SOCA, now complaining of breach of duty under the DPA on the part of both organisations. As against SOCA he claimed compensation of £880,000 in relation to this loss of employment and damage to his future prospects of employment.

The ET's decision

At the hearing before the ET in January 2016, Mr Cooper was represented by Ms Dehon (who was also his junior counsel in the EAT, in the County Court and before us). On 9 February 2016 the ET sent its decision to the parties.

The ET reviewed the employment contract and relevant SOCA policies, including the SOCA Code and its Misconduct and Disciplinary Policy, identifying that there were obligations on Mr Cooper to maintain at all time the highest professional and ethical standards; never to behave in a manner likely to bring discredit on SOCA; to behave properly in all aspects of life and act professionally; and to act with fairness and impartiality, respecting the rights of the public, colleagues and partners and treating everyone with respect and courtesy and being expected to exercise tolerance and self-control. I interpose that SOCA had an obvious and important interest in maintaining high standards of conduct on the part of its employees both inside and outside work, so as to promote public confidence in it as a law enforcement agency and to ensure that its employees were not exposed to the risk of threats or blackmail which might jeopardise the secrecy of information held within the organisation. This much was not in issue on this appeal.

The ET found that Mr Cooper was dismissed by reason of his conduct, as examined in the disciplinary proceedings. It said that there was and could be no challenge to the proposition that SOCA had reasonable grounds for its belief that Mr Cooper had engaged in the conduct alleged against him, and it held that dismissal fell within the band of reasonable responses available to SOCA as his employer (and, indeed, Ms Dehon had not argued to the contrary).

Mr Cooper's case as presented at the hearing in the ET was based on three procedural points: (i) SOCA unfairly based the disciplinary case on the Brighton custody material which had been improperly passed to it by Sussex Police, in breach of their duties under the DPA, which SOCA had improperly received and used, in breach of its duties under the DPA; (ii) SOCA acted unreasonably in refusing to postpone the disciplinary hearings on grounds of Mr Cooper's ill-health; and (iii) SOCA acted unreasonably in refusing to postpone the disciplinary appeal in light of the legal advice Mr Cooper had been given that he should not participate in the internal disciplinary process for fear of prejudicing his defence in the criminal proceedings. The ET made findings at [18]-[20] that sharing of information between law enforcement agencies, including in relation to allegations of misconduct against officers of such agencies, was routine and indeed was required under guidance given in a Home Office Circular. Based on evidence given by a SOCA witness, the ET found at [20] that this practice could lead to material adverse to Mr Cooper which emerged in the disciplinary process within SOCA being passed back to Sussex Police, and hence potentially being used in a prosecution against him.

As to point (i), the ET noted at [58] that Ms Dehon had made "the startling assertion" that the practice of police forces sharing information concerning arrests of SOCA staff with SOCA "is necessarily and inherently a breach of the [DPA] and, on that account, any consequential dismissal is unfair". The ET also noted that Ms Dehon's detailed submissions on the DPA were not included in any skeleton argument (and I observe also that they had not been pleaded in any amendment to the claim as set out in the ET1 form); and went on to say that anyway it was not appropriate for the ET to engage with them, because they were not relevant to the case before it. This was because arguments based on the DPA had not been relied upon at either stage of the disciplinary process. The ET examined the transcript of the disciplinary appeal hearing and found that Mr Tully had not raised any equivalent argument on behalf of Mr Cooper based on the DPA at that hearing. In the circumstances, the appeal panel had made a proper inquiry of Mr Kerr about the propriety of the acquisition and use of the Brighton custody material for SOCA's disciplinary process and had been entitled to be satisfied with his assurances, which had not been challenged. The ET found that there was no merit in Mr Cooper's new DPA point because his case in the disciplinary proceedings leading to his dismissal did not rely upon it and the appeal panel was offered no arguable legal basis for finding any merit in it.

As to point (ii) (postponement on sickness grounds), the ET gave reasons for rejecting this complaint by Mr Cooper. This ruling is not in issue before us.

Finally, at [61]-[65] the ET also rejected Mr Cooper's case based on point (iii). It referred to Harris v Courage (Eastern) Ltd [1982] ICR 530, CA, for approval at p. 532D-F of certain observations of Slynn J in the EAT to the effect that there is no hard and fast rule that once an employee has been charged with a criminal offence an employer cannot dismiss him if the employee is advised to say nothing until the trial in the criminal proceedings; whether it is reasonable for the employer to proceed with internal disciplinary proceedings arising out of the same circumstances will depend on the particular facts of the case; and in that regard, "There may be cases where fairness requires that the employer should wait". At [65] the ET held that it was properly open to SOCA to refuse the request for the internal disciplinary proceedings to be adjourned; the disciplinary case embraced the whole of Mr Cooper's conduct on the night of 7 April 2012 and was much wider than the specific criminal charges; acquittal on the criminal charges would not be material to the outcome on the disciplinary case; SOCA was entitled to conclude that the evidence of Mr Cooper's misconduct was compelling; and SOCA was also entitled to have regard to the undesirability of significant delay in sorting out Mr Cooper's employment position (and having to continue suspending him on full pay) pending resolution of the criminal case many months in the future.

The EAT's decision

The appeal before the EAT proceeded on grounds which raised two points: (i) that the ET had not given proper consideration to Mr Cooper's submission based on the DPA, and (ii) that the ET should have found that it was unfair for SOCA to proceed with the disciplinary process in light of the ongoing criminal proceedings and the practice of information-sharing between SOCA and the police.

The EAT dismissed the grounds of appeal in relation to the first point. It held that the ET had approached the question of fairness in the right way, by inquiring whether SOCA's conduct and decisions fell within the range of reasonable responses, given the information before it and given how Mr Cooper put his case in the disciplinary proceedings. The ET had properly found on the evidence before it that information sharing as had happened in Mr Cooper's case was standard practice; and there was no reason for SOCA to investigate the point further; moreover, when the point about the propriety of use of the Brighton custody material was raised by Mr Tully at the appeal hearing, the appeal panel had made reasonable inquiries on the point and had been entitled to be satisfied on the information before it (the positive assurance from Mr Kerr and the absence of any challenge to that or any positive case of unlawfulness being advanced by Mr Tully) that it was proper to proceed to examine the case by reference to the Brighton custody material: [34]-[40]. Mr Cooper appeals to this court in relation to this part of the EAT's decision.

However, the EAT allowed the appeal in relation to the second point: [43]-[47]. HHJ Eady QC was troubled by the failure of the ET in the relevant part of its decision at [61]-[65] (and in particular, in the critical part of its reasoning at [65]), to make express reference to the information-sharing practice between SOCA and the police, that is to say, to the likelihood that SOCA would pass back to Sussex Police information which it obtained from Mr Cooper in the course of him responding to the disciplinary charges against him, as found by the ET at para. [20] of its decision. This was of concern to the judge because it had been raised as a particular point of complaint at various stages in SOCA's investigatory and disciplinary process by Mr Cooper and by Mr Tully on his behalf. HHJ Eady QC gave careful consideration to whether it could be said that the ET's reasoning implicitly took this point into account, even though it did not make express reference to it at [65]. However, she concluded at [47] that she simply could not be sure that the ET had brought this point into consideration when it reached its conclusion at [65] that SOCA had proceeded in a fair manner, and therefore on that basis alone she allowed the appeal. She made an order for the case to be remitted to the same ET judge to consider the point further. SOCA cross-appeals to this court in relation to this part of the EAT's decision.

The DPA proceedings and the County Court judgment

Mr Cooper's claim in the County Court relying on the DPA was brought against both Sussex Police and SOCA. The claim against Sussex Police was settled. A claim against SOCA for misfeasance in public office was struck out, but Mr Cooper's claim against SOCA under the DPA for unlawful processing of his personal data proceeded to a hearing before HHJ Dight in the County Court.

In relation to that claim, SOCA submitted that it was entitled and legally required to investigate the incident on the night of 7 April 2012 and that its processing of the personal data of Mr Cooper contained in the Brighton custody material was justified under the DPA on one or more of a number of bases set out in that Act. Since the personal data were sensitive personal data, SOCA needed to be able to rely on at least one condition set out in Schedule 2 to the DPA and also on at least one condition set out in Schedule 3 to the DPA: see the first data protection principle set out at para. 1 of Schedule 1 to the DPA. SOCA submitted that Schedule 2 and Schedule 3 conditions were satisfied as follows: that by clause 24.2 of the employment contract and/or by agreeing to be bound by relevant SOCA policies under clause 3.2 of the employment contract Mr Cooper had consented to the processing of the Brighton custody material by SOCA for the purposes of its investigation of the incident and its disciplinary proceedings (under para. 1 of Schedule 2 DPA and para. 1 of Schedule 3 DPA); that such processing was necessary for the performance of the employment contract (para. 2(a) of Schedule 2 DPA); that such processing was necessary for compliance with legal obligations to which SOCA was subject (being obligations other than an obligation imposed by contract) (para. 3 of Schedule 2 DPA); that such processing was necessary for the exercise by SOCA of its functions conferred by or under an enactment (para. 5(b) of Schedule 2 DPA and para. 7(1)(b) of Schedule 3 DPA) or for the exercise of other functions of a public nature (para. 5(d) of Schedule 2 DPA); that such processing was necessary for the purposes of legitimate interests pursued by SOCA (para. 6(1) of Schedule 2 DPA); that such processing was necessary for the purposes of exercising or performing a right or obligation conferred or imposed by law on SOCA in connection with employment (para. 2(1) of Schedule 3 DPA); that such processing was necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings) – in that regard, SOCA's case was that its internal disciplinary proceedings were the relevant legal proceedings - or was otherwise necessary for the purpose of establishing, exercising or defending legal rights (para. 6(a) and (c) respectively of Schedule 3 DPA). SOCA also contended that it had the benefit of the limited exemption contained in section 35(2) of the DPA, from the non-disclosure provisions of the DPA (as defined in section 27 of the DPA), for the same reasons as applied in respect of para. 6(a) and (c) of Schedule 3 DPA.

Mr Cooper submitted that SOCA could not rely on any of these conditions in Schedules 2 and 3 DPA, and that therefore the processing by SOCA of his sensitive personal data in the Brighton custody material was in violation of SOCA's obligation under section 4(4) of the DPA to comply with the first data protection principle as set out in para. 1 of Schedule 1 to the DPA. He also submitted that in processing those data, and quite apart from the conditions in Schedule 2 DPA and Schedule 3 DPA, SOCA failed to act "fairly" and hence, again, in breach of the first data protection principle.

Mr Cooper further submitted that SOCA acted in breach of its obligation under section 4(4) of the DPA to comply with the second data protection principle, as set out in para. 2 of Schedule 1 DPA, in that his personal data in the Brighton custody material had been obtained by Sussex Police for one or more specified purposes (in particular, for the purposes of keeping an accurate record of events in relation to his arrest and custody and for prosecuting criminal proceedings against him), and that the further processing of those data by SOCA in the course of its investigation and disciplinary process was "in [a] manner incompatible with that purpose or those purposes".

There was debate before HHJ Dight regarding the meaning of the term "necessary" as used in these statutory provisions. The judge followed the approach set out by Green J in Hussain v Sandwell Metropolitan Borough Council [2017] EWHC 1641, that the requirement is one of reasonable necessity (Hussain at [230]): see County Court judgment at [121].

As regards compliance with the first data protection principle, HHJ Dight upheld the submissions of SOCA on each point of its contention that it was able to satisfy the specified conditions under Schedule 2 DPA and also under Schedule 3 DPA as set out above (he ruled against SOCA in relation to a further contention that it was able to rely upon condition 5 in Schedule 3 DPA, and it is not necessary to say any more about that). The judge also held that there was no significant additional and distinct complaint of unfair processing contrary to that principle (County Court judgment, [158]). Accordingly, Mr Cooper's claim in respect of breach of the first data protection principle failed.

HHJ Dight also held that SOCA had not acted in breach of the second data protection principle, since what was in issue under that principle was the purpose or purposes of SOCA in obtaining and using the Brighton custody material, and not the purposes of Sussex Police in generating the personal data in that material in the first place: see County Court judgment at [160]. The purposes of SOCA in obtaining and using the data for its investigation and disciplinary proceedings were specified and lawful in the requisite sense.

The judge also held, for the same reasons he had given in respect of para. 6(a) and (c) of Schedule 3 DPA, that SOCA had the benefit of the limited exemption in section 35(2) DPA, although in view of his principal conclusions in relation to the first and second data protection principles this ruling was not of any great consequence.

HHJ Dight gave a further reason for dismissing Mr Cooper's claim for damages. The judge found that Mr Cooper's claim failed for reasons of causation: [163]-[166]. If SOCA had not made use of the Brighton custody material, it would still have been the case that Mr Cooper would have informed SOCA of the charges against him (as he was obliged to do under the employment contract) and SOCA would have investigated what had happened. Mr Kerr would have sought to interview the police officers involved in the incident and Sussex Police would have cooperated by allowing them to be interviewed. They would have provided Mr Kerr with the substance of the information contained in the Brighton custody material and there would have been no legal impediment to SOCA acting on that information in the same way, as it would in fact have done. In any event, Mr Kerr would have attended the hearings in the Magistrates' Court and the Crown Court, as in fact he did, and would have noted all the evidence given against Mr Cooper on both those occasions. Again, this would have provided Mr Kerr with the substance of the information contained in the Brighton custody material and SOCA could and would have acted upon that information in the same way, by deciding to dismiss Mr Cooper.

Mr Cooper appeals to this court against HHJ Dight's judgment on a number of grounds: (1) the judge misapplied the first data protection principle in a number of respects (we were given a list of ten respects); (2) the judge misapplied the second data protection principle; (3) the judge failed properly to deal with another aspect of Mr Cooper's case, regarding provision of information by SOCA to Sussex Police; and (4) the judge erred in his findings on causation.

The legislative and policy context for SOCA's operations

I address the position as at the material time in 2012 and 2013. Part 2 of the PRA 2002 established the IPCC and set out a regime for the handling of complaints against and misconduct by persons serving with the police, providing for a division of responsibilities between local forces and the IPCC. Within Part 2, section 13 provided that Schedule 3 to the PRA 2002 (which makes provision for the handling of complaints and conduct matters and for the carrying out of investigations) should have effect and section 12(2) defined "conduct matter" as follows:

"In this Part 'conduct matter' means … any matter which is not and has not been the subject of a complaint but in the case of which there is an indication (whether from the circumstances or otherwise) that a person serving with the police may have –

(a) committed a criminal office; or

(b) behaved in a manner which would justify the bringing of disciplinary proceedings."

Section 29 made further provision for the interpretation of Part 2. It stated that "'recordable conduct matter' means … (a) a conduct matter that is required to be recorded by the appropriate authority under paragraph 10 or 11 of Schedule 3 or has been so recorded …".

Part 2 of Schedule 3 to the PRA 2002 was concerned with the handling of conduct matters. Paragraphs 11 and 12 of that Part provided so far as relevant as follows:

"11 Recording etc. of conduct matters in other cases

(1) Where—

(a) a conduct matter comes (otherwise than as mentioned in paragraph 10) to the attention of the local policing body or chief officer who is the appropriate authority in relation to that matter, and

(b) it appears to the appropriate authority that the conduct involved in that matter falls within sub-paragraph (2),

it shall be the duty of the appropriate authority to record that matter.

(2) Conduct falls within this sub-paragraph if (assuming it to have taken place)—

(a) it appears to have resulted in the death of any person or in serious injury to any person;

(b) a member of the public has been adversely affected by it; or

(c) it is of a description specified for the purposes of this sub-paragraph in regulations made by the Secretary of State.

(3) Where the appropriate authority records any matter under this paragraph it—

(a) shall first determine whether the matter is one which it is required to refer to the [IPCC] under paragraph 13 or is one which it would be appropriate to so refer; and

(b) if it is not required so to refer the matter and does not do so, may deal with the matter in such other manner (if any) as it may determine.

(4) Nothing in sub-paragraph (1) shall require the appropriate authority to record any conduct matter if it is satisfied that the matter has been, or is already being, dealt with by means of criminal or disciplinary proceedings against the person to whose conduct the matter relates.

…

12 Duties to preserve evidence relating to conduct matters

…

(2) Where a chief officer becomes aware of any recordable conduct matter relating to the conduct of a person under his direction and control, it shall be his duty to take all such steps as appear to him to be appropriate for the purposes of Part 2 of this Act for obtaining and preserving evidence relating to that matter.

(3) The chief officer's duty under sub-paragraph (2) must be performed as soon as practicable after he becomes aware of the matter in question.

(4) After that, he shall be under a duty, until he is satisfied that it is no longer necessary to do so, to continue to take the steps from time to time appearing to him to be appropriate for the purposes of Part 2 of this Act for obtaining and preserving evidence relating to the matter.

…"

The Police (Complaints and Misconduct) Regulations 2004 ("the 2004 Regulations") were promulgated pursuant to the PRA 2002. Regulation 5(1) specified conduct falling within para. 11(2)(c) of Schedule 3 to the PRA 2002 and hence to be treated as a "recordable conduct matter" for the purposes of Schedule 3, including at regulation 5(1)(f) "conduct whose gravity or other exceptional circumstances make it appropriate to record the matter in which the conduct is involved." It was on the basis of this provision that SOCA on 11 April 2012, after its initial assessment of the information it had received about Mr Cooper's conduct, treated his conduct as a recordable conduct matter.

SOCA was not a police force, so its staff did not qualify as persons serving with the police as defined in section 12(7) of the PRA; hence Part 2 of the PRA as enacted had no direct application in relation to SOCA and its staff. The same is true, as it seems to me, of Schedule 3 to the PRA, which again is predicated on there being a complaint or conduct matter or a death or serious injury matter in relation to a person serving with the police. Also, the duties created by Schedule 3 are, apart from those imposed on the IPCC, imposed on "local policing bodies" and "chief officers"; whereas SOCA was not a "local policing body" and the Director General of SOCA was not a "chief officer". (At a late stage in the hearing, and in written submissions thereafter, counsel for Mr Cooper and counsel for SOCA both suggested that Part 3 of Schedule 3 did apply without more in relation to SOCA staff, but that does not seem to me to be correct; for the purposes of the present analysis, however, it does not seem to me to matter which view is right).

However, section 26A(1) of the PRA, as inserted into Part 2 of the PRA by SOCPA 2005, required SOCA and the IPCC to enter into an agreement "for the establishment and maintenance in relation to members of [SOCA's] staff of procedures corresponding or similar to those provided for by or under this Part". Section 26A(3) provided that such an agreement "may contain provision for enabling [the IPCC] to bring and conduct, or otherwise participate or intervene in, any proceedings which are identified by the agreement as disciplinary proceedings in relation to members of [SOCA's] staff".

Pursuant to section 26A, on 31 March 2006 the IPCC and SOCA entered into the IPCC Agreement. Recital 3 to the Agreement stated:

"The Parties to this Agreement intend that any complaint about the conduct of a member of the Staff of SOCA made on or after 1 April 2006, any conduct matters involving such a person and any death or serious injury matter following contact with such a person coming to the attention of the appropriate authority on or after that date should be dealt with in accordance with the relevant provisions of Part 2 of Schedule 3 to the Police Reform Act 2002."

Clause 1(2) of the IPCC Agreement set out various definitions. It provided that "complaint" and "conduct matter" were to be construed in accordance with sections 12 and 29 of the PRA and that "misconduct policy" meant the SOCA Misconduct and Discipline Policy.

Clause 2(2) of the IPCC Agreement stated:

"A conduct matter coming to the attention of the appropriate authority [as defined in clause 1(2)] in relation to the conduct of a member of the staff of SOCA shall be treated as if it had come to the attention of the authority under paragraph 10 or 11 of Schedule 3 to the 2002 Act and as if the provisions of Part 2 of the Act dealing with conduct matters applied to it, and accordingly in those provisions-

(a) a reference to a chief officer shall be treated as a reference to the Director General, and

(b) a reference to a police authority shall be treated as a reference to SOCA".

Clause 2(1) and (3), respectively, made similar provision to incorporate the statutory provisions in respect of complaints and death or serious injury matters in relation to members of the staff of SOCA. Clause 2(4) provided that the 2004 Regulations should be treated as applying to complaints and conduct matters involving the staff of SOCA.

Clause 5(1) of the IPCC Agreement provided that "SOCA will ensure that all reports, complaints and allegations about the conduct of a member of staff of SOCA are dealt with in accordance with the misconduct policy".

SOCA was established by section 1 of SOCPA 2005. Section 2 stated that SOCA had the functions of preventing and detecting serious crime and contributing to its reduction and the mitigation of its consequences. Section 3(1) provided that SOCA has the function of gathering, storing, analysing and disseminating information relevant to the prevention, detection, investigation or prosecution of offences. Section 5 conferred general powers on SOCA; subsection (3) provided that despite the references to serious organised crime in section 2(1), SOCA could carry on activities in relation to other crime if they were carried on for the purposes of any of the functions conferred on SOCA by section 2 or 3. Section 32 provided that information obtained by SOCA in connection with the exercise of any of its functions could be used by it in connection with the exercise of any of its other functions.

SOCA's Misconduct and Discipline Policy, referred to in the IPCC Agreement and the employment contract, made provision in relation to notification and investigation of conduct issues. Paragraph 3.1 stated that all employees had a responsibility to report any matter to the Conduct Unit which may result in them being subject to any alleged misconduct or discipline issues and that they were required to engage and participate in all actions taken under the policy. Paragraph 3.2 stated that line management would contact SOCA's Security Department should concerns arise regarding the potential security implications of a discipline or misconduct issue. Paragraph 3.4 set out the functions of the Conduct Unit, which included acting as a central point of receipt for all misconduct and discipline allegations, managing all allegations of misconduct, initiating and arranging an appropriate investigation into the allegations and ensuring that investigations were carried out in an appropriate and timely manner proportionate to the allegation. Paragraph 6.3 provided that where a matter had been referred to the Conduct Unit, "an investigation proportionate to the seriousness of the allegation will be carried out by an Investigating Officer appointed by the [Conduct Unit] to establish the facts". In the present case, Mr Phillips was the relevant officer in the Conduct Unit and Mr Kerr was the appointed Investigating Officer.

SOCA also had in place a number of other policies of which Mr Cooper had been notified in accordance with clause 3.2 of the employment contract. These included SOCA's Security Clearance Policy and the Revelation Policy.

The Security Clearance Policy stated that all security cleared personnel within SOCA were subject to being monitored to confirm their ongoing suitability to access sensitive information (para. 1); that "These checks are essential to protect SOCA's legitimate interests and are required by the Government Security Policy Framework" (para. 1); and that the security vetting process was continuous and that staff had an obligation to maintain their clearance including the reporting of changes to personal circumstances (para. 2); and defined change of personal circumstances to include arrests and being subject to criminal proceedings and investigations (para. 5.2).

The Revelation Policy was concerned with disclosure to prosecuting authorities of information about misconduct and criminal proceedings regarding SOCA staff called as witnesses in prosecutions of third party defendants which might have a bearing on the credibility of such witnesses and hence be disclosable under the CPIA 1996. Paragraph 4.1 reminded staff of the duty upon them to reveal such matters and para. 4.2 stated that the duty to reveal would usually be confined to complaints or allegations leading to a criminal conviction and/or a misconduct finding that had incurred a sanction under SOCA policy. By para. 6, the duty to reveal was extended to being subject to internal disciplinary proceedings.

The DPA

SOCA became a data controller in respect of the Brighton custody material (and some of the information in that material which was provided by Sussex Police in advance of 4 May 2012) when it came into SOCA's possession. As I have said, the information so provided constituted sensitive personal data of Mr Cooper. Under section 4(4) of the DPA, and subject to section 27(1), it was the duty of SOCA as data controller to comply with the data protection principles. Section 13(1) provides a right to compensation for an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of the DPA.

Part IV of the DPA sets out a series of exemptions from obligations under the Act. Section 27(3)-(4) provides a definition of "the non-disclosure provisions" for the purposes of that Part, which include "the first data protection principle, except to the extent to which it requires compliance with the conditions in Schedules 2 and 3" and the second data protection principle.

Section 35(2) provides:

"Personal data are exempt from the non-disclosure provisions where the disclosure is necessary-

(a) for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) …

Or is otherwise necessary for the purposes of establishing, exercising or defending legal rights."

Part I of Schedule I to the DPA sets out the data protection principles. The first and second data protection principles are stated as follows:

"1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes."

Part II of Schedule I to the DPA sets out provisions relating to the interpretation of the data protection principles. Paragraph 2 provides in relation to the first data protection principle in relevant part as follows:

"(1) … for the purposes of the first principle data are not to be treated as processed fairly unless –

(a) in the case of data obtained from the data subject, the data controller ensures so far as practicable that the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3), and

(b) In any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3).

(2) In sub-paragraph (1)(b) 'the relevant time' means – (a) the time when the data controller first processes the data …

(3) The information referred to in sub-paragraph (1) is as follows, namely –

(a) the identity of the data controller, …

(c) the purpose or purposes for which the data are intended to be processed, and

(d) any further information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair."

In relation to the second data protection principle, paragraphs 5 and 6 of Part II of Schedule I to the DPA provide as follows:

"5. The purpose of purposes for which personal data are obtained may in particular be specified-

(a) in a notice given for the purposes of paragraph 2 by the data controller to the data subject, or

(b) in a notification given to the [Information Commissioner] under Part III of this Act.

6. In determining whether any disclosure of personal data is compatible with the purpose or purposes for which the data were obtained, regard is to be had to the purpose or purposes for which the personal data are intended to be processed by any person to whom they are disclosed."

Schedule 2 to the DPA sets out the first set of conditions referred to in the first data protection principle, including the following:

"1. The data subject has given his consent to the processing.

2. The processing is necessary –

(a) for the performance of a contract to which the data subject is a party, …

3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

…

5. The processing is necessary –

…

(b) for the exercise of any functions conferred on any person by or under any enactment,

…

(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject. …"

Schedule 3 to the DPA sets out the second set of conditions referred to in the first data protection principle as relevant to processing of sensitive personal data, including the following:

"1. The data subject has given his explicit consent to the processing of the personal data.

2(1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.

…

6. The processing –

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

…

(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

7(1) The processing is necessary –

…

(b) for the exercise of any functions conferred on any person by or under an enactment …"

The DPA is the United Kingdom's legal instrument which implements Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("the Directive"). Although we were taken to certain provisions in the Directive to see how they tied in with the provisions in the DPA it is not necessary to set them out here, because it was not suggested that any provision of the DPA was inconsistent with the provisions of the Directive in any material respect. In my opinion, no assistance in resolving the particular issues before us is to be derived from the terms of the Directive itself.

As at the material time in this case, the Information Commissioner's Office had issued a Data Sharing Code of Practice dated May 2011 ("the Code of Practice"). The Code of Practice provided guidance on, among other things, the consent conditions at condition 1 in Schedule 2 DPA and at condition 1 in Schedule 3 DPA. The guidance referred to the definition of consent in the Directive ("any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed") and stated (p. 15),

"There must therefore be some form of active communication where the individual knowingly indicates consent … If you are going to rely on consent as your condition you must be sure that individuals know precisely what data sharing they are consenting to and its implications for them. They must also have genuine control over whether or not the data sharing takes place. …"

Discussion

The County Court appeal

It is important to emphasise that in respect of the DPA this court is only concerned with Mr Cooper's claim against SOCA, and not with his claim against Sussex Police. It is the lawfulness of the processing by SOCA of his personal data as reflected in the Brighton custody material which is in issue.

On this appeal, the right of SOCA to require high standards of conduct of its employees on and off duty is not in doubt. In Mr Cooper's case, that was made clear by the employment contract and the various SOCA policies referred to above; and in recognition of this he himself very properly informed SOCA that he had been arrested on the night of 7 April 2012. Since Mr Cooper also properly informed Sussex Police that he worked for SOCA, Sussex Police also acted correctly in contacting SOCA to alert them to this, since it might obviously raise issues about his suitability to be a SOCA employee and regarding his access to sensitive material of the kind handled by SOCA.

In this context, it is in my view entirely unsurprising that when SOCA was provided by Sussex Police with the information which is in issue in these proceedings, SOCA should wish to use it to get to the bottom of what had happened on the night of 7 April 2012. It needed to do that in order to assess whether what Mr Cooper had done was of a seriousness which merited further action being taken against him (either by reference of his case to the IPCC or by instituting disciplinary proceedings) or whether it might affect his security clearance.

In my judgment, there is no merit in this appeal and HHJ Dight was right to dismiss Mr Cooper's claim for the reasons he gave. That is subject to one point on which I consider the judge was in error; but in the overall context of his judgment this error was immaterial.

The present case is closely similar to Laverty v Police Service for Northern Ireland [2015] NICA 75, and the points of distinction urged on us by Mr Coppel do not stand up to scrutiny. In Laverty, the Police Service for Northern Ireland ("PSNI") received personal data of Mr Laverty, one of its officers, from the Irish police in respect of an incident in Eire in which Mr Laverty had been involved. In the event, Mr Laverty was not prosecuted in Eire, but the PSNI used the personal data it had received about the incident as the foundation for an investigation which led to disciplinary proceedings against Mr Laverty on charges that whilst off duty he behaved in a manner that was likely to bring discredit upon the PSNI and that he had failed to notify the Chief Constable of the PSNI that he was the subject of a criminal investigation by the Irish police. As a result of those disciplinary proceedings, Mr Laverty was dismissed. The Northern Ireland Court of Appeal held that the processing of these personal data of Mr Laverty by the PSNI was justified and lawful under the DPA. Mr Coppel emphasises that the disciplinary proceedings in Laverty were governed by a statutory instrument, rather than by an employment contract as in this case. However, as appears below, I do not regard that as a significant point of difference from this case. The Northern Ireland Court of Appeal held that "the investigation into the conduct of [Mr Laverty] and the disciplinary proceedings against [him] were undertaken in furtherance of the public interest in the integrity of the PSNI and its membership and the removal of those adjudged to be unsuitable" ([49]) and that the processing of the data by the PSNI had satisfied conditions 3 and 5 in Schedule 2 DPA ([51]) and conditions 3, 6 and 7 in Schedule 3 DPA ([52]).

Ground (1): compliance with the first data protection principle

By virtue of section 4(4) of the DPA, SOCA was obliged to act in conformity with the data protection principles. That obligation was qualified somewhat if the exemption in section 35(2) of the DPA applied, as the judge held it did. However, since I consider that the processing by SOCA was justified and in compliance with the first data protection principle in any event, it is convenient to address that question first before turning to section 35(2).

The issues which arise in relation to the first data protection principle are whether the relevant sensitive personal data of Mr Cooper in this case were processed by SOCA in circumstances where (i) at least one of the conditions in Schedule 2 DPA was met; (ii) at least one of the conditions in Schedule 3 DPA was also met; and (iii) the processing was conducted "fairly", within the meaning of paragraph 1 of Part I of Schedule 1 DPA (there was no separate issue based on the word "lawfully" which also appears in that paragraph). Since the processing cannot be regarded as fair and lawful under the first data protection principle unless it complies with at least one condition in Schedule 2 DPA and with at least one condition in Schedule 3 DPA, it is appropriate first to address issues (i) and (ii), which involve focused questions turning on the terms of particular conditions in those Schedules, before turning to the general question in issue (iii). As the drafting of the first data protection principle makes clear, the obligation of "fair" processing under that principle is wider than simply being able to show that there has been compliance with conditions under Schedule 2 DPA and Schedule 3 DPA, so I will refer to the wider or back-stop question of fairness under issue (iii) as involving an obligation of "overarching fairness".

(i) Compliance with conditions in Schedule 2 DPA

In my judgment, HHJ Dight was right to find that the processing of the relevant data by SOCA was in compliance with each of condition 1 (consent of the data subject, i.e. Mr Cooper); condition 2(a) (necessary for the performance of a contract to which the data subject is a party, i.e. the employment contract); condition 3 (necessary for compliance with legal obligations to which the data controller – i.e. SOCA – is subject, other than an obligation imposed by contract); condition 5(b) (necessary for the exercise of functions conferred on SOCA by or under any enactment); condition 5(d) (necessary for the exercise of other functions of a public nature exercised in the public interest by SOCA); and condition 6(1) (necessary for the purposes of legitimate interests pursued by SOCA, the data controller). I address each of these in turn below.

Before doing so I will first consider a general submission made by Mr Coppel regarding the meaning of the word "necessary" as used in some of these conditions. Mr Coppel submitted that HHJ Dight had adopted too lax an interpretation of that word in his analysis (in particular, at [121]-[122]), where he followed the approach set out by Green J (as he then was) in Hussain v Sandwell Metropolitan Borough Council [2017] EWHC 1641; [2018] PTSR 142 at [230]). In that paragraph Green J said:

"… The test of necessity in the conditions means more than desirable but less than indispensable or absolutely necessary: see e.g. Goldsmith International Business School v Information Comr [2014] UKUT 563 (AAC) at [37]. A test of reasonable necessity should be applied: see the Goldsmith International Business School case, para. [38]. This test implies that the council [the data controller in that case] has an appropriate margin of appreciation. The parties agreed that the power had to be exercised proportionately. …"

The propositions set out by Green J, taken from the Goldsmith International Business School case, are in fact, as the Upper Tribunal (Administrative Appeals Chamber) made clear in its decision, a summary of the law derived from other authorities, including in particular the judgment of the Divisional Court in Corporate Officer of the House of Commons v Information Commissioner [2008] EWHC 1084 (Admin), in particular at [43]; Farrand v Information Commissioner [2014] UKUT 310 (AAC), in particular at [26]-[27]; and South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55; [2013] 1 WLR 2421, in particular at [27]. Mr Coppel did not take us to the judgments in these cases to try to demonstrate that the Upper Tribunal's summary of their effect was wrong, still less to try to demonstrate that the reasoning in these cases in explaining the meaning of the term "necessary" was wrong. Having looked at the judgments, it seems to me that the summary given by the Upper Tribunal and adopted by Green J is accurate, and I cannot see any error in the reasoning in the cases referred to by the Upper Tribunal.

This Court itself pointed out that the Supreme Court addressed this issue in the South Lanarkshire case, in which the relevant European authorities were reviewed. Baroness Hale of Richmond DPSC delivered the judgment of the court. In that case, the local authority was arguing that the Information Commissioner had been in error in adopting a proportionality approach to the term "necessary", rather than giving it what might arguably be said to be its stricter natural and ordinary meaning. That argument was rejected by the Supreme Court. Baroness Hale noted with evident approval at [23] that counsel for the local authority, Mrs Wolffe, stopped short "of arguing that 'necessary' means 'absolutely necessary' or even 'strictly necessary'", and added, again with approval, "She has also to accept that something may be necessary if it makes furthering the purposes of a legitimate interest [as referred to in Article 7(f) of the Directive and condition 6 in Schedule 2 DPA] more effective." At paras. [25]-[27] Baroness Hale said this:

"25. I agree with Mrs Wolffe to this extent: the word "necessary" has to be considered in relation to the processing to which it relates. If that processing would involve an interference with the data subject's right to respect for his private life, then the Austrian Radio case is clear authority for the proposition that the requirements of article 8(2) of the European Convention on Human Rights must be fulfilled. However, that was a case about article 7(e), where there is no express counterbalancing of the necessary processing against the rights and interests of the data subject. In a case such as this, where that balance is built into article 7(f) and condition 6, it may not matter so much where the requirements of article 8(2) are considered, as long as the overall result is compliant with them.

26. In this particular case, however, as the processing requested would not enable Mr Irvine or anyone else to discover the identity of the data subjects, it is quite difficult to see why there is any interference with their right to respect for their private lives. It is enough to apply article 7(f) and condition 6 in their own terms.

27. I disagree with Mrs Wolffe, however, about the meaning of "necessary". It might be thought that, if there is no interference with article 8 rights involved, then all that has to be asked is whether the requester is pursuing a legitimate interest in seeking the information (which is not at issue in this case) and whether he needs that information in order to pursue it. It is well established in community law that, at least in the context of justification rather than derogation, "necessary" means "reasonably" rather than absolutely or strictly necessary (see, for example, R v Secretary of State for Employment, Ex p Seymour-Smith (No 2) [2000] 1 WLR 435; Chief Constable of West Yorkshire Police v Homer [2012] UKSC 15; [2012] ICR 704). The proposition advanced by Advocate General Poiares Maduro in Huber [Case C-524/06 Huber v Bundesrepublik Deustchland [2009] All ER (EC) 239] is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. Thus, for example, if Mr Irvine had asked for the names and addresses of the employees concerned, not only would article 8 have clearly been engaged, but the Commissioner would have had to ask himself whether his legitimate interests could have been served by a lesser degree of disclosure."

The proposition advanced by Advocate General Poiares Maduro referred to (point 47 in his opinion in the Huber case), and set out by Baroness Hale at [22], was as follows:

"The concept of necessity has a long history in Community law and is well established as part of the proportionality test. It means that the authority adopting a measure which interferes with a right protected by Community law in order to achieve a legitimate aim must demonstrate that the measure is the least restrictive for the achievement of this aim."