England and Wales Court of Appeal (Civil Division) Decisions

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
ADMINISTRATIVE COURT
Ouseley J
[2017] EWHC 1930 (Admin)

		Royal Courts of Justice Strand, London, WC2A 2LL
		08/03/2019

Sir Terence Etherton MR, Lady Justice Sharp and Lord Justice Irwin:

Introduction

1. This is an appeal against the order dated 26 July 2017 of Ouseley J, by which he dismissed the claim of the appellant, Dr Salman Butt, for judicial review of the Home Office's revised Prevent Duty Guidance ("the PDG") and the associated Higher Education Prevent Duty Guidance ("the HEPDG") (together "the Guidance"), and the collection, recording and sharing of information relating to Dr Butt by the Extremism Analysis Unit ("the EAU") of the Home Office.
2. Broadly, Dr Butt maintains that the Guidance and, in particular the HEPDG, is unlawful as ultra vires, and in contravention of the statutory duty of the Secretary of State to ensure freedom of speech in universities and other further education institutions, and contrary to the right of free speech both under common law and Article 10 of the European Convention on Human Rights ("the Convention"); and that the collection, recording and sharing of information relating to Dr Butt by the EAU is in breach of his privacy rights under Article 8 of the Convention.

The Government's Prevent strategy

3. The Prevent strategy is a part of the Government's wider counter-terrorism strategy, CONTEST. The aim of the Prevent strategy is to reduce the threat of terrorism to the UK by preventing people from being drawn into terrorism or supporting terrorist ideologies. The strategy is implemented by way of a statutory duty on universities and other higher education institutions to "have due regard to the need to prevent people from being drawn into terrorism" imposed by section 26 of the Counter-Terrorism and Security Act 2015 ("CTSA").
4. On 17 September 2015 the respondent, the Secretary of State for the Home Department, announced the coming into force of the PDG and the HEPDG on the following day. They were brought into force on 18 September 2015 by statutory instrument dated 17 September 2015, following debate and approval by affirmative resolution of each House of Parliament. They are complementary and are intended to be read together.
5. The PDG sets out generally the steps that specified authorities, which include universities and other higher education institutions (together "RHEBs"), are expected to take to comply with their duty under section 26(1) of the CTSA. The PDG recommends a "risk-based approach" to discharging the duty, which means monitoring and understanding the risk of radicalisation in their institution (PDG [14]). The guidance describes itself as "best practice" for the specified authorities (PDG [13]), and it is expressly contemplated that compliance with it is expected and will be monitored by the Home Office (PDG [23]-[28]).
6. The HEPDG is specific to RHEBs. Of particular relevance is paragraph 5, which states as follows:

"Compliance with the Prevent duty requires that properly thought through procedures and policies are in place. Having procedures and policies in place which match the general expectations set out in this guidance will mean that institutions are well placed to comply with the Prevent duty. Compliance will only be achieved if these procedures and policies are properly followed and applied. This guidance does not prescribe what appropriate decisions would be - this will be up to institutions to determine, having considered all the factors of the case."

7. Paragraph 11 of the HEPDG is at the heart of the challenge to the lawfulness of the Guidance. It is in the section dealing with external speakers, and is as follows:

"… when deciding whether or not to host a particular speaker, RHEBs should consider carefully whether the views being expressed, or likely to be expressed, constitute extremist views that risk drawing people into terrorism or are shared by terrorist groups. In these circumstances the event should not be allowed to proceed except where RHEBs are entirely convinced that such risk can be fully mitigated without cancellation of the event. This includes ensuring that, where any event is being allowed to proceed, speakers with extremist views that could draw people into terrorism are challenged with opposing views as part of that same event, rather than in a separate forum. Where RHEBs are in any doubt that the risk cannot be fully mitigated they should exercise caution and not allow the event to proceed."

8. "Extremism" is defined in the PDG glossary as:

"vocal or active opposition to fundamental British values, including democracy, the rule of law, individual liberty and mutual respect and tolerance of different faiths and beliefs. We also include in our definition of extremism calls for the death of members of our armed forces, whether in this country or overseas."

The EAU

9. The EAU is a unit within the Home Office established in December 2014. It assists all government departments and the public sector with understanding and responding to extremism in the UK and abroad. The EAU conducts "all source" research into individuals, as well as identifying extremist networks and trends. By "all source" is meant drawing information from both publicly available and private sources of information.
10. The EAU's research allows the Home Office to flag events taking place in RHEBs as events of concern. Where a speaker identified as extremist is known to be giving a talk, the Home Office will contact local "Prevent Duty Coordinators", who will then liaise with their counterparts at RHEBs so that a risk assessment can be carried out.
11. One source on which the EAU relies is information gathered by external bodies. One such body is Student Rights, an organisation set up by a British-based think tank called the Henry Jackson Society. Student Rights was established with the aim of researching and understanding extremism on university campuses. Student Rights kept track of the occurrence and content of various events taking place on university campuses in the UK. These included talks given by Dr Butt, who was named in a Student Rights digest of October 2014 which was provided to the Home Office.
12. The EAU processed information relating to Dr Butt on three occasions. They are described in more detail in the Discussion section of this judgment.

Dr Butt

13. Since 2005 Dr Butt has been the editor in chief of "Islam21C", a publicly accessible website describing itself as articulating Islamic beliefs in the 21st century. He has spoken at various universities at the invitation of student societies, as well as at schools and at conferences, on issues relating to Islamic beliefs.
14. The announcement on 17 September 2015 of the coming into force of the PDG on the following day was made in a press release of the Prime Minister's Office and the Home Office jointly ("the press release"), in which Dr Butt was identified as an extremist "hate speaker". The press release stated that he had been identified as an extremist on the basis of research carried out by the EAU.
15. Dr Butt denies that his views are extremist, that he opposes fundamental British values, and that he supports the activities of any extremist or terrorist groups.
16. Dr Butt claims that he has suffered as a result of the press release and the Guidance. He says that he has received far fewer invitations to speak than he would have expected based on past trends, and that he has declined others in order to spare the inviting institutions the embarrassment of being associated with a "hate speaker".

The legal framework

CTSA, the Terrorism Act 2000 ("TA") and the Education (No.2) Act 1986 ("E2A")

17. CTSA Part 5 Chapter 1 contains provisions to prevent people from being drawn into terrorism.
18. As stated above, section 26(1) imposes a duty on specified authorities to "have due regard to the need to prevent people from being drawn into terrorism".
19. By section 35(3), "terrorism" has the meaning given by TA section 1. TA section 1(1) provides that the use or threat of action constitutes "terrorism" if:

"(b) … designed to influence the government or an international governmental organisation or to intimidate the public or a section of the public, and

(c) the use or threat is made for the purpose of advancing a political, religious, racial or ideological cause."

20. TA section 1(2) provides that terrorism is the use or threat of action that

"(a) involves serious violence against a person,

(b) involves serious damage to property,

(c) endangers a person's life, other than that of the person committing the action,

(d) creates a serious risk to the health or safety of the public or a section of the public, or

(e) is designed seriously to interfere with or seriously to disrupt an electronic system."

21. Section 27 CTSA gives the Secretary of State the power to specify the authorities to which the duty in section 26 applies. These are the "specified authorities". As described in Schedule 6 to the CTSA, they include RHEBs.
22. By section 29 CTSA the Secretary of State may also issue guidance to specified authorities "about the exercise of their duty under section 26(1)". By section 29(2) CTSA specified authorities "must have regard to any such guidance in carrying out that [s.26(1)] duty."
23. The power to issue guidance is complemented by a power conferred by section 30 CTSA for the Secretary of State to issue directions to a specified authority where the Secretary of State considers that the specified authority has failed to discharge the duty imposed by section 26(1). Section 30(2) provides that such directions may be enforced by a mandatory order of the court.
24. Section 32 CTSA makes provision for monitoring the discharge by specified authorities of their section 26 duty. The specified authorities must give to the monitoring authority "any information that the monitoring authority may require for the purposes of monitoring that body's performance in discharging the duty imposed by section 26(1)". That information must include the steps that the specified body will take to ensure it discharges its section 26 duty. The monitoring authority may be either the Secretary of State or a person to whom he has delegated the function of monitoring compliance.
25. The Higher Education Funding Council for England ("HEFCE") was the monitoring authority for RHEBs until that function was delegated to the Office for Students. HEFCE produced guidance about its framework for monitoring whether RHEBs have appropriate policies to enable them to discharge their section 26(1) duty.
26. Section 31 CTSA makes special provision for the protection of freedom of expression in RHEBs. It imposes duties in that respect on both RHEBs and on the Secretary of State. Section 31(2) provides that RHEBs must "have particular regard to the duty to ensure freedom of speech" when carrying out the duty imposed by section 26(1). Section 31(3) provides that, when issuing guidance under section 29, the Secretary of State is required to have "particular regard to the duty to ensure freedom of speech, in the case of authorities that are subject to that duty". The same duty applies where the Secretary of State issues directions under section 30.
27. Section 31(5) provides that the "duty to ensure freedom of speech" means the duty imposed by E2A section 43(1) on universities and any other higher or further education institution. Section 43 is as follows, so far as relevant:

"(1) [RHEBs] shall take such steps as are reasonably practicable to ensure that freedom of speech within the law is secured for members, students and employees of the establishment and for visiting speakers.

(2) The duty imposed by subsection (1) above includes (in particular) the duty to ensure, so far as is reasonably practicable, that the use of any premises of the establishment is not denied to any individual or body of persons on any ground connected with—

(a) the beliefs or views of that individual or of any member of that body; or

(b) the policy or objectives of that body.

(3) The governing body of every such establishment shall, with a view to facilitating the discharge of the duty imposed by subsection (1) above in relation to that establishment, issue and keep up to date a code of practice setting out—

(a) the procedures to be followed by members, students and employees of the establishment in connection with the organisation—

(i) of meetings which are to be held on premises of the establishment and which fall within any class of meeting specified in the code; and

(ii) of other activities which are to take place on those premises and which fall within any class of activity so specified; and

(b) the conduct required of such persons in connection with any such meeting or activity;

and dealing with such other matters as the governing body consider appropriate.

(4) Every individual and body of persons concerned in the government of any such establishment shall take such steps as are reasonably practicable (including where appropriate the initiation of disciplinary measures) to secure that the requirements of the code of practice for that establishment, issued under subsection (3) above, are complied with.

…

(8) Where a students' union occupies premises which are not premises of the establishment in connection with which the union is constituted, any reference in this section to the premises of the establishment shall be taken to include a reference to the premises occupied by the students' union."

The Regulation of Investigatory Powers Act 2000 ("RIPA")

28. Part II of RIPA provides a statutory basis for the authorisation of surveillance by specified public authorities.
29. Section 48(2) provides the following non-exclusive definition of "surveillance":

"(a) monitoring, observing or listening to persons, their movements, their conversations or their other activities or communications;

(b) recording anything monitored, observed or listened to in the course of surveillance; and

(c) surveillance by or with the assistance of a surveillance device."

The expression "surveillance device" is defined in section 48(1) as "any apparatus designed or adapted for use in surveillance".

30. Section 26 defines the conduct to which Part II applies. By section 26(1)(a) this includes "directed surveillance". That expression is defined in section 26(2), as follows:

"(2) Subject to subsection (6), surveillance is directed for the purposes of this Part if it is covert but not intrusive and is undertaken–

(a) for the purposes of a specific investigation or a specific operation;

(b) in such a manner as is likely to result in the obtaining of private information about a person (whether or not one specifically identified for the purposes of the investigation or operation); and

(c) otherwise than by way of an immediate response to events or circumstances the nature of which is such that it would not be reasonably practicable for an authorisation under this Part to be sought for the carrying out of the surveillance."

31. By section 26(1)(b) and (c) Part II also applies to "intrusive surveillance" and "the conduct and use of covert human intelligence sources" respectively but these are not relevant to the present proceedings.
32. Section 26(9)(a) provides that "surveillance is covert if, and only if, it is carried out in a manner that is calculated to ensure that persons who are subject to the surveillance are unaware that it is or may be taking place".
33. Subsections (4) and (6) of section 26 exempt from Part II certain forms of surveillance that would otherwise fall within the definitions of directed and intrusive surveillance. Those exceptions are not relevant to this appeal.
34. Section 27 makes lawful any conduct that falls within section 26 if it has been authorised under RIPA and conducted in accordance with the authorisations.
35. Section 28 empowers persons designated by order of the Secretary of State to authorise directed surveillance. By subsection (2), authorisations are not to be granted unless the authorising person believes:

"(a) that the authorisation is necessary on grounds falling within subsection (3); and

(b) that the authorised surveillance is proportionate to what is sought to be achieved by carrying it out."

36. The grounds in subsection (3) are, as follows:

"(a) in the interests of national security;

(b) for the purpose of preventing or detecting crime or of preventing disorder;

(c) in the interests of the economic well-being of the United Kingdom;

(d) in the interests of public safety;

(e) for the purpose of protecting public health;

(f) for the purpose of assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department; or

(g) for any purpose (not falling within paragraphs (a) to (f)) which is specified for the purposes of this subsection by an order made by the Secretary of State."

37. Section 80 is a savings provision for lawful conduct. It makes clear that conduct that would have been lawful apart from RIPA remains lawful notwithstanding the absence of authorisation under RIPA.

The Data Protection Act 1998 ("the DPA")

38. The DPA was enacted pursuant to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("the Data Protection Directive"). Relevant provisions of the DPA are set out in the Appendix to this judgment.

The Human Rights Act 1998 ("the HRA") and the Convention

39. Relevant provisions of the HRA and of the Convention are set out in the Appendix to this judgment.

The proceedings

40. The factual matters we have mentioned above, and others which we mention subsequently in the Discussion section of this judgment, are sufficient to understand the context of these proceedings. Reference should be made to the lengthy and detailed judgment of the Judge for further factual details of the background to the commencement of the proceedings.
41. Dr Butt issued the claim form on 15 December 2015 for judicial review of "the decision made by the [EAU] to include [Dr Butt's] name in the list of speakers that are allegedly on the record as expressing extremist views". There was subsequently served on his behalf an amended "Detailed Statement of Facts and Grounds" dated 22 June 2016, which was in excess of 64 pages and 173 paragraphs. In that document Dr Butt sought the following relief: a declaration that the PDG is unlawful; an order quashing the PDG in whole or in part; a mandatory order requiring the Secretary of State to promulgate lawful guidance under section 29(1) CSTA; a declaration that the collection, storage and/or dissemination of information concerning Dr Butt by the EAU was unlawful; a mandatory order requiring the Secretary of State to promulgate lawful guidance concerning the collection, storage and/or dissemination of information by the EAU; an injunction pursuant to section 10 and/or 14 of the DPA to prevent the Secretary of State from continuing to unlawfully process the personal data of Dr Butt; an order pursuant to section 14 of the DPA requiring the erasure of the personal data of Dr Butt forming the subject matter of the action; a declaration that the Secretary of State acted unlawfully in issuing the press release naming Dr Butt as an individual associated with extremism; a final injunction to restrain the Secretary of State from publishing or causing or permitting to be published the words complained of or any similar words; and an order pursuant to section 13(1) of the Defamation Act 2013 for the removal of the words complained of from online digital content operated by or on behalf of the Secretary of State; damages, including damages under section 8(2) of the HRA, and/or compensation pursuant to section 13 of the DPA, and/or damages, including aggravated damages, for libel; and costs.
42. The defamation claim was the subject of separate proceedings and is not considered further in this judgment.

The judgment

43. Ouseley J heard the claim over 4 days in December 2016. He handed down his comprehensive judgment, which runs to 277 paragraphs, on 26 July 2017. He dismissed the claim.
44. With no disrespect to the Judge, it is not necessary to set out his extensive reasoning in detail. The following brief summary is sufficient for the purposes of setting the context for the appeal.
45. The Judge said that he made no findings one way or the other about any of Dr Butt's views. The Judge said that whether or not Dr Butt is an "extremist" or "hate speaker", and what the effect of the press release on him has been, were issues for defamation and allied damages litigation.
46. The Judge rejected the argument that the Guidance was outside the power conferred by section 29 CTSA because, instead of being directed at and limited to terrorism, it was also directed at non-violent extremism. The Judge reasoned that the Guidance was directed at non-violent extremism only if it risked drawing people into terrorism and that was within the scope of section 26.
47. The Judge rejected the argument that the Secretary of State had failed to comply with her duty under section 31(3) CTSA when issuing the Guidance. He had already addressed the issue of non-violent extremism. So far as concerns the statement in paragraph 11 of the HEPDG that RHEBs should not allow an event to proceed if there was any unmitigated risk of extremist views drawing people into terrorism, the Judge reasoned that the Guidance was guidance and not a direction; there were numerous references to the importance of academic freedom and freedom of speech; and it was left to the judgment of RHEBs, having regard to their duty under section 31(3) CTSA, to decide whether protecting freedom of speech rather than the risk of people being drawn into terrorism was more important in any particular case; any failure by the RHEBs to carry out that balancing evaluation correctly would be a basis for challenging their decision but their possible dereliction of duty was not a ground for challenging the issuing of the Guidance.
48. The Judge rejected the argument that the Guidance breached Dr Butt's Article 10 rights. He held that Dr Butt was not a victim for the purposes of section 7 HRA. His reasoning was that Dr Butt had no right to go on to any university premises for his own purposes and he had no right to be invited. Further, he had given no evidence of any invitation having been withdrawn because of the Guidance; there was no evidence from anyone else that their freedom of speech, including the freedom to impart or to receive information, had been interfered with by the HEPDG; and there was no convincing evidence of some general chilling effect. The Judge went on to consider whether, even if there was an infringement of Article 10, the infringement was justified under Article 10(2). He held that the requirements of Article 10(2) were satisfied: any interference was justified and proportionate.
49. The Judge rejected the argument that the collection, storage and use of information about Dr Butt by the EAU was a breach of Dr Butt's Article 8 rights. The Judge reasoned that Dr Butt could have no reasonable expectation of privacy in relation to statements that he intended to be public and were made by him as a person engaged in debate, discussion, and trying to involve others in debate. Further, there was no systematic collection and retention of the information relating to Dr Butt. The Judge went on to consider whether, if, contrary to his view, there was an infringement of Dr Butt's Article 8 rights, it was nevertheless justified under Article 8(2). He held that it was: it was in accordance with the law and proportionate. He held that it was in accordance with the law because the DPA provided an adequate legal framework.
50. Finally, the Judge rejected the argument that the collection and storage of information about Dr Butt was unauthorised directed surveillance under RIPA. The Judge observed that the absence of authorisation under RIPA did not necessarily make any surveillance unlawful: RIPA merely provided a permissive mechanism and a justification for the purposes of Article 8(2) were it to apply. He held that, in any event, there was no surveillance and certainly no directed surveillance in the present case in the light of the frequency of examination, the circumstances, the public nature of the data, its mode of collection, the lack of an exercise of drawing conclusions about personal matters from the systematic assembly of data from multiple sources, and the absence of focused monitoring of Dr Butt or the group to which he belonged.

The appeal

51. There are five grounds of appeal: (1) the Judge erred in holding that the Guidance was not unlawful as being ultra vires the power in section 29 CTSA; (2) the Judge erred in holding that the Guidance was not unlawful as being contrary to section 31(3) CTSA; (3) the Judge erred in holding that the Guidance was not unlawful as being contrary to the common law right of free speech and/or Article 10; (4) the Judge erred in holding that there was no breach of Article 8 in the collection, storage and use of information concerning Dr Butt by the EAU; and (5) the Judge erred in holding that the collection of the material concerning Dr Butt was not "directed surveillance" for the purposes of RIPA.

Discussion

52. Mr Paul Bowen QC, for Dr Butt, addressed Appeal Grounds 4 and 5 before Appeal Grounds 1, 2 and 3. We shall consider them in the same order.

Appeal Ground 4

53. Dr Butt claims that the collection, storage and use of information concerning himself by the EAU infringed his right to privacy under Article 8. In his oral submissions in support of that claim Mr Bowen referred to a large number of decisions of the ECrtHR, none of which had facts similar to those in the present case. Many of the judgments were very long and detailed but often only a single passage or paragraph was cited to us as containing a relevant principle. The need to understand the significance of the passage or passages in the context of the very different facts of so many cases left us with a rather confused understanding of Dr Butt's arguments. This was further compounded by some arguments deployed under Appeal Ground 5 in relation to the absence of RIPA authorisation apparently also being relevant to Article 8 under Appeal Ground 4. Nor was our understanding materially assisted by references to Dr Butt's 88 page skeleton argument for the hearing before the Judge, which we were left to follow up on our own.

Engagement of Article 8(1)

54. The first question is whether Article 8(1) is engaged. At the heart of that question is a dispute between the parties as to the significance of the fact that the information obtained, kept and shared by the EAU in respect of Dr Butt was obtained from publicly accessible sources and related to his public appearances and the views which he had expressed publicly and which he wishes to continue to express publicly. Mr Oliver Sanders QC, for the Secretary of State, submits that those facts preclude any right to privacy under Article 8. Dr Butt maintains that the collection by the State of such information from the internet and social media sources and its retention in the computer records of the EAU for future reference and sharing with others, including Prevent co-ordinators across the country, who would be in contact with RHEBs, engages Article 8(1). This, therefore, raises as a central issue whether, and if so when, the collection and recording of something done by an individual in public can infringe the right to privacy under Article 8.

The Supreme Court authorities: Catt and JR38

55. There are two UK Supreme Court decisions which address that issue in the context of police photographs of an individual's activity in a public place: R (Catt) v Association of Chief Police Officers of England, Wales and Northern Ireland [2015] UKSC 9, [2015] AC 1065, and Re JR38 [2015] UKSC 42, [2016] AC 1131. Although the Supreme Court judgments in those two cases set out the relevant principles, Catt was only addressed by Mr Bowen at the very end of his opening oral submissions on Appeal Ground 4 and JR38 was not addressed by him at all in his opening submissions. As domestic authorities of the highest level, which are binding on us, we consider that our analysis should start with them.
56. Catt concerned a database maintained by the National Public Order Intelligence Unit, which was supervised initially by the Association of Chief Police Officers and subsequently the Commissioner of Police of the Metropolis. The database contained information about the claimant, who attended many public demonstrations organised by a group which campaigned against the operations of a commercial weapons manufacturer, in the form of a single photograph, which was subsequently destroyed, and written references to him in a number of "information reports" on other named persons. In the majority of those reports all that was recorded about the claimant was the fact of his presence at a protest and his date of birth and address, but some also described his appearance. The database had no statutory foundation but was based on common law powers to obtain and store information likely to be of assistance to the police in carrying out their functions. The Supreme Court held that Article 8(1) was engaged but the interference with the claimant's private life was justified under Article 8(2).
57. Lord Sumption, with whom the majority agreed, said (at [4]) that, in common with other jurisdictions, including the ECrtHR and the courts of the United States, Canada and New Zealand, the courts of the UK have adopted as the test for what constitutes "private life" in Article 8 whether there was a reasonable expectation of privacy in the relevant respect. He said that, given the expanded concept of private life in the jurisprudence of the Convention, the test cannot be limited to cases where a person can be said to have a reasonable expectation about the privacy of his home or personal communications. It must extend to every occasion on which a person has a reasonable expectation that there will be no interference with the broader rights of personal autonomy recognised in the case law of the ECrtHR. He said that is consistent with the recognition that there may be some matters about which there is a reasonable expectation of privacy, notwithstanding that they occur in public and are patent to all the world. Lord Sumption continued as follows:

"5 In Rotaru v Romania (2000) 8 BHRC 449, para 43, the Grand Chamber held that "public information can fall within the scope of private life where it is systematically collected and stored in files held by the authorities." Cf Segerstedt-Wiberg v Sweden 44 EHRR 2, para 72. In Kingdom (2008) 46 EHRR 51, the court found a violation of article 8 by covertly recording the applicants' voices at a police station in the presence of police officers, for the purposes of future voice recognition. At para 57, the court said:

"There are a number of elements relevant to a consideration of whether a person's private life is concerned by measures effected outside a person's home or private premises. Since there are occasions when people knowingly or intentionally involve themselves in activities which are or may be recorded or reported in a public manner, a person's reasonable expectations as to privacy may be a significant, although not necessarily conclusive, factor. A person who walks down the street will, inevitably, be visible to any member of the public who is also present. Monitoring by technological means of the same public scene (for example, a security guard viewing through closed-circuit television) is of a similar character. Private-life considerations may arise, however, once any systematic or permanent record comes into existence of such material from the public domain. It is for this reason that files gathered by security services on a particular individual fall within the scope of article 8, even where the information has not been gathered by any intrusive or covert method."

In BB v France (Application No 5335/06) (unreported) given 17 December 2009, a case concerning the inclusion of persons in a register of convicted sex offenders, it was held at para 57 that the "mere storing by a public authority of data relating to the private life of an individual" engaged article 8 of the Convention so as to require to be justified. In S v United Kingdom 48 EHRR 50 the Strasbourg court held that article 8 was engaged by the mere storage of cellular samples, DNA profiles and fingerprints: see paras 77, 86. This was because of the sensitivity and amount of the personal information in question, and the uses to which it might "conceivably" be put: paras 70-86. The same principle has been recognised and applied in English case law. As Lord Hope of Craighead DPSC observed in R (L) v Comr of Police of the Metropolis (Secretary of State for the Home Department intervening) [2010] 1 AC 410, para 27, even public information such as a criminal conviction may become part of a person's private life once it recedes into the past and other people are likely to have forgotten about it."

58. Lord Sumption then said:

"6 These cases, and others like them, all have particular features which differentiate them both from each other and from the present cases. But it is clear that the state's systematic collection and storage in retrievable form even of public information about an individual is an interference with private life."

59. Dr Butt's contention is that the factual situation here precisely fits that statement of principle: publicly available information about him has been collected by the EAU and stored in retrievable form.
60. The Supreme Court held (by a majority) that the retention of the information about Mr Catt on the database was nevertheless justified under Article 8(2). Mr Catt subsequently applied to the ECrtHR, which has now held that the retention of the information was not justified under Article 8(2): Catt v United Kingdom (Application no. 4351/15), judgment published 24.1.2019. Dr Butt relies upon statements of the ECrtHR in the majority judgment. We address those below.
61. JR38 concerned judicial review proceedings alleging infringement of Article 8 where the applicant, then aged 14, had been involved with other young persons in serious rioting, and the police had supplied to local newspapers images of the applicant and others taken during the course of the rioting and requested the newspapers to publish the photographs in order to assist the police in identifying the participants. The Supreme Court held, by a majority, that Article 8(1) was not engaged.
62. Lord Toulson, with whom the majority agreed on Article 8(1), referred (at [84]) to Von Hannover v Germany 40 EHRR 1, and said as follows:

"84 In the leading case Von Hannover v Germany 40 EHRR 1, concerning press photographs of the applicant engaged in various informal activities with members of her family or friends in locations outside her own home, the Strasbourg court said, at paras 50–52:

"50. The court reiterates that the concept of private life extends to aspects relating to personal identity, such as a person's name (see Burghartz v Switzerland (1994) 18 EHRR 101, para 24) or a person's picture (see Schüssel v Austria (Application No 42409/98) (unreported) given 21 February 2002, [2002] ECHR 845).

Furthermore, private life, in the court's view, includes a person's physical and psychological integrity; the guarantee afforded by article 8 of the Convention is primarily intended to ensure the development, without outside interference, of the personality of each individual in his relations with other human beings: see, mutatis mutandis, Niemietz v Germany (1992) 16 EHRR 97, para 29, and Botta v Italy (1998) 26 EHRR 241, para 32. There is therefore a zone of interaction with others, even in a public context, which may fall within the scope of 'private life': see, mutatis mutandis, PG v United Kingdom (2008) 46 EHRR 51, para 56, and Peck v United Kingdom (2003) 36 EHRR 41, para 57.

51. The court has also indicated that, in certain circumstances, a person has a 'legitimate expectation' of protection and respect for his private life. Accordingly, it has held in a case concerning the interception of telephone calls on business premises that the applicant 'would have had a reasonable expectation of privacy for such calls': see Halford v United Kingdom (1997) 24 EHRR 523, para 45.

52. As regards photos, with a view to defining the scope of protection afforded by article 8 against arbitrary interference by public authorities, the Commission had regard to whether the photographs related to private or public matters and whether the material thus obtained was envisaged for a limited use or was likely to be made available to the general public: see, mutatis mutandis, Friedl v Austria (1995) 21 EHRR 83, Friendly Settlement, Commission opinion, at paras 49–52; PG v United Kingdom (2008) 46 EHRR 51, para 58; and Peck v United Kingdom 36 EHRR 41, para 61."

63. Lord Toulson said that that passage highlights three matters: the width of the concept of private life; the purpose of Article 8, that is to say what it seeks to protect; and the need to examine the particular circumstances of the case in order to decide whether, consonant with that purpose, the applicant had a legitimate expectation of protection in relation to the subject matter of the applicant's complaint.
64. Lord Toulson said (at [87]) that the touchstone was whether the claimant enjoyed on the facts a reasonable expectation of privacy or a legitimate expectation of protection, adding that he took the expressions to be synonymous. He referred (at [88]) to the statement of Sir Anthony Clarke MR in Murray v Express Newspapers plc [2009] Ch 481 (at [36]) that the question of whether there is a reasonable expectation of privacy is a broad one which takes account of all the circumstances of the case, including the attributes of the claimant, the nature of the activity in which the claimant was involved, the place at which it was happening, and the nature and purpose of the intrusion. Lord Toulson explained that the principled reason for the "touchstone" is that it focuses on the sensibilities of a reasonable person in the position of the person who is the subject of the conduct complained about in considering whether the conduct falls within the sphere of Article 8.
65. Lord Toulson referred to Lord Sumption's statement in Catt (at [4]) that the UK courts have adopted, as the test for what constitutes "private life", whether there was a reasonable expectation in the relevant respect. He said (at [98]) that the reasonable or legitimate expectation test is an objective test, to be applied broadly, taking account of all the circumstances of the case and having regard to underlying value or values to be protected. It does not include interaction in the form of a public riot: the criminal nature of what the claimant was doing was not an aspect of his private life that he was entitled to keep private.
66. Lord Clarke, who was among the majority in JR38, also adopted (at [105]) as the touchstone for engagement of Article 8(1) "a legitimate expectation of privacy or a reasonable expectation of protection for [the alleged victim's] private life", and said that he agreed with Lord Toulson that the two expressions have the same meaning. He too cited (at [107]) Lord Sumption's description of the test in Catt (at [4]), and said (at [109]) that the concept of reasonable expectation is a broad objective concept and the court is not concerned with the subjective expectation of the person concerned.
67. The facts of the present case are very different from those in both Catt and JR38. In fact, we were not referred to any domestic authority or any case of the ECrtHR or of any other court which bears any comparison with the claim for infringement of a right of privacy made in the present case; that is to say, a claim for privacy in respect of information publicly available by search of the internet and social media, being views the claimant has expressed publicly and which he wishes to continue to promote to students and others in order to encourage them to follow his way of thinking and details as to where and how he has promoted those views. Indeed, it is a notable feature of the present case that, on the one hand, Dr Butt claims that the collection and recording of his views by the EAU and the sharing of that record by the EAU with others, is a breach of his right to privacy under Article 8, but, on the other hand, he claims that the Prevent Guidance is a breach of his rights under Article 10 to impart those views to others. Unless precluded by authority, the natural conclusion is that Dr Butt could not have had any legitimate or objectively reasonable expectation of privacy in relation to the information about him recorded and retained by the EAU.
68. Mr Bowen submitted that such a conclusion is indeed precluded by authority. He relied, as we have said, on the bald statement of Lord Sumption in Catt (at [6]) that "the state's systematic collection and storage in retrievable form even of public information about an individual is an interference with private life". He also relied on the following statement in the majority ECrtHR judgment in Catt:

"The Court recalls that it is well established in its case-law that the mere storing of information amounts to an interference with the applicants' right to respect for private life as secured by Article 8(1) of the Convention (see S. and Marper, cited above, § 67 and Segerstedt-Wiberg and Others v. Sweden, no. 62332/00, § 73, ECHR 2006-VII with further references)."

We do not consider that either statement precludes the conclusion that Article 8(1) is not engaged on the facts of this case.

69. It is convenient to consider, first, the statement in paragraph 93 of the majority judgment of the ECrtHR in Catt. Firstly, as is made clear in paragraph 92 of that judgment, the UK Government conceded that the collection and retention of Dr Butt's personal data interfered with his Article 8 rights. The Government's argument was that the infringement of Dr Butt's Article 8 rights was, however, limited. The Court said (in paragraph 93) that the allegedly limited nature of the interference was more appropriately addressed in the context of whether the interference was necessary in a democratic society under Article 8(2). Accordingly, the engagement of Article 8(1) was not in issue.
70. Secondly, it will be noted that the principle said to be drawn from the case law of the ECrtHR in paragraph 93 of the majority judgment in Catt – "the mere storing of information amounts to an interference with the applicants' right to respect for private life" - is even more prescriptive and narrow than that stated by Lord Sumption in the Supreme Court (at [6]) – "the state's systematic collection and storage in retrievable form even of public information about an individual is an interference with private life". The ECrtHR's statement contains no condition of "systematic" collection and storage in respect of information publicly available. Yet, the ECrtHR did not expressly disagree with Lord Sumption's formulation.
71. Thirdly, the two cases cited by the ECrtHR in paragraph 93 - Segerstedt-Wiberg v Sweden (2007) 44 EHRR 2 and Marper v United Kingdom (Applications 30562/04 and 30566/04) (4.12.2008) 48 EHRR 50 - do not support the narrow and prescriptive statement of the majority judgment in that paragraph. Segerstedt-Wiberg, paragraph 72, was cited by Lord Sumption in paragraph [5] of his judgment and is authority for the need for information publicly available to be systematically collected and stored for Article 8(1) to be engaged:

"72. The Court, having regard to the scope of the notion of "private life" as interpreted in its case-law (see, in particular, Amann v. Switzerland [GC], no. 27798/95, § 65, ECHR 2000-II, and Rotaru v. Romania [GC], no. 28341/95, § 43, ECHR 2000-V), finds that the information about the applicants that was stored on the Security Police register and was released to them clearly constituted data pertaining to their "private life". Indeed, this embraces even those parts of the information that were public, since the information had been systematically collected and stored in files held by the authorities. Accordingly, Article 8 § 1 of the Convention is applicable to the impugned storage of the information in question."

72. Marper is authority that not all personal information involves the concept of private life within Article 8(1). It all depends on the context. In paragraph 66 of Marper the ECrtHR set out various examples of "private life" within Article 8(1). It then said the following:

"67. The mere storing of data relating to the private life of an individual amounts to an interference within the meaning of Article 8 (see Leander v. Sweden, 26 March 1987, § 48, Series A no. 116). The subsequent use of the stored information has no bearing on that finding (see Amann v. Switzerland [GC], no. 27798/95, § 69, ECHR 2000-II). However, in determining whether the personal information retained by the authorities involves any of the private-life aspects mentioned above, the Court will have due regard to the specific context in which the information at issue has been recorded and retained, the nature of the records, the way in which these records are used and processed and the results that may be obtained (see, mutatis mutandis, Friedl, cited above, §§ 49-51, and Peck, cited above, § 59)."

73. That is consistent with the overarching test of a legitimate expectation of privacy in relation to the subject matter of the applicant's complaint, which was articulated in Von Hannover v Germany 40 EHRR 1, paragraph 51, and was endorsed by Lord Sumption in Catt at [4] and by Lord Toulson and Lord Clarke in JR38, and which has never been said to be wrong in any decision of the ECrtHR.
74. That overarching principle and the need to consider the particular context in deciding whether the personal information falls within "private life" within Article 8(1) apply equally to information which is and which is not publicly available. That is apparent from the cases cited by Lord Sumption in Catt at [5]. In Rotaru, paragraph 43, the Grand Chamber held that "public information can fall within the scope of private life where it is systematically collected and stored in files held by the authorities". In PG, paragraph 57, the ECrtHR said that "private life considerations may arise … once any systematic or permanent record comes into existence of material from the public domain". In R (L) v Commissioner of Police of the Metropolis, which concerned the storage of information about the applicant's conviction in central records, Lord Hope at [27] envisaged that information about the conviction might over the passage of time eventually fall within Article 8(1), that is to say would attract a reasonable expectation of privacy. He said that "as it recedes into the past, it [scil. the conviction] becomes a part of the person's private life which must be respected", a point that was accepted by the ECrtHR in MM v UK (2012) (24029/07), paragraph 188.
75. It follows that the narrow and prescriptive statement of the ECrtHR in Catt, paragraph 93, which, as we have said, was not part of the case that was in dispute, requires qualification in two respects, in accordance with the established jurisprudence of the ECrtHR. The information in question must be of a kind which, in the context, falls within "private life" protected by Article 8(1): there must in all the circumstances be a legitimate expectation of privacy in respect of it. Further, if the information is publicly available, Article 8(1) will only be engaged if the public authority has systematically collected and stored it.
76. It also follows that Lord Sumption's statement in Catt at [6] must similarly be qualified by the overarching principle, that, even in the case of the state's systematic collection and storage of publicly available information, Article 8(1) will only be engaged if, in all the circumstances, there was a legitimate expectation of privacy in respect of it. We do not accept that Lord Sumption's statement was intended to apply to the facts of the present case.
77. For the reasons we have given, Dr Butt could not have had any legitimate or objectively reasonable expectation of privacy in relation to the information recorded and retained by the EAU.
78. Furthermore, the Judge held (at [232]-[236]) that what happened here did not amount to a systematic collection of information by the EAU about Dr Butt. The Judge made no error of principle in reaching that conclusion, and, furthermore, we agree with it.
79. There were three occasions on which the EAU obtained information about Dr Butt. The first was in February 2015 when the EAU was asked to provide a rough assessment of how many events had taken place on university campuses in 2014 involving individuals who had expressed extremist views. The EAU considered weekly digests which had been received from Student Rights. Those digests disclosed two events at which Dr Butt had spoken.
80. The second occasion was a consequence of the EAU being asked in May 2015 to look at extremism in universities in more detail. That led to a report of the EAU in November 2015 – "Extremism in Universities: A Case Study of East and South East London". In preparing that report, the EAU had been given a paper from Student Rights based on their research. Although the report itself did not refer to Dr Butt, the references in Student Rights' earlier digests involving him were mentioned.
81. The third occasion followed the publication of the press release on 17 September 2015, which led to Dr Butt's MP, Fiona McTaggart, writing a letter to the Home Office Minister, Lord Tariq Ahmad, asking why Dr Butt was on the list, and also putting down a Parliamentary Question ("PQ") on 9 October 2015 asking what evidence was used to identify the six hate preachers named in the press release and whether the evidence would be published which demonstrated that Dr Butt had expressed views at a university contrary to British values. In order to brief Ministers, the EAU carried out a search of Home Office Databases, including a search of the EAU's own databases. Nothing new was thrown up by that search. In addition, a search was made of Facebook, Twitter, Google and Islam21C. Those searches resulted in the following answer to the PQ by Karen Bradley MP on 1 December 2015. In relation to Dr Butt, she said that he:

"is the chief editor of Islam21c, a publication that hosts material contrary to British values, and has himself expressed views of concern in this publication and on social media, appearing to compare homosexuality to paedophilia as a sin and supporting FGM. He has spoken alongside CAGE and used social media to support CAGE's position on Mohammed Emwazi ("Jihadi John"), which has been to try to justify his resort to violence."

82. It is to be noted that the information received from Student Rights which first alerted the EAU to Dr Butt's activities formed part of a digest of events sent to the Home Office on a regular basis. There is no evidence whatever that Student Rights kept any kind of specific or systematic record on him as an individual. Accordingly, even though it was common ground that the Home Office is fixed, for this purpose, with the monitoring activity of Student Rights, there was no systematic record of information on Dr Butt as a result of anything done or communicated by Student Rights.
83. Similarly, the information held by the EAU was not sufficient to constitute a systematic record on Dr Butt as an individual. Indeed, the evidence is to the contrary. The EAU is not a legal person. It comprises a team of officials within the Home Office. In his first witness statement Paul Willis, who was employed as head of the EAU from July 2016, said that the EAU was set up to help improve government's understanding of extremism and related trends and to provide expertise and advice to assist the implementation of the Counter-Extremism Strategy and wider counter-extremism work. He said that it does not have any executive or police powers or any operational role. It does not take operational decisions or determine policy or strategy. It provides independent analysis to policy and operational colleagues, who are responsible for such decisions. Mr Sanders described its work as the research and analysis of extremism and the flagging of events to co-ordinators. In a letter dated 15 January 2016 to Dr Butt's solicitors the Home Office said that the EAU does not designate individuals as "extremists" for others to investigate and has never produced or held a list of extremists. The letter said that, in order to fulfil its functions, however, the EAU inevitably obtains, records, holds and discloses information about identifiable private individuals, including individuals who promote extremist views. That is entirely consistent with the evidence. In short, whatever might be the situation in a different case, in Dr Butt's case, the scant material collected was not sufficient to constitute a systematic record in the sense required to engage Article 8.
84. There is an overlap on this aspect of the appeal with Dr Butt's case on Appeal Ground 5. Dr Butt maintains that RIPA applied to the EAU's activities in relation to him because it was conducting covert directed surveillance on him within section 26 of RIPA. Section 26(9)(a) provides that "surveillance is covert if, and only if, it is carried out in a manner that is calculated to ensure that persons who are subject to the surveillance are unaware that it is or may be taking place". Section 48(2) provides a non-exclusive definition of "surveillance" as including monitoring, observing or listening to persons, their movements, their conversations or their other activities or communications; and recording anything monitored, observed or listened to in the course of surveillance.
85. The Judge considered whether the activity of the EAU in relation to Dr Butt amounted to surveillance. Having taken into account various publications and statements of the Office of the Surveillance Commissioners to which his attention had been drawn by Mr Bowen, the Judge concluded (at [271]) that what the EAU had done did not amount to surveillance. He said:

"I do not consider that what they did in this case reached the level of "surveillance" at all, and certainly not directed surveillance. I have considered the frequency of examination, the circumstances, the public nature of the data, its mode of collection, the lack of what I regard as the sort of exercise, to which the comments and concerns are addressed, of drawing conclusions about personal matters from the systematic assembly of data from multiple sources; the absence of focused monitoring of the Claimant or of a group to which he belonged."

86. The Judge made no error of principle in reaching that conclusion. In any event, we agree with it for much the same reasons as we have expressed in rejecting the suggestion that there was any systematic collection and recording of information about Dr Butt.
87. Furthermore, we do not accept that the activity of Student Rights or the EAU in relation to Dr Butt was "covert". It would be absurd to suggest that every search by anyone of the internet and social media is covert merely because the subject of the search is unaware that it is taking place. The word "covert" in the context of surveillance and RIPA denotes a state of mind that is reflected in the words "is calculated to ensure" in section 26(9)(a) of RIPA. There must be an intention to conduct the surveillance secretly, in the sense of an intention that it should not become known to the subject.
88. Mr Bowen submitted that the EAU does conduct its affairs in secret, and relied, in that regard, on the Home Office's answer to a request by Mr T McIntyre in an email of 23 March 2015 for information about the EAU's role and as to whether there was a document setting out its remit, and also asking two other questions about certain of the EAU's procedures and policies. The Home Office replied by letter dated 22 April 2015, in which it said it was treating the first request as one under the Freedom of Information Act 2000. The Home Office declined to provide the information and relied on the exemption in section 35(1) (formulation of government policy) and section 23(5) (information supplied by or relating to bodies dealing with security matters) of the 2000 Act. It gave substantive replies to the two other questions.
89. We do not consider that the response of the Home Office to that Freedom of Information Act request is any indication that Student Rights or the EAU intended the collection or retention of information about Dr Butt to be kept secret from him. The Home Office has been quite open and public about the establishment and existence of the EAU and what is its purpose. The Revised Prevent Duty Guidelines of 16 July 2015 stated in paragraph 21 that "The Prevent programme must not involve any covert activity against people or communities".
90. Furthermore, we do not consider that Dr Butt could have had any legitimate or reasonable expectation of privacy in relation to the further information obtained as a result of searches of the internet and social media after the letter was written and the PQ was placed by Dr Butt's MP following the press release. The letter and the PQ were in effect an invitation to the Home Office to find evidence to support the naming of Dr Butt in the press release.
91. For all those reasons, we do not consider that either the decision of the Supreme Court or that of the ECrtHR in Catt requires us to conclude that the activity of the EAU in relation to Dr Butt engaged Article 8(1). Subject to the other cases cited by Mr Bowen on Article 8(1), to which we now turn, the Judge was right to conclude that the touchstone of reasonable or legitimate expectation of privacy was not satisfied.

Other authorities

92. In Uzun v Germany (2011) 53 EHRR 24 the ECrtHR held that Article 8(1) was engaged by the surveillance of the German Federal Office for Criminal Investigation of the applicant, who had been convicted by a German court of attempted murder and of four counts of causing an explosion, and his accomplice. In particular, Article 8(1) was engaged when, in addition to a number of other surveillance measures including visual surveillance, video cameras, the interception of telephone calls, the checking of the applicant's post and interception of radio communications, a global positioning system (GPS) was placed in the car of the applicant's accomplice.
93. The court said (at paragraph 48) that the publication of material obtained in public places in a manner or degree beyond that normally foreseeable may bring recorded data or material within the scope of Article 8(1). Having concluded that the measure constituted a compilation of data on the applicant, and that the surveillance of the applicant via GPS had enabled the investigation authorities for some three months systematically to collect and store data determining the applicant's whereabouts and movements in the public sphere, the ECrtHR concluded that there had been an interference with the applicant's private life protected by Article 8(1). The court then went on to consider justification under Article 8(2).
94. We do not consider this case assists the resolution of this appeal. The surveillance in that case was much more extensive than in Dr Butt's case and, unlike the present case, did not involve the collection of material deliberately made publicly available from publicly accessible sources.
95. In Magyar Helsinki Biottsag v Hungary (App No 18030/11) (8 November 2016) the applicant sought the disclosure of information about public defence counsel, including their names and the number of times they had been appointed to act as counsel in certain jurisdictions. The refusal of the Hungarian government to disclose that information was said to be in breach of Article 10. The court said (at paragraph 198) that, although the information request concerned personal data, it did not involve information outside the public domain. It consisted only of information of a statistical nature about the number of times the individuals in question had been appointed to represent defendants in public criminal proceedings within the framework of the publicly funded national legal-aid scheme. It was not, therefore, private information engaging the protection of Article 8(1).
96. This case would appear to assist the Secretary of State rather than Dr Butt. In that case, as in Dr Butt's case, the relevant material had not previously been collated. The material consisted of information obtainable from public sources.
97. In R (W) v Secretary of State for Health [2015] EWCA Civ 1034 the claimants, who were not UK residents, and so were liable for charges for services provided under the National Health Service, claimed that their right to privacy under Article 8(1) was infringed when, following non-payment for three months, there was passed by the NHS body to the Health Secretary and then to the Home Office information including the name, date of birth, gender, current address and nationality of the patient, the amount of the debt owed and the NHS body to which it was owed. The Court of Appeal rejected the claim. It acknowledged that the information was inherently private information, particularly because it revealed information of substance about the health of the data subjects, namely that they were unwell to the extent that they had to seek medical care at a particular point in time from one or more NHS bodies. The Court of Appeal, upholding the decision of the judge, held, however, that there was no reasonable expectation of privacy in the information since a patient, liable to charges, will reasonably expect that, in the event of default, steps will be taken to enforce payment, which may include informing others of the fact, duration and cost of his stay at the hospital concerned; and that, to that extent, their stay at the hospital will not necessarily be kept confidential.
98. This case is of no assistance as the facts are so different from those concerning Dr Butt. The information as to the claimants' medical condition was plainly of a private and confidential nature, in contrast to the public statements of Butt.
99. In Barbulescu v Romania (Application 61496/08) (5 September 2017) the applicant was dismissed by his employer for breaching the employer's instruction to refrain from personal activities in the workplace and not to use company resources for personal use. The applicant had used the internet for personal purposes, including exchanging messages with his brother and his fiancée. The ECrtHR held that there had been an infringement of Article 8. The applicant had not been given information in advance of the extent and nature of his employer's monitoring activities or the possibility that the employer might have access to the contents of his communications. The court said that employers' instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary.
100. We consider that the facts of that case are so far removed from those of the present that it is difficult to see how any useful comparisons may be made. The court appears to have reached its conclusion on a specific consideration about private social life in the workplace, and the fact that an employer could not reduce private social life in the workplace to nothing.
101. Mr Bowen referred us to Richard v British Broadcasting Corporation [2018] EWHC 1837. Those were proceedings against the BBC and South Yorkshire police for misuse of private information and breach of rights under the DPA following prominent and widespread broadcast coverage of the search of the claimant's home on 14 August 2014 as part of an investigation into an allegation of an historic sex offence. The claimant reached a settlement with South Yorkshire Police but the BBC continued to contest the claim. Mann J held that the claimant's Article 8 rights were infringed, and that his Article 8 rights were not outweighed by the BBC's Article 10 rights to freedom of expression. He said (at [237]) that whether or not there is a reasonable expectation of privacy in a police investigation is a fact-sensitive question and is not capable of a universal answer one way or the other. He said (at [248]):

"As a general rule it is understandable and justifiable (and reasonable) that a suspect would not wish others to know of the investigation because of the stigma attached … The fact of an investigation, as a general rule, will of itself carry some stigma, no matter how often one says it should not."

102. Mann J acknowledged (at [251]) that there is not an invariable right to privacy as there may be all sorts of reasons why, in a given case, there is no reasonable expectation of privacy, or why an original reasonable expectation is displaced. The judge addressed (at [256]) the fact that the claimant was a public figure, and one who had promoted his Christian beliefs in his writing and his public appearances. He said that, on the facts of the case, they did not detract from the claimant's reasonable expectations, and that a public figure is not, by virtue of that quality, necessarily deprived of his or her legitimate expectations of privacy. He continued:

"it may be that a given public figure waives at least a degree of privacy by courting publicity, or adopting a public stance which would be at odds with the privacy rights claimed".

103. We consider, again, that the facts of that case are so far removed from Dr Butt's case that it is difficult to see that it offers any guidance. Mr Bowen relied on the case for the "stigma" element mentioned by Mann J, Mr Bowen's proposition being that there is a stigma attached to the designation of a person as someone who holds extremist views and who falls or may fall within the ambit of the Prevent policy. On the other hand, it is noteworthy that Mann J postulated the possibility that a person could lose the right to privacy by courting publicity. That notion is closely analogous to the situation here where, far from seeking privacy as regards his philosophy and views, Dr Butt seeks to promote them publicly in order to educate and influence others to think along the same lines.
104. Hewitt and Harman v United Kingdom (1992) 14 EHRR 657 was a case decided by the European Commission of Human Rights. The Commission held that there had been a violation of the applicants' right to respect for private life contrary to Article 8 in circumstances in which there was a reasonable likelihood that the applicants, who had been the General Secretary of the National Council for Civil Liberties and its Legal Officer respectively, were the subject of secret surveillance by the security services. The security services maintained records, classifying the applicants as "communist sympathisers" and "subversives", on the basis of information gathered from a number of sources, including information about them which appeared in the telephone or mail intercepts of others.
105. This case is of no relevance. Unlike the position in that case, there was no secret surveillance of Dr Butt by the security services or anyone else and neither the Prevent strategy nor the EAU was a secret, nor were there records of anything other than Dr Butt's public statements and appearances.
106. In Szabo v Hungary (2016) 63 EHRR3 the ECrtHR held that there had been a violation of Article 8 as a result of the Hungarian Anti-Terrorism Task Force ("TEK") being empowered by statute to engage in secret intelligence gathering, including covert house searches, surveillance by way of recording, opening mail and checking and recording the contents of individuals' electronic communications. The surveillance was not linked to any particular crime, was authorised by the government minister in charge of justice, did not need to be supported by any reasoning in the minister's decision on ordering surveillance, and there was no requirement for the destruction of collected but irrelevant information. The court said (at paragraph 53) that the potential interferences with email, mobile phone and internet services as well as those of mass surveillance attracted the Convention protection of private life particularly acutely.
107. We can see no relevance of that case to the issue of the engagement of Article 8(1) in Dr Butt's case where the information obtained on Dr Butt was material which he placed in the public domain for public dissemination as to his personal philosophies and views on matters of public interest and debate.
108. In Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources [2014] 3 CMLR 44 the European Court of Justice ("the ECJ", which expression includes the Court of Justice of the European Union) held that Directive 2006/24 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks was invalid as contravening Articles 7 (respect for private life), 8 (the protection of personal data), and 11 (respect for freedom of expression) of the Charter of Fundamental Rights of the European Union. The main objective of the Directive was to harmonise Member States' provisions concerning the retention, by providers of publicly available electronic communications services or of public communications networks, of certain data generated or processed by them, for the prevention, investigation, detection and prosecution of serious crime, such as organised crime and terrorism. The data which such providers were required to retain under the Directive were wide-ranging and, taken as a whole, allowed very precise conclusions to be drawn concerning the private lives of the persons whose data was retained, such as the habits of everyday life, permanent or temporary place of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them. It was held that both the retention of such data and the right of access to the data by the competent national authorities constituted an interference with the rights guaranteed by Article 7 and Article 8 of the Charter, and such interference was not justified.
109. Again, the facts of that case are so far removed from the situation in Dr Butt's case that it provides no assistance whatsoever on the engagement of Article 8(1). There is no analogy whatsoever between, on the one hand, the collection of data sufficient to create a comprehensive profile of the users of public communication networks, and, on the other hand, the limited collection by the EAU of public opinions expressed by Dr Butt.
110. For all those reasons we conclude that the Judge was correct to conclude that Article 8(1) was not engaged in this case.

Justification under Article 8(2)

111. Although it is not necessary, in the circumstances, to consider justification under Article 8(2), we shall do so as we received extensive submissions on it.
112. In order for an interference with privacy rights under Article 8 to be justified under Article 8(2) the interference must be in accordance with the law; it must pursue a legitimate aim; and it must be necessary in a democratic society. That last requirement involves a requirement of proportionality.
113. There is no dispute that the policies of the EAU pursue a legitimate aim.
114. Mr Bowen submitted that the requirement that the interference be in accordance with the law was not satisfied in the present case. The law relied upon for the collection and recording of the data about Dr Butt is the prerogative power of the Executive, that is to say the common law. Mr Bowen submitted that the common law in this respect does not satisfy the requirements of the ECrtHR and of the ECJ for certainty and foreseeability as to its effects: Zakharov v Russia (2016) 63 EHRR 17 (at paragraphs 228-229). He emphasised that the common law does not specify with any particularity or any clear limitation what data may be collected. He relied in this respect on, among other things, Szabo where the ECrtHR said (at para. 67) that justification was not established because, among other reasons, the generality of the legislation paved the way for the unlimited surveillance of a large number of citizens: the category was overly broad because there was no requirement of any kind for the authorities to demonstrate the actual presumed relation between the persons or range of persons concerned and the prevention of any terrorist threat.
115. Mr Bowen also relied on the decision of the ECrtHR in Catt which, as we have said, held that Article 8(2) was not satisfied, contrary to the decision of the majority in the Supreme Court.
116. As in the present case, the collection of Mr Catt's personal information by the police was undertaken on the basis of common law powers and a non-statutory definition of "extremism". In Catt the definition was directed at the activity of individuals or groups who carried out criminal acts of direct action to further their protest campaigns, outside the democratic process.
117. The ECrtHR said at paragraph 97, in relation to the collection of data, that there was significant ambiguity over the criteria being used by the police to govern the collection of the data in question, and it therefore agreed with Mr Catt that it was difficult to determine the exact scope and content of the data being collected and compiled to form the database. The Court accepted, however, the contention of the UK Government that the creation of the database did not need to be statutory. Although the Court was concerned that the collection of data for the purposes of the database did not have a clearer and more coherent legal base, it said, at paragraph 99, that the framework governing the collection of Mr Catt's data could not be viewed in isolation from the provisions governing retention and use of his personal data. Accordingly, the Court turned to examine those aspects, which provided certain legal protections against arbitrariness.
118. In relation to the retention and use by the police of Mr Catt's data, the ECrtHR noted, in paragraph 104, that Mr Catt had the possibility under the DPA to make a request for the review and deletion of his data.
119. In the event, the question of whether the interference was "in accordance with the law" within Article 8(2) was never decided by the majority in Catt because, unlike Judge Koskelo, who gave a separate concurring judgment, and Judge Felici, who joined him, they took the view (stated in paragraph 106) that the question of whether the collection, retention and use of Mr Catt's personal data was in accordance with the law was closely related to the broader issue of whether the interference was necessary in a democratic society, and they decided that it was not. They expressly stated, in paragraph 107, that for those reasons they did not find it necessary to decide whether the interference was in accordance with the law within the meaning of Article 8(2).
120. It follows that we do not agree with Mr Bowen that the majority decision of the ECrtHR in Catt supports Dr Butt's contention that the collection of his data by the EAU failed to satisfy the requirement in Article 8(2) that it be in accordance with the law merely because (1) the legal basis for the collection was the common law and (2) the concept of "extremism" employed by the EAU was imprecise. On the contrary, as was made clear in the majority judgment, that issue could only properly be determined in the context of wider issues about the necessity for collection, retention and use of the data.
121. That approach is entirely logical. If (1) the collection of Dr Butt's personal information was for the purpose of retention and use for a legitimate aim, (2) the retention and use were necessary because they answered to a "pressing social need", were proportionate to the legitimate aim pursued, and the reasons adduced by the national authorities to justify them are relevant and sufficient, and (3) the law provides adequate safeguards in relation to the retention and use, it is not necessary for there to be a separate rigorous approach to the right of collection. As was pointed out in the majority judgment of the ECrtHR in Catt at paragraph 117, it is in the nature of intelligence gathering that the data must first be collected before its value is evaluated.
122. The retention and use of Dr Butt's data were in accordance with the law within the meaning of Article 8(2) for the following reasons. In Catt the ECrtHR appears to have been satisfied that adequate safeguards regarding retention and use were contained in the DPA, including in particular, the possibility to make a request for the review and deletion of the data. That was a reference to section 7 of the DPA, which enables any individual to be informed at any time whether personal data, of which that individual is the data subject, are being processed by or on behalf of the data controller, and, if so, to be provided with extensive information in relation to the data, and to the remedies available pursuant to sections 13 and 14 of the DPA.
123. Those and other relevant provisions of the DPA are set out in the Appendix to this judgment. In addition to the right of access to personal data pursuant to section 7, the following are significant. The basic interpretative provisions of the DPA are set out in section 1. "Data" means, among other things, information held by a public authority. Personal data is data from which a living person can be personally identified. Data subjects are the persons who are the subject of data. Data controllers are those who determine the purposes to which data is put.
124. By section 2, "sensitive personal data" includes data relating to the data subject's political opinions.
125. Section 4 imposes a duty on data controllers to comply with the Data Protection Principles (the "DPPs"). The DPPs require, among other things, that personal data shall be processed fairly and lawfully, shall be obtained only for a specified and lawful purpose, shall be adequate, relevant and not excessive, shall be accurate and, where necessary, kept up to date, shall not be kept longer than is necessary, and that at least one of the conditions in Schedule 2 is met. In the case of sensitive personal data, a condition in Schedule 3 must also be met.
126. Schedule 2 provides, among other things, that processing of data is legitimate if it is necessary for the exercise of any functions of the Crown (Sch 2 para 5).
127. Schedule 3 provides, among other things, that processing of the data is legitimate if the information contained in the personal data has been made public as a result of steps deliberately taken by the data subject (Sch 3 para 5).
128. All of those conditions are met in Dr Butt's case.
129. In reaching its conclusion that there was not a pressing need to retain Mr Catt's data, the ECrtHR (at paragraph 112) placed considerable weight on the fact that political opinion falls among the special categories of sensitive data attracting a heightened level of protection. While Dr Butt's views may technically fall within the category of sensitive data for the purposes of the DPA, they cannot in any realistic way be described as requiring a heightened level of protection as he wishes to publicise and proselytise them. It is precisely because he wishes publicly to promote his political views and to persuade others of their validity that the Government has collected information relating to them in pursuit of its unchallenged legitimate aim. The lower level of protection required in such circumstances is reflected in the legitimating condition in paragraph 5 of Schedule 3 to the DPA (information intentionally put in the public domain by the data subject).
130. No arguments were addressed to us on the materiality of any differences between the DPA and the Data Protection Act 2018.
131. In accordance with the First Data Protection Principle, the data subject is to be notified of the processing of his or her data and related information, subject to certain exceptions, including where the provision of the information would involve a disproportionate effort.
132. Mr Bowen submitted that, nevertheless, the interference with Dr Butt's rights was not in accordance with the law, and so cannot be justified under Article 8(2), as there is no legal provision requiring notification when the EAU collects and records information about persons being investigated for extremism. He submitted that, in the absence of a requirement for such notification, the rights of a data subject under the DPA are worthless because they are not practically enforceable. In support of that proposition he relied on the decision of the ECJ in R (Watson) v Secretary of State for the Home Department [2017] QB 771 at paragraph 121.
133. We do not agree. Each case turns on its own facts. In the present case, firstly, if there was an interference with Dr Butt's right to privacy, it was of the most modest and marginal nature. That is relevant to what legal framework would be adequate for the interference with the Article 8 right to be in accordance with the law for the purposes of Article 8(2), and also as to whether what was done was proportional: compare Uzun (at paragraph 66); R (W) v Secretary of State for Health (at [87]); and the statement of the ECrtHR in Catt at paragraph 93, to which we have already referred above.
134. Secondly, notification of surveillance to the subject of it is not an absolute requirement of Article 8: Big Brother Watch v United Kingdom (Applications 58170/13, 62322/14 and 24960/15) (13 September 2018) (at paragraphs 213 and 310).
135. Thirdly, the right to make a subject access request under section 7 of the DPA at any time is sufficient to avoid the need for notification: see the observations of the ECrtHR in Zakharov (at para. 288) contrasting the position of Russians with the ability of any person in the UK, who suspects his communications have been intercepted, to apply to the Investigatory Powers Tribunal ("the IPT"), whose jurisdiction does not depend on notification to the interception subject that there has been an interception of his or her communications.
136. Fourthly, it was inevitable that Dr Butt would soon learn, as he did, that the EAU had information relating to him. Dr Butt is an experienced speaker. Indeed, his evidence demonstrates the number and range of higher educational establishments at which he has given speeches. His complaint is that those invitations to speak have dried up.
137. Fifthly, we reject Mr Bowen's submission that Dr Butt could not have known about the collection of his information by the Home Office any sooner than the then Home Secretary's speech in March 2015, in which she announced the existence of the EAU. The existence of the EAU may not have been disclosed publicly until then, but the Prevent strategy has had various similar predecessor programmes under which universities were advised as to the formulation and implementation of policies in relation to external speakers. The Guidance has been published in order to assist universities in discharging their duty under section 43(3) of E2A to issue and maintain an up-to-date code of practice regulating meetings on their premises. Our attention was drawn to a number of those policies, starting with the Promoting Good Campus Relations Policy 2008. That policy included, among its key objectives, the tackling of extremist views that might incite violence. The updated 2013 version of the Guidance advises universities to be "aware of the risk of radicalisation and the challenges posed by violent extremism" (Promoting good relations on campus: a guide for higher and further education, March 2013 Guidance, p.27). The 2013 Universities UK guidance on External Speakers in Higher Education Institutions is similarly concerned with extremism. It provides guidance on the sorts of policy that universities ought to adopt in order to deal effectively with risks posed by particular speakers. One of those steps is to contact "BIS [Department for Business, Innovation and Skills] regional Prevent coordinators" for further advice on the best course of action to take in respect of particular events of concern.
138. Bearing in mind that Dr Butt has also been in higher education for several years and is an experienced speaker, it is highly likely that he would have been aware of the existence of those policies. He could reasonably have been expected to know that the Government was likely to monitor what is said by speakers like him in order to form a judgement about whether or not he fell within the ambit of the Prevent policy or one of its predecessors. The Judge, in effect, made a finding of fact in that respect (at [250]) when he said:

"although the claimant may not have seen himself in that light [viz as a non-violent extremist], he readily could have contemplated that others might in the light of the PDG and made a subject access request".

139. Finally, we note that in Secretary of State for the Home Department v Watson [2018] EWCA Civ 70 Lord Lloyd-Jones, with whom the other two members of the Court of Appeal agreed, stated (at [21]) that the view of the ECJ at paragraph 121 of its decision in Watson was not included in the dispositif of the ECJ's judgment.
140. After the oral hearing had concluded, Mr Bowen sought to rely on the decision and judgments of the Supreme Court in Re Gallagher's Application for Judicial Review [2019] UKSC 3, which were delivered on 30 January 2019, and particularly statements made by Lord Sumption in that case. We do not consider that Gallagher is of any assistance in resolving the present appeal. The judgments of the Supreme Court concerned the application of Article 8 to legislation providing for the mandatory disclosure of information about cautions, convictions and reprimands. What was critical to the analysis in that case, including Lord Sumption's analysis of whether the disclosure regime satisfied the "in accordance with the law" requirement, is that it was mandatory for the relevant data to be disclosed: see especially [44]. In the present case there was no requirement for the EAU to disclose Dr Butt's data to anyone, nor any evidence that it was shared with Prevent co-ordinators.
141. No other challenge to justification under Article 8(2) was advanced in Mr Bowen's oral submissions. After the conclusion of the oral hearing, however, in response to an invitation from the Court for submissions on the decision of the ECrtHR in Catt, Mr Bowen submitted that, as was found by the ECrtHR in Catt, so in the present case the storage and use of Dr Butt's information was disproportionate because there was no maximum time limit on the retention of data by the EAU.
142. We consider there is no analogy. In Catt the Court accepted (at paragraph 117) that there was a pressing need to collect Mr Catt's personal data but held (at paragraph 119) that there was not a pressing need to retain it. The Court said that it did not call into question the fact that there may have been a pressing need for the police to retain Mr Catt's personal data for a period of time after it was collected. It emphasised (at paragraphs 121-122), however, that at least some of his personal data concerning his involvement in non-violent protest was collected over six years before and remained in the domestic extremism database despite the fact that the police concluded, and the domestic courts affirmed, that he was not considered a danger to anyone.
143. In Dr Butt's case, his personal data was collected and had been retained by the EAU for a relatively short period before he commenced these proceedings. Furthermore, unlike the situation for Mr Catt, Dr Butt's personal information was not in any realistic sense of a particularly sensitive nature in view of his desire and practice of deliberately publicising and promoting it. Nor was our attention drawn to any evidence in the present case that the Secretary of State has accepted that Dr Butt is no longer of any interest in relation to the Prevent strategy.
144. It is arguably too late for Dr Bowen to make even those submissions on proportionality. It is certainly too late for any more extensive submissions.
145. In the circumstances, if Article 8(1) was engaged in the present case, it was justified under Article 8(2).

Appeal Ground 5

146. In view of our findings above that there was no surveillance of Dr Butt by the EAU within section 26 of RIPA and, if there was surveillance, it was not covert, RIPA had no application, and the Judge was correct to so hold. As section 80 of RIPA makes clear, there is nothing in RIPA which makes unlawful anything which would otherwise be lawful and is not unlawful under RIPA.

Appeal Grounds 1, 2 and 3

147. These three linked Appeal Grounds comprise the challenge to the PDG and the HEPDG. The Grounds are as follows:

(1) Appeal Ground 1: The PDG and the HEPDG were ultra vires the powers of the Secretary of State to promulgate guidance under section 29 CTSA in that they required RHEBs to take steps to prevent people being drawn into "non-violent extremism", where "extremism" is defined as "opposition to fundamental British values".

(2) Appeal Ground 2: The Secretary of State failed to comply with his duty under section 31(3) CTSA to have a "particular regard to the duty to ensure free speech". Section 31(2) CTSA requires RHEBs, in the discharge of their duty under section 26 CTSA, to "have particular regard to the duty to ensure freedom of speech", and the Secretary of State in promulgating guidance under section 29 CTSA "must have particular regard to the duty to ensure freedom of speech". The Guidance as promulgated, particularly paragraph 11 of HEPDG, disproportionately restricted free speech.

(3) Appeal Ground 3: The PDG and the HEPDG breached common law and Article 10 Convention rights in relation to free speech "in their lack of clarity, absence of connection between the interference and any legitimate aim and their lack of proportionality". It is acknowledged that this ground turns on the same alleged flaws in the Guidance already identified: the over-broad definition of "extremism" and the mandate to RHEBs to prevent speakers from attending events "where RHEBs are in any doubt that the risk cannot be fully mitigated".

Appeal Ground 1

148. The Judge (at [27]) characterised Dr Butt's attack on this matter as follows. The power in section 29 was to give guidance about the exercise of the duty in section 26. The duty under section 26 was to have "due regard to the need to prevent people from being drawn into terrorism". The PDG, however, went well beyond the confines of sections 26 and 29 and sought to prevent people being drawn into "extremism", including "non-violent extremism".
149. The Judge recorded (at [28]) the Secretary of State's central reply in the following terms:

"Being drawn into terrorism included being drawn into support for terrorism. There was no clear dividing line between extremism and terrorism; the two were closely related. Preventing people being drawn into terrorism required the extremist ideologies used to legitimise terrorism to be challenged, and their promotion disrupted, …. "Non-violent extremism" was always "caveated" in Guidance by the concept of a "risk of being drawn into terrorism"."

150. The Judge rejected Dr Butt's contention, defining the critical issue as one of proper construction of the Guidance. The duty under section 26 was to have "due regard" to the "need to prevent" people from being "drawn into terrorism". This was a duty to prevent a process occurring (see [29]). The PDG did not equate "non-violent extremism" with "terrorism". The Judge expressed it in the following way (at [30]):

"The whole context of the Guidance, the CTSA and the Prevent strategy is to reduce the risk of people being drawn into terrorism by extremism, violent or non-violent. The Guidance did not apply to "non-violent" extremism however intrinsically undesirable, which does not create a risk that others will be drawn into terrorism."

151. The Judge rejected Dr Butt's submission that, despite TA's broad definition of "terrorism", the definition should be construed strictly following R (Miranda) v SSHD (Liberty Intervening) [2016] EWCA Civ 6, [2016] 1 WLR 1505. In the Judge's view Miranda had nothing to do with this issue. The issue here was the role of non-violent extremism in drawing an individual into terrorism itself.

The submissions on Appeal Ground 1

152. The central contention of Dr Butt is that the Secretary of State cannot lawfully promulgate guidance which applies to "extremist" views that do not, at least in some respect, risk drawing others into terrorism, and that the Judge was in error when he concluded that the Guidance properly read was in fact limited in that way. Mr Bowen submitted that the Guidance goes further than that and "applies to expressions of belief or opinion" which are "extremist" within the definition in the PDG. That would include non-violent extremism and is therefore ultra vires section 29. In the alternative, the distinction between non-violent extremism which risks drawing others into terrorism and that which does not is impossible to draw in practice, particularly when the relevant decisions in response to the Guidance must be made by RHEB staff, or others with widely differing degrees of experience. This is particularly so where the decision may be based on an assessment from the EAU or elsewhere, which applies the test of "extremism" in the Guidance but without any qualification as to the effect of drawing people into terrorism.
153. The Secretary of State replies that the position of the government is not to subscribe to any "single pathway" theory of radicalisation, but rather to adopt a "multi-factorial analytical model which focusses on background factors, influences and receptiveness". As Mr Sanders emphasised in his written submissions, being drawn into terrorism encompasses being drawn into support for terrorism, as well as the threatened or actual use of terrorism.
154. As below, the Secretary of State submits that the Judge's analysis was correct when he considered the section 26 duty: it was to prevent a process occurring which would be likely to draw individuals into terrorism. The PDG does not equate or treat as synonymous "terrorism", "extremism", and "active or vocal opposition to fundamental British values". That equation is expressed by Mr Bowen to be one of his "core" submissions. The PDG recognises explicitly (see paragraph 8) that "extremism" as defined may be legal. However, it is also true that extremists may draw people into terrorism by radicalising them, creating an atmosphere which conduces to terrorism: see PDG paragraphs 7/8, HEPDG paragraphs 11, 19, 22 and 29. The Judge was right to reject the submission that the Guidance equates the terms in the way suggested.
155. In our view this aspect of Dr Butt's challenge cannot succeed. The Judge was correct in his conclusions. It is not in issue that preventing people from being drawn into terrorism is a legitimate aim: see the judgment below at [40]. The Guidance concerns the section 26 duty: it is directed to preventing people being drawn into terrorism through non-violent extremism. As the Judge put it:

"Non-violent extremism which carries no risk of drawing people into terrorism is not subject to the guidance." [129]

156. It cannot be a part of this challenge to assert that there is no such thing as non-violent extremism which carries the relevant risk. Firstly, that is not a point of law. Secondly, the Judge expressed rather cogently how this might arise: see [136] to [139]. The Judge's conclusion is expressed in [140]:

"140. I regard it as plain that if non-violent extremism does risk drawing people into terrorism, then a degree of consideration, which may lead to RHEBs countering, mitigating or restricting that effect on its students towards whom they owe some safeguarding duty, (and ultimately that effect on the wider society of which they form part) is a legitimate objective for government to set for achievement through guidance. I am far from clear that Mr Bowen submitted otherwise."

157. Provided that the "extremism" in question is understood as subject to the additional requirement that it must be of a kind such as to risk drawing people into terrorism, then the aim is legitimate and the Guidance intra vires.

Appeal Ground 2

158. The next challenge has been described by the Secretary of State as the "micro" challenge. It arises under Appeal Grounds 1 and 2 and is closely tied in with Appeal Ground 3. This is focused on paragraph 11 of HEPDG. For convenience, we repeat that here:

"Furthermore, when deciding whether or not to host a particular speaker, RHEBs should consider carefully whether the views being expressed, or likely to be expressed, constitute extremist views that risk drawing people into terrorism or are shared by terrorist groups. In these circumstances the event should not be allowed to proceed except where RHEBs are entirely convinced that such risk can be fully mitigated without cancellation of the event. This includes ensuring that, where any event is being allowed to proceed, speakers with extremist views that could draw people into terrorism are challenged with opposing views as part of that same event, rather than in a separate forum. Where RHEBs are in any doubt that the risk cannot be fully mitigated they should exercise caution and not allow the event to proceed." [emphasis added].

159. The nub of this challenge is that the sentences emphasised above go too far; that the formulation contains a strong presumption which will skew the decision-making process; and that the Guidance ignores statutory duties to which the RHEBs are subject, and will have a marked tendency to mislead the RHEB representative seeking guidance from the HEPDG.
160. The starting point here is the statutory duty under section 31(2)(a) of the CTSA to "have particular regard to the duty to ensure freedom of speech". That duty is defined by section 31(5) as meaning "the duty imposed by section 43(1) of the Education (No 2) Act 1986" (set out above at [27]).
161. Mr Bowen submitted that paragraph 11 of HEPDG is so unbalanced as to constitute an invitation to ignore the duty under E2A, which is not named or referenced, and which is inconsistent with the presumption so emphasised in the Guidance.
162. The Judge accepted the thrust of Dr Butt's submissions as to the content and meaning of paragraph 11, taken on its own. He said as follows:

"56. I entirely understand why the last and second last sentences of paragraph 11 can be seen as very restrictive. The RHEB must be "entirely convinced" that the risk is "fully mitigated", or "fully mitigated" without any doubt. Otherwise, the RHEB should exercise caution and not allow the event to proceed. In this context, I would have thought that was a nigh-on impossible task with some speakers, though the suggestion that it was a requirement that all who opposed fundamental British values should be banned is rather wide of the mark.

57. Mr Sanders' interpretation of the guidance is close however to submitting in effect that the proper interpretation of the guidance, albeit in context and read alongside other guidance, is not what an ordinary reading of the words would yield. His analysis was more nuanced, less absolute, and more reflective of the fact that the HEPDG concerned but one strand of the duties to which the institutions were subject.

58. In my judgment, paragraph 11 of the HEPDG means what it says on a straightforward reading of its quite simple language. The notion of "full mitigation" could mean mitigation as far as reasonably practicable or mitigation so that there was no significant risk, and without doubt could mean without any reasonable or significant doubt. But in the context of cancellation if full mitigation cannot be achieved beyond doubt, I do not think that that Mr Sanders' more nuanced reading is right. If the guidance meant what Mr Sanders said, it should have said so. But I have to add, that where RHEBs have interpreted the HEPDG as Mr Sanders submitted they should have done, it will lie ill in the mouth of the SSHD to complain. And if she wishes to revise the wording to reflect his submission, she can always do so. Even on Mr Sanders' reading, though some of the sting might be removed, many of the issues about the relationship between the guidance and the section 31 duties would remain."

163. Mr Sanders' response was somewhat complex. He distinguished between the "literal meaning in isolation" of paragraph 11 and its "overall effect as part of the Prevent Duty Guidance". RHEB senior managers will be trained and "supported" in taking these decisions. They will promulgate local policies, which should "contain procedures allowing for the discussion, escalation, review and resolution of disputed decisions". Mr Sanders relied on the preamble to the HEPDG which expressly states it is "additional to, and is to be read alongside, the general guidance contained in the revised [PDG]". Further, the HEPDG itself, in paragraph 5, emphasises that it is not prescriptive of individual decisions, which will be made by the institution "having considered all the factors in the case".
164. Mr Sanders emphasised the references to other policies and duties scattered throughout the HEPDG, and the existing legal obligations of RHEBs under E2A, and CTSA section 31(2), the HRA and the Equality Act 2010.
165. Mr Sanders then emphasised some of the other wording in HEPDG paragraph 11. The phrase "in these circumstances" must mean that "careful consideration has been given to the risk [of] drawing people into terrorism". The term "mitigation" does not mean "elimination" of the risk, but rather "alleviation or moderation" of the risk. Moreover, even where the relevant risk has been identified, such a speaker may be permitted to speak, provided they are "challenged with opposing views as part of the same event".
166. Many of those arguments found resonance with the Judge, who expressed part of his conclusions as follows:

"98. But the Guidance needs to be read and understood for what it is. It is just that: guidance. It does not direct an outcome, let alone "ban" or "direct" the banning of speakers. It must be considered, but "following it" in the absence of good reason can be a misleading approach, notwithstanding Mr Sanders' apparent concession. "Following it" requires no particular outcome but a consideration of factors, processes and steps. The guidance leaves it to the judgment of the RHEB as to whether the event should not proceed or proceed in whatever format or with whatever organisation it chooses.

99. As I have already explained, the balancing act, which Mr Bowen said failed to give due weight to the rights of the individual, does not need to be carried out within the guidance itself. The balancing act is for the RHEBs, having considered the Guidance, and their duties in s31 CTSA and s43 EA 1986. Mr Bowen said that the Guidance contained no explicit recognition of the importance of freedom of speech or political and religious matters. I do not agree with that, but the specific provisions of the CTSA show that when RHEBs reach decisions, they have to have particular regard to those issues. It is at that stage in the decision-making process that the balance is to be struck, and it is struck by the decision-maker not the SSHD."

167. Very similar conclusions are expressed at [59]-[61] of the judgment.
168. As elsewhere in this case, there has been something of a kaleidoscope of submissions from Mr Bowen, with responses from the Secretary of State. However, the challenge advanced on a proper analysis is in fact rather straightforward. Is the HEPDG in this critical paragraph so unbalanced that it represents a breach of the duty under section 31(2)(a) CTSA/section 43(1) of E2A? Does it wrongly divert RHEBs from their obligations under the 1986 Act?
169. We must first consider the ambit of that duty. That section 43(1) protects the freedom of speech of "members, students and employees of" the RHEB is straightforward. What is the meaning of "visiting speakers"? Does that phrase import expressly, or alternatively imply, a duty to ensure freedom of speech for those who would wish to be visiting speakers in the future (such as Dr Butt)? Dr Butt says yes. The Secretary of State's submission is more nuanced.
170. In the case of R v University of Liverpool, ex parte Caesar-Gordon [1991] 1 QB 124, the Court had to consider the section 43(1) duty. A meeting had been cancelled by the university authorities because of the anticipated reaction to a visiting speaker. It was anticipated that there might be disorder outside the university precincts and by persons not within its control. The Court held that the university was not entitled to take such matters into account.
171. The category of "visiting speakers" cannot, in our view, be restricted to "speakers who have already been invited to visit". Nor is such a gloss on the phrase supported by the decision in Caesar-Gordon. That case simply decided that the duty on an RHEB under section 43(1) is confined to what happens on campus, and that must include (as in Caesar-Gordon) what will be permitted on campus. Viewed in that way, a distinction between speakers who have been invited to visit, and those who would be invited but for the effect of the Guidance, will be arbitrary. In neither case is the RHEB drawn into considering matters beyond their area of responsibility.
172. The point is reinforced by the broad categories of persons whose freedom of speech is protected by the legislation. If the duty only extended to those already invited to speak, then could the same limitation apply to members and students? Could freedom of speech and academic freedom be said to be preserved by granting freedom of speech to existing members and students, while restricting recruitment of members and students on the ground of their political opinions? We think not. In our judgment the statutory duty in the 1986 Act, and thus the CTSA, extends to those who will in future be invited to visit and speak.
173. Although, as we have noted, the Judge accepted Dr Butt's criticism of the meaning of paragraph 11, he rejected the submission that the Guidance was unlawful. His reasoning was fully and elegantly expressed in [61]-[68] of his judgment. He said that the HEPDG and PDG "are guidance and not direction; institutions are responsible for their own decisions"; the institutions have the statutory duties we have quoted and the obligation of the institution is merely to have regard to the Guidance; their actions (decisions) "may not comply with the terms of the HEPDG, but the HEPDG is not law": [61].
174. The Judge concluded (at [63]) that:

"the HEPDG could have set out more fully what I concluded the position is; but it was not unlawful to say what it did, and leave the institutions to make the clear judgment that the other interests overrode its application in any particular case."

175. The Judge went on to observe (at [64]) that guidance of that kind is not "evidence that the SSHD failed in her duty in section 31(3) to have particular regard to the values of freedom of speech". The Judge observed (at [65]) that it was common ground that:

"the guidance had to be applied in the absence of good reasons not do so … based on R (Munjaz) v Merseyside Care NHS Trust [2005] UKHL 58, [2006] 2 AC 148."

The Judge doubted, however, the value of that "simple proposition" where the institution was subject to separate and "differently expressed duties". At [68], the Judge addressed Dr Butt's submission that the HEPDG would have the effect that RHEBs "are likely to give insufficient weight to their duty to ensure free speech under section 43 of the 1986 Act". The Judge characterised that as "not even an allegation that [RHEBs] would err in law, let alone that the SSHD has erred". If the RHEBs failed in their duty, that was a matter for challenge to their decisions. As the Judge put it:

"Guidance cannot be unlawful simply because, through misunderstanding their duties, others may act unlawfully."

176. With very great respect to the careful approach of this highly experienced judge, we are unable to agree with his conclusions on this issue. The HEPDG in general, and paragraph 11 in particular, is expressed in trenchant terms. The HEPDG is not only intended to frame the decision of RHEBs on the topic in question, it is likely to do so. We accept, of course, that those responsible for taking such decisions on behalf of RHEBs will often be aware of the other statutory duties to which they must respond, including the duties under section 43(1) E2A. No doubt some will be better versed in these duties than others. We accept also that guidance can be sought from Prevent coordinators and from information circulated within the university establishments. The difficulty, as we see it, is that the reader of HEPDG is likely to conclude that it is the most specific and pointed guidance that exists in the context with which we are concerned. Even the well-educated reader called on to take a decision on behalf of a university is likely to assume that this particular focused guidance already represents a balance of the relevant statutory duties affecting the RHEB decision-maker. Given those characteristics, can it properly be said that the Secretary of State had properly in mind his statutory duty under section 31(2)(a) CTSA when drafting and promulgating guidance which insufficiently represents the statutory duties bearing on the person seeking guidance, on the basis that they will already be sufficiently aware of these duties, and therefore able to correct the imbalance contained in the Guidance?
177. In the end, we cannot support such a conclusion. We conclude rather that the Secretary of State's duty in promulgating guidance such as this was to ensure that it was sufficiently balanced and accurate to inform the decision-maker in an RHEB of their competing obligations so best to assist them to a proper conclusion. We do not intend to attempt a redraft of paragraph 11, since that is a matter for the government. We do, however, consider that a balanced guidance which better reflects what we perceive the Secretary of State intended it to say - not least because of the submissions on literal as opposed to contextual meaning advanced by Mr Sanders - would be very easily achievable.

Appeal Ground 3

178. In the light of our conclusions expressed above, we intend to take Ground 3 shortly.
179. Neither of the parties has suggested that there is a material difference between the substance of Article 10 of the Convention and the right to freedom of expression at common law. The Judge took the same view. He addressed the matter through the lens of Article 10, between [69] and [95].
180. For reasons which the Judge gave, he concluded as a matter of fact that Dr Butt was not a victim of either the PDG or the HEPDG. In his Core Submissions, Mr Bowen made it clear, following the authority of R (Unison) v Lord Chancellor [2017] UKSC 51, [2017] 3 WLR 409, that, so far as concerns Dr Butt's common law rights, the point here is not one of proving a historic breach within section 7(1) of the HRA. As Mr Bowen put it, "the only issue is whether [Dr Butt] has sufficient 'standing' for bringing the claim", which he says has not been disputed.
181. The Secretary of State relies on the finding that Dr Butt has not been a "victim" within section 7 because "he could not show that the guidance had in fact been applied to prevent him speaking at a university and he was not entitled to rely upon his status as a 'potential victim'". Mr Sanders, in his written and oral submissions, went on to rely on the finding of the Judge that "the guidance was in accordance with the law", had a legitimate aim and was necessary and proportionate. Given our conclusions expressed above, those matters fall away. We accept the submission from the Secretary of State that there has been no proper basis to disturb the conclusion of the Judge that Dr Butt has failed to demonstrate any concrete impact on him. Accordingly, by virtue of section 7(1) of the HRA he cannot advance any claim for infringement of Article 10.
182. It is agreed that the Judge came to no conclusion in relation to Dr Butt's standing at common law. We consider that Dr Butt demonstrably has standing sufficient to establish his interest in the Guidance and its effects. This case concerns what Dr Butt has said in public, and wishes to say in public in the future. He was, after all, singled out in public.
183. As Mr Bowen has acknowledged, the remainder of this ground, insofar as it alleges breaches of common law rights, turns on the same alleged flaws in the Guidance already identified. In agreement with the Judge, we see no basis for concluding that he has demonstrated any historic infringement of his common law right of freedom of speech so as to found further action.

Conclusion

184. To the limited extent indicated at [158] to [177] above, this appeal succeeds. The remainder of this appeal is dismissed.

Appendix

Human Rights Act 1998, section 7

7.— Proceedings.

(1)  A person who claims that a public authority has acted (or proposes to act) in a way which is made unlawful by section 6(1) may—

(a)  bring proceedings against the authority under this Act in the appropriate court or tribunal, or

(b)  rely on the Convention right or rights concerned in any legal proceedings,

 but only if he is (or would be) a victim of the unlawful act.

…

Data Protection Act 1998

4.— The data protection principles.

(1)  References in this Act to the data protection principles are to the principles set out in Part I of Schedule 1.

(2)  Those principles are to be interpreted in accordance with Part II of Schedule 1.

…

(4)  Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.

7.— Right of access to personal data.

(1)  Subject to the following provisions of this section and to sections 8, 9 and 9A, an individual is entitled—

(a)  to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,

(b)  if that is the case, to be given by the data controller a description of—

(i)  the personal data of which that individual is the data subject,

(ii)  the purposes for which they are being or are to be processed, and

(iii)  the recipients or classes of recipients to whom they are or may be disclosed,

(c)  to have communicated to him in an intelligible form—

(i)  the information constituting any personal data of which that individual is the data subject, and

(ii)  any information available to the data controller as to the source of those data, and

(d)  where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his credit worthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.

(2)  A data controller is not obliged to supply any information under subsection (1) unless he has received—

(a)  a request in writing, and

(b)  except in prescribed cases, such fee (not exceeding the prescribed maximum) as he may require.

…

…

(8)  Subject to subsection (4), a data controller shall comply with a request under this section promptly and in any event before the end of the prescribed period beginning with the relevant day.

…

SCHEDULE 1 THE DATA PROTECTION PRINCIPLES

PART I THE PRINCIPLES

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

4. Personal data shall be accurate and, where necessary, kept up to date.

5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

6. Personal data shall be processed in accordance with the rights of data subjects under this Act.

7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Part II

Interpretation of the principles in Part I

The first principle

1.—(1) In determining for the purposes of the first principle whether personal data are processed fairly, regard is to be had to the method by which they are obtained, including in particular whether any person from whom they are obtained is deceived or misled as to the purpose or purposes for which they are to be processed.

(2) Subject to paragraph 2, for the purposes of the first principle data are to be treated as obtained fairly if they consist of information obtained from a person who—

(a) is authorised by or under any enactment to supply it, or

(b) is required to supply it by or under any enactment or by any convention or other instrument imposing an international obligation on the United Kingdom.

2.—(1) Subject to paragraph 3, for the purposes of the first principle personal data are not to be treated as processed fairly unless—

(a) in the case of data obtained from the data subject, the data controller ensures so far as practicable that the data subject has, is provided with, or has made readily available to him, the information specified in subparagraph (3), and

(b) in any other case, the data controller ensures so far as practicable that, before the relevant time or as soon as practicable after that time, the data subject has, is provided with, or has made readily available to him, the information specified in sub-paragraph (3).

(2) In sub-paragraph (1)(b) "the relevant time" means—

(a) the time when the data controller first processes the data, or

(b) in a case where at that time disclosure to a third party within a reasonable period is envisaged—

(i) if the data are in fact disclosed to such a person within that period, the time when the data are first disclosed,

(ii) if within that period the data controller becomes, or ought to become, aware that the data are unlikely to be disclosed to such a person within that period, the time when the data controller does become, or ought to become, so aware, or

(iii) in any other case, the end of that period.

(3) The information referred to in sub-paragraph (1) is as follows, namely—

(a) the identity of the data controller,

(b) if he has nominated a representative for the purposes of this Act, the identity of that representative,

(c) the purpose or purposes for which the data are intended to be processed, and

(d) any further information which is necessary, having regard to the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair.

3.—(1) Paragraph 2(1)(b) does not apply where either of the primary conditions in sub-paragraph (2), together with such further conditions as may be prescribed by the Secretary of State by order, are met.

(2) The primary conditions referred to in sub-paragraph (1) are—

(a) that the provision of that information would involve a disproportionate effort, or

(b) that the recording of the information to be contained in the data by, or the disclosure of the data by, the data controller is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

SCHEDULE 2

Conditions relevant for purposes of the first principle: processing of

any personal data

1. The data subject has given his consent to the processing.

2. The processing is necessary—

(a) for the performance of a contract to which the data subject is a party, or

(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

4. The processing is necessary in order to protect the vital interests of the data subject.

5. The processing is necessary—

(a) for the administration of justice,

(b) for the exercise of any functions conferred on any person by or under any enactment,

(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

6.—(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.

European Convention of Human Rights, Articles 8, 10, 34

ARTICLE 8 Right to respect for private and family life

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

ARTICLE 10 Freedom of expression

1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises.

2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.

ARTICLE 34 Individual applications

The Court may receive applications from any person, non-governmental organisation or group of individuals claiming to be the victim of a violation by one of the High Contracting Parties of the rights set forth in the Convention or the Protocols thereto. The High Contracting Parties undertake not to hinder in any way the effective exercise of this right.