England and Wales High Court (Queen's Bench Division) Decisions

IN THE HIGH COURT OF JUSTICE
SITTING AT LIVERPOOL CIVIL & FAMILY COURT
QUEEN'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST

		Royal Courts of Justice Strand, London, WC2A 2LL
		01/09/2020

Covid-19 Protocol:  This judgment was handed down by the Judge remotely by circulation to the parties' representatives by email and release to BAILII.  The date and time for hand-down is deemed to be 1 September 2020 at 10:00

Mrs Justice Steyn :

A. Introduction

1. The Claimant, Dr Kathryn Hopkins, is a civil servant employed by the Defendant, Her Majesty's Revenue and Customs ("HMRC").
2. The claim stems from the Claimant's arrest by Merseyside Police on 15 August 2018. In accordance with her contract of employment, she disclosed her arrest to her employer. The Claimant was suspended on full pay by HMRC pending disciplinary proceedings. More than two years after she was arrested, the position remains that the Claimant has not been charged with any offences (but nor has she been notified that the police investigation is closed). No disciplinary charges have been laid by HMRC, but the Claimant remains suspended. The primary focus of Dr Hopkins' claim against HMRC is her concern regarding the processing of her personal data, including criminal offence data, and the way in which the ongoing disciplinary proceedings have been handled, albeit her claim raises numerous causes of action.
3. By an application filed on 14 October 2019, and amended on 20 December 2019, HMRC seeks an order striking out the claim and/or for summary judgment in the Defendant's favour.

B. Open justice and anonymity

4. The hearing took place in open court in Liverpool. Dr Hopkins attended in person, accompanied by her McKenzie friend, Mr Bizimungu Joseph, and she represented herself. Counsel for HMRC, Mr David Mitchell, appeared via video link relayed from the Royal Courts of Justice.
5. In her Particulars of Claim, Dr Hopkins had made a request for anonymisation given the "highly confidential nature of the personal information involved in this case". However, when the matter came before Saini J on 25 October 2019, the Claimant chose not to pursue any application for anonymity. Accordingly, Saini J's order of 25 October 2019 records that the "Claimant's applications are dismissed, save as regards the anonymity application on which no order is made". At a telephone hearing before Nicklin J on 5 June 2020, Dr Hopkins confirmed that she was not seeking any order for anonymisation or restricted reporting. Dr Hopkins again confirmed this position in her skeleton argument and at the hearing before me of HMRC's application, at which she represented herself ably.
6. Accordingly, and perhaps unusually given the nature of the claim, there is no order for anonymity or restricted reporting. Nevertheless, I have borne in mind the sensitivity of the information and I have sought to avoid referring to it more than is reasonably necessary to explain my conclusion and reasons. In particular, although I have not referred to the evidence regarding the Claimant's health, the transcript of the Claimant's interview on 20 December 2018 or answers to follow up questions, or gone into the details of the offences for which the Claimant was arrested, I am fully aware of the evidence regarding these matters.

C. The facts

7. I have taken the facts from the Particulars of Claim, save to the extent that I have referred to the (undisputed) contents of correspondence.

The disciplinary proceedings

8. On 15 August 2018, the Claimant was arrested by Merseyside Police. The four offences for which she was arrested are identified in a letter dated 3 September 2018 sent by Merseyside Police to HMRC. It is unnecessary to set out the details of the alleged offences, and as no charges have (at least, as yet) been brought I shall refrain from doing so, save to say that all four offences are serious and they include an allegation of the commission of a serious sexual offence.
9. On 16 August 2018, the Claimant disclosed to her line manager, Darren Warren, that she had been arrested. She referred to the sexual offence for which she had been arrested, but not the other three offences. The Claimant has pleaded that she believed it was a contractual requirement to disclose this information to her line manager and he confirmed to her that it was a condition of her employment.
10. On 17 August 2018, Mr Warren required the Claimant to provide further information about the arrests.
11. Between 16 and 20 August 2018, Mr Warren disclosed the Claimant's arrest information to Internal Governance (a division of HMRC) and, the Claimant states, unidentified "others". Internal Governance are alleged to have disclosed the information further within HMRC, including to Human Resources and the Press Office.
12. On 20 August 2018, the Claimant arrived at work and was immediately suspended and escorted out of the building by Mr Warren. She was provided with a letter notifying her of her suspension from duty.
13. On 4 September 2020, HMRC sent to the Claimant, by recorded delivery, a letter notifying her that she was the subject of a disciplinary investigation, to be conducted by Mr Neil Angus of Internal Governance Civil Investigations, to investigate concerns arising from her arrest by Merseyside Police for the four offences identified in their letter to HMRC of 3 September 2018. Prior to this letter being sent, Mr Warren telephoned the Claimant to inform her that she was under investigation for possible gross misconduct, that a potential outcome would be dismissal, and to forewarn her of the letter of 4 September. The Claimant states that she did not collect the letter from the Royal Mail office until a week or so after the attempted delivery.
14. The Particulars of Claim state that the 4 September letter caused the Claimant distress and her mental health deteriorated. On 2 October 2018 she informed her line manager that she was going on sick leave due to stress. This developed into "very severe anxiety and depression".
15. On 5 November 2018, Mr Warren sent the Claimant a message that he needed to hand-deliver a letter to her from Internal Governance, so that they could interview her. She responded that she was unwell. On 15 November 2018, Mr Warren sent the Claimant a further message and on 17 November 2018 the Claimant received a letter from him sent by recorded delivery which she did not open.
16. On 18 November 2018, the Claimant wrote letters to:

i) Mr Warren, stating that she believed his conduct amounted to harassment and she would be communicating with Jane Whittaker from now on.

ii) Ms Whittaker, stating that she would like to initiate a number of formal grievances (without identifying them) and that she did not wish to be contacted while she was on sick leave.

iii) Sean Whellams, asking for the suspension and investigation to be halted, and alleging that the proposed investigation was unfair, unlawful and in breach of the GDPR.

17. Ms Whittaker responded in a letter dated 5 December 2018:

"Thank you for your letter dated 18 November. I confirm that I have received the fit note for the period 3 November to 14 December, and copies of your letters to Darren and Sean (also dated 18 November). I am sorry to hear that you are unwell.

I understand that you do not want to engage with or be contacted by work at the moment. However, we do need to keep in touch during your absence. I am attaching the relevant HMRC guidance for you.

I take from your letter to me and the letter that you sent to Darren that you do not want him to continue as your keep in touch manager and that you would prefer to keep in touch with me whilst you are away. I am content to take on this role.

We will need to agree how frequently we will contact each other, the method (face to face, phone call, text/email) and, if you are too unwell to keep in touch with me directly, whether there is a family member or other person you would like to liaise with me on your behalf. The absolute minimum expectation is that we are in touch at least once every 6 weeks. The purpose of keep in touch arrangements is to support your wellbeing so I hope that we can find a way to fulfil the HR requirements that will work for you.

I also want to stress that the keep in touch manager's role is separate from HMRC's disciplinary process. You will receive a separate response to the letter you sent to Sean.

Please confirm that you have received this letter and let me know your preferences on keeping in touch arrangements."

18. The Claimant responded by letter dated 6 December 2018:

"Thank you for your letter. I have been advised not to open it because of the risk to my health and well being. I (or my advocate) will continue to provide you with medical certificates and will let you know as soon as I am well enough to engage with work again."

19. On 13 December 2018, Ms Whittaker and Dan Coughlin, Human Resources Director, delivered by hand to the Claimant, at her home, a letter dated 12 December 2018 from Mr Angus.
20. The letter of 12 December 2018 from Mr Angus invited the Claimant to attend an interview to investigate the concerns referred to in Mr Whellams' letter of 4 September 2018, as well as further concerns that on 29 July 2018 she hired a car under HMRC corporate policy and, when the car was stopped by the Police later that day due to it being driven erratically, a 15 year old male who did not hold a driving licence, was not insured to drive the car, and was under the influence of cannabis, was driving the car. The Claimant was in the rear of the car at the time. Mr Angus's letter informed the Claimant of her right to be accompanied by a trade union representative or work colleague, but not a solicitor. It also stated:

"If you choose not to attend the interview, you can provide me with a written response regarding the matters detailed above. Your response should reach me no later than Friday 21^st December 2018. Should you choose not to attend the interview, or provide me with a written response by the stipulated date, consideration of the discipline case will go ahead based on the available information."

21. On 13 December 2018, the Claimant telephoned Mr Angus and told him that she would attend the interview, although she was still on sick leave.
22. On 20 December 2018, the Claimant attended the investigatory interview with Mr Angus and Justine Craven, another Internal Governance investigator. The Claimant chose not to be accompanied by a colleague or trade union representative.
23. On 25 January 2019, the Claimant telephoned and wrote to Mr Angus and raised with him her concerns regarding the lawfulness of the suspension and investigation, with respect to the GDPR and the DPA. Mr Angus agreed to halt the investigation while these concerns were addressed.
24. On 24 April 2019, Mr Angus responded to the Claimant's letter of 25 January 2019. He indicated that the advice he had received was that the Claimant's data was being lawfully processed and so he intended to continue with the investigation which had originally opened on 4 September 2018. Mr Angus stated that he had a number of follow up questions to put to the Claimant. He asked her to indicate whether she wished to respond at a meeting or by providing a written response.
25. On 29 April 2019, the Claimant lodged a complaint with the Information Commissioner's Office ("the ICO") and sent Mr Angus a text message asking him to pause the investigation pending the outcome of her complaint to the ICO.
26. On 13 May 2019, the Claimant sent a letter of claim and, following pre-action correspondence, she issued the claim on 27 June 2019.
27. The disciplinary investigation was incomplete when the Claimant issued this claim. No disciplinary charges had, at that stage, been formulated. That remains the position. The Claimant has been suspended on full pay, and her suspension has been reviewed monthly, since 20 August 2018.

The Claimant's grievances

28. The Claimant's letter of 18 November 2018 to Ms Whittaker stated that she wished to raise a number of grievances, but she did not identify them in that letter. I have referred to Ms Whittaker's response in paragraph 17 above.
29. The letter to Mr Whellams of 18 November 2018 asked for the suspension and investigation "to be halted" on the grounds that it was alleged to be unfair and unlawful and may breach the GDPR. The Claimant did not, in her letter, seek to raise a grievance. Mr Whellams responded by a letter dated 7 January 2019:

"You contacted me to object to the processing of your personal data for the purpose of disciplinary action, and specifically to request HMRC cease distribution of information relating to you. I am afraid that we cannot grant this request. The distribution of your personal information in this instance was necessary to adhere to HMRC's disciplinary processes, and therefore for the performance of a public task carried out in the interest or in the exercise of official authority. The right to restrict or object to data processing in this way does not apply.

You have also asked five questions relating to the processing of your personal data, please see our response to these as follows:

1. Why this information was committed to writing in the first place and by whom?

This information was committed in writing in line with HMRC's disciplinary procedures (HR23002, HR23003 – The HR guidance on the intranet site are replicated at annex B and C below.) and committed in paper by those with authority to do so as part of an investigation into allegations – line management and [Internal] Governance.

2. With whom this information has been shared, in writing, or by any other means and why?

In line with the procedures outlined in question 1 this has been shared with limited HR staff, relevant personnel in your management chain, the decision maker on your case and where required legal advisors.

3. What instructions were provided to each and every recipient regarding the use of this information?

Recipients of your data in this case were not provided any specific instruction on how to handle your information. However, there are departmental expectations on information handling that the recipients must follow both in the discipline procedures outlined in question 1, and HR21000 (Personal data). The HR guidance on the intranet site is replicated at annex D below.

4. With whom have any recipients have further shared this information, either in writing or by any other means and why

There is no indication that recipients of your information have shared it wider than those outlined in the response to question 1.

Details of how each and every recipient has stored this information, and how long they intend to keep it and why?

Recipients of your data in this case should store and retain your data in line with HMRC's guidance outlined above and HR22005 (Conduct: Confidentiality and customer privacy). Relevant recipients will also retain your records in line with our retention policies for HR data held centrally and data held locally by managers. The HR guidance on the intranet site is replicated at annex D below.

I appreciate that you asked not to be contacted but we are obliged to do so now to meet our legal obligations to respond to you in line with DPA 2018 and GDPR.

If you are unhappy with this response you may ask for a review. …

You may also complain to the Information Commissioner …

Finally, you requested that we halt these investigations, however we cannot do this where misconduct is suspected then it is reasonable for HMRC to follow its internal disciplinary proceedings including consideration of suspension."

30. On 30 January 2019, the Claimant replied to Mr Whellams, copying her response to Ms Whittaker, providing "more information about what she considered to be a Personal Data Breach, and other breaches of her rights" (POC §53).
31. On 3 March 2019, the Claimant wrote to Ms Whittaker asking for a grievance investigation into her concerns about the Defendant's allegedly unlawful conduct.
32. By a letter dated 8 March 2019, Ms Whittaker wrote to the Claimant:

"You asked me to appoint a grievance manager to investigate 4 issues:

whether HMRC has unlawfully accessed, recorded, stored, used, disclosed, and transmitted sensitive personal data about you (Personal Data Breach);

whether the ensuing suspension and disciplinary procedures are lawful, both because of their reliance on unlawfully accessed information, and in themselves.

whether HMRC is in breach of their duty of care towards you in respect of your health and well-being.

whether HMRC's actions could constitute a breach of your Human Rights amongst other legal obligations.

I can confirm that I will appoint an independent grievance manager. I expect this person to be from outside KAI [Knowledge, Analysis and Intelligence]. As we have discussed before, this will mean that another person in HMRC will be aware of your case, but my understanding is that this is how you want to proceed.

Many of the other specific issues raised in your letter to me are similar to those in your letters to Neil Angus and Sean Whellams and depend on the legal view on the use of personal data about you. I can assure you that we are taking these questions very seriously indeed and we have sought advice on them. I am afraid that securing this advice is taking longer than we anticipated."

33. A Grievance Manager, Morris Graham, was appointed by Ms Whittaker. The Claimant had an initial telephone discussion with Mr Graham on 2 April 2019. On 18 April 2019, Mr Graham wrote to the Claimant that he was "still taking advice on how to progress this somewhat complex issue".
34. On 31 May 2019 Mr Graham wrote to the Claimant:

"HR20507 sets out a list of matters which are appropriate for investigation under grievance procedures. Having taken advice from HR colleagues, and having considered the guidance in full, my conclusion is that, for the most part, your complaint does not meet the criteria set out in that guidance.

The HR guidance is clear (at HR20502) that "the grievance policy is not to be used to deal with complaints arising from the application of other policies and procedures that include an appeal mechanism, for example discipline…"

I attach copies of the guidance I have referred to.

There is however an Internal Governance complaints procedure for those who are unhappy with the way in which investigations are carried out. Complaints under this procedure can be addressed at the same time as disciplinary procedures. The relevant process is set out on the intranet, so again I attach a paper copy.

Please let me know if you would like to proceed with a complaint using this procedure, and I will ensure the necessary steps are taken.

In relation to the third element of your complaint, that relating to HMRC's duty of care, my finding is that this does fall within the grievance procedure. My conclusion is that I have referred the issue to Jane Whittaker to review the Keeping in Touch procedures, ensure they have been correctly followed, and to ensure that appropriate support is maintained moving forward."

35. On 26 June 2019 Ms Whittaker wrote to the Claimant, following up on the letter from Mr Morris of 31 May:

"Grievance

Since we were last in touch, I have received a copy of the letter that Morris Graham sent to you on 31 May, setting out his conclusions on the issues he was investigating. One of Morris's conclusions was that I should review our KIT arrangements with you to ensure that they have been correctly followed and that appropriate support is being provided.

I am conscious that it's some time since we agreed KIT arrangements and there have been quite a few developments since I first took on the Keep in Touch manager role, so I think it would be timely and helpful to discuss what would work best for you. Can you let me know whether you'd like to have a phone conversation about this, or whether you'd like to approach it in a different way?"

36. In an email to Ms Whittaker sent on 16 July 2019, the Claimant said she was "happy with the KIT arrangements".

The complaint to the ICO

37. As I have noted in paragraph 25 above, the Claimant made a complaint to the ICO. The ICO summarised the key points of the Claimant's complaint in these terms:

"You have claimed that the processing of your personal data by HMRC from 16 August 2018 onwards was unlawful under the GDPR and DPA 2018 because

The information about your arrest is a special category of personal data under GDPR Article 10 and HMRC failed to establish a lawful basis for processing under GDPR Article 5.

HMRC unlawfully shared information about you within its own organisation and with third parties.

HMRC's contractual requirement for you to disclose information about your arrest was in breach of GDPR Articles 5 and 7.

HMRC was in breach of GDPR Articles 12 and 13 in respect of failing to provide clear and transparent information about the use of your personal data.

HMRC failed to comply in its obligations under GDPR Articles 15, 21 and 18 in response to your letter of 18 November 2018.

…

You claim that the information in the letter from Merseyside [Police] was processed in a way incompatible with the purpose for which it was provided."

38. The Lead Case Officer for the ICO concluded the investigation into the Claimant's complaint, and wrote to the Claimant on 6 February 2020 that "I am of the view it is likely that HMRC has complied with its data protection obligations in this case". The ICO's letter explained:

i) In their view, HMRC had a lawful basis for processing the Claimant's personal data.

ii) The ICO had seen no clear evidence to support the claim that the Claimant's information had been inappropriately shared either within or outside HMRC.

iii) The ICO agreed with HMRC that the Claimant's letter of 18 November 2018 to Mr Whellams was not a subject access request but rather a request to halt the disciplinary investigation, which HMRC was justified in refusing to do. The request did not appear to the ICO to meet any of the criteria in Articles 18 or 21(1).

iv) The ICO rejected the Claimant's contention that HMRC failed to provide information detailing how it would process her personal data, noting that she would have had HMRC's Staff Privacy Notice – which was widely available on the staff intranet and had been provided to the Claimant along with copies of HMRC's conduct and discipline policies – "which explains how HMRC will process your personal data and includes a section specifically about criminal convictions".

39. Given the ICO's expertise in the area of data protection, its view is of interest, but I am not bound to follow the ICO's view and I note that the ICO did not have as full materials before it as I have before me.

D. Procedural framework

40. Rule 3.4(2) of the Civil Procedure Rules ("CPR") provides:

"The court may strike out a statement of case if it appears to the court –

(a) that the statement of case discloses no reasonable grounds for bringing or defending the claim;

(b) that the statement of case is an abuse of the court's process or is otherwise likely to obstruct the just disposal of the proceedings; or

(c) that there has been a failure to comply with a rule, practice direction or court order."

41. HMRC relied in the application on each of these subsections. The application to strike out pursuant to r.3.4(2)(c) was based on the fact that the Particulars of Claim were unsigned. This basis for the application fell away at the hearing. Dr Hopkins had initially filed an unsigned version of the Particulars of Claim because she was unsure how to complete the statement of truth while seeking (as she was at that stage) to remain anonymous. However, Dr Hopkins provided documents at the hearing which showed that she had filed a second version of her Particulars of Claim which fully complied with the requirement to sign a statement of truth.
42. CPR r.24.2(a)(i) provides:

"The court may give summary judgment against a claimant or defendant on the whole of a claim or on a particular issue if –

(a) it considers that

(i) that claimant has no real prospect of succeeding on the claim or issue; …"

(ii) …; and

(b) there is no other compelling reason why the case or issue should be disposed of at a trial."

43. In determining HMRC's application, I assume that the facts asserted by Dr Hopkins in her Particulars of Claim are true.

E. The causes of action

44. The primary claims on which Dr Hopkins focused are claims for (a) breach of contract; (b) breach of the General Data Protection Regulation ("the GDPR") and the Data Protection Act 2018 ("the DPA"); and (c) breach of Articles 3, 8, 6, 10 and 14 of the European Convention on Human Rights ("the ECHR").
45. In addition, the following causes of action are pleaded in the Particulars of Claim:

i) Breach of the Rehabilitation of Offenders Act 1974, the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (Amendment) (England and Wales) Order 2013 (SI 213/1198) and the Police Act 1997;

ii) Negligence/Breach of the Health and Safety at Work Act 1974 and the Health and Safety Regulations/Protection from Harassment Act 1997;

iii) Breach of the Commissioners for Revenue and Customs Act 2005;

iv) Misfeasance in Public Office; and

v) Defamation/Malicious Falsehood/Negligence.

F. POC §75: Contract

POC §75(a): requirement to provide arrest information

46. The claim for breach of contract is pleaded at paragraph 75 of the Particulars of Claim. The Claimant's first allegation is that:

"(a) The requirement for the Claimant to provide information upon arrest was contradictory to the Defendant's policies on the use of staff criminal offence data outlined in the Staff Privacy Statement."

47. The Claimant's contract of employment specifies:

"10. Conduct and discipline

10.1 You must comply with the Civil Service Code and HMRC's Code of Conduct. HMRC's conduct and discipline policy specifies HMRC's conduct rules and disciplinary procedures. Failure to comply may result in disciplinary action, which can include suspension without pay, downgrading or dismissal.

10.2 You are required to co-operate with any investigation conducted under HMRC's disciplinary procedures.

…

13. Criminal investigations and offences

13.1 If you are investigated for any criminal or revenue offence (for example, irregularities involving, tax, duties and contributions administered by HMRC) you must report the facts immediately to your manager, as well as the outcome of any subsequent proceedings. If you are the subject of a criminal investigation or of allegations about an offence amounting to gross misconduct HMRC may suspend you from duty. You may also be subject to disciplinary proceedings which could result in your dismissal."

48. The requirement to report any criminal investigation is reiterated in HMRC's guidance "HR22009 Conduct: private conduct" which states:

"In your private activities and financial transactions, you must avoid any conduct or behaviour which would:

reflect poorly on you as an employee of HMRC

bring HMRC into disrepute

give grounds for suspecting dishonesty or abuse of trust

involve the use of official information to secure a financial advantage.

You must not do anything in your private conduct that might discredit the Department. You must tell your manager if:

you are arrested or become the subject of criminal proceedings

… you should also follow the conduct guidance for:

Reporting criminal offences"

49. The guidance "HR22012 Conduct: Reporting criminal offences" states:

"You must immediately tell your manager (or your manager's manager) if:

you are arrested (and/or released but remain under police investigation) …

You must keep your manager informed of proceedings subsequent to any of the above."

50. Similarly, "HR23004 Discipline: Advice for Employees" gives the following advice:

"Q.12 I have recently been arrested by the Police. Do I have to report it and will the discipline procedure apply?

In line with the HMRC Code of Conduct, you must inform your manager if you are:

arrested, receive a formal police caution or become the subject of criminal proceedings either on or off duty.

…

are involved in or investigated for any criminal or revenue offences."

51. It is plain that the Claimant was under a contractual obligation to inform HMRC that she had been arrested and of the alleged offences for which she was arrested. The Claimant's allegation is that this requirement breached HMRC's Staff Privacy Statement.
52. The statement relied on is "HR21007 Personal Data: Staff data Privacy Notice" ("the Staff Privacy Notice"). The Particulars of Claim do not specify how the requirement to provide information following an arrest contradicts the Staff Privacy Notice. The Staff Privacy Notice states that HMRC will comply with data protection law. It states:

"THE KIND OF INFORMATION WE HOLD ABOUT YOU

…

We collect, store, and use the following categories of personal information about you.

…

Disciplinary and grievance information.

…

There are "special categories" for more sensitive personal data which require a higher level of protection. We will collect, store and use the following information where necessary to do so;

…

Information about criminal convictions/allegations and offences

…

HOW IS YOUR PERSONAL INFORMATION COLLECTED?

…

We will also collect personal information from third party suppliers where it is proportionate and necessary to do so.

…

HOW WE WILL USE INFORMATION ABOUT YOU.

We will only use your personal information when necessary and in full compliance with data protection legislation.

Most commonly, we will use your personal information in the following circumstances:

Where it is necessary for performing the contract we have entered into with you.

Where we need to comply with a legal obligation.

For official purposes; or in the exercise of a function of the Crown or the official authority of HMRC as a government department.

…

SITUATIONS IN WHICH WE WILL USE YOUR PERSONAL INFORMATION

We need all the categories of information in the list above … to enable us to perform our contract with you; to enable us to comply with legal obligations, to carry out our functions as a government department/functions of the Crown; or where it is necessary to do so in the public interest.

Examples of the situations in which we will process personal information are listed below. …

Gathering evidence and any other steps relating to possible grievance or disciplinary and associated hearings.

Making decisions about your continued employment.

…

Dealing with legal disputes involving you…

Ascertaining your fitness to work, managing sickness absence and keeping in touch during an absence.

…

HOW WE USE PARTICULARLY SENSITIVE PERSONAL INFORMATION

"Special categories" of particularly sensitive information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We will, if necessary, process special categories of personal information in the following circumstances:

Where we need to carry out our legal obligations or exercise our employment-related rights and in line with this privacy policy.

Where it is in line with this data privacy policy, is substantially in the public interest to do so and necessary for:

performing our functions as a Government Department or a function of the Crown

…

… In some circumstances, we will process this type of information where it is needed in relation to legal claims … In limited circumstances we will process sensitive personal information for other purposes as described at Section 6, where we have established that is legal, proportionate and that sufficient protection is in place.

…

DATA SHARING

…

We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you; where HMRC or HMG have a contractual relationship with the third party, where it is in the public interest to do so or where it is necessary for the performance of our functions as a Government Department or a function of the Crown.

This will, in some circumstances, involve sharing special categories of personal data and where relevant, data about criminal convictions/allegations.

…

Once you are no longer an employee … we will retain and securely destroy your personal information in accordance with our data retention policy and applicable laws and regulations."

53. It is readily apparent that the Claimant's contractual obligation to inform HMRC of her arrest, and of the alleged offences for which she was arrested, is consistent with the terms of the Staff Privacy Notice. It is made clear that criminal offence data may be processed in various circumstances, including in the exercise of HMRC's employment-related rights (such as to investigate potential misconduct and undertake disciplinary proceedings) and in the exercise of HMRC's legal obligations (such as to refer recordable conduct matters to the Independent Office for Police Complaints ("the IOPC") under the Revenue and Customs (Complaints and Misconduct) Regulations 2010).
54. In my judgment, paragraph 75(a) of the Particulars of Claim falls to be struck out and summarily dismissed on the ground it has no realistic prospect of success.

POC §75(b) and (h): Suspension

55. The Claimant's second allegation of breach of contract, pleaded at paragraph 75(b) of the Particulars of Claim, is that her suspension was unfair or in breach of HMRC's policies or the Advisory, Conciliation, and Arbitration Service (ACAS)/Employment Tribunal Guidance. In particular, the Claimant submits that:

"i. there was a decision not to ascertain the Claimant's version of events or response to the allegations, prior to the suspension.

ii. No risk assessment was undertaken, of either the risks to the Defendant or the Claimant, of suspending the Claimant (or not).

iii. There was a [sic] no consideration given to alternatives to immediate suspension.

iv. The suspension was not imposed 'as a last resort/only when absolutely necessary'.

v. The suspension letter did not provide a reason for the suspension.

vi. The suspension letter did not explain why the suspension was necessary in order for an investigation to be conducted fairly.

vii. The suspension was not effectively reviewed at each extension.

viii. The suspension was not kept as short as possible.

ix. The suspension implied that the Claimant was dangerous.

x. The suspension implied that the Claimant was guilty of the criminal allegations."

56. Contrary to subparagraph (v), the suspension letter did provide a reason, namely, that "the potential offence is so serious that it is necessary to suspend you from duty with pay with immediate effect pending the outcome of further enquiries." This accords with "HR23004 Discipline: Advice for Employees" which states that whether an employee will be suspended "will depend on the seriousness of your alleged misconduct".
57. Subparagraphs (i) to (iv) and (vi) challenge the initial decision to suspend the Claimant. In my judgment, this challenge has no realistic prospect of success given the very serious nature of the offences for which the Claimant was arrested. There is no sensible basis on which HMRC's decision to commence a disciplinary investigation, and to suspend the Claimant while further inquiries were made, can be challenged.
58. Accordingly, I consider that subparagraphs (i) to (vi) fall to be struck out and summarily dismissed. In addition, subparagraphs (ix) and (x) also fall to be struck out and summarily dismissed on the grounds they have no realistic prospect of success. HR23004 advises employees: "You need to bear in mind that suspension is a precaution and a temporary measure not an assumption of your guilt." Similarly, "HR23012 Discipline: Suspension or removal from normal duties: Duty of care and keeping in touch" advises: "The fact that a member of staff has been suspended from duty does not mean they are considered to be guilty of any offence."
59. However, I am not persuaded that the claim that the Claimant's suspension is unfair and/or in breach of HMRC's policy on the grounds advanced in subparagraphs (vii) and (viii) should be struck out or summarily dismissed. The Claimant has been suspended from her employment since 20 August 2018. Although it is apparent that it has been regularly reviewed, the issues raised by the claim are whether it has been effectively reviewed and whether it has been kept as short as possible. I am not in a position to make any findings on those issues.
60. Mr Mitchell submitted that the suspension has not caused any loss because the Claimant has been suspended on full pay. In HR23012, HMRC recognises that "suspension from duty is likely to have detrimental effects on the suspended employee and their family".
61. The length of the Claimant's suspension has been such that there has been a reorganisation in her absence and so if, when the disciplinary proceedings conclude, the Claimant returns to work with HMRC, it will be to a different role. The Claimant has pleaded this at paragraph 75(h) of the Particulars of Claim which states, "The Defendant informed the Claimant that her job could not be held open for her, on 18 April 2019, because of the 'passage of time'." The letter of 18 April 2019 made clear that a post was available for the Claimant on her return, at her current grade, and the allegation in subparagraph (h) does not itself particularise any breach of contract. Nevertheless, it is of potential relevance in considering the length of the suspension and whether it has caused damage and so I do not consider that subparagraph should be struck out. In addition, damages may potentially be awarded where an unlawful suspension has caused a depressive illness: see Gogay v Hertfordshire County Council [2000] IRLR 703.
62. In my judgment, it is not possible to determine on the evidence before me at this preliminary stage that no part of the Claimant's suspension was unlawful or that the suspension has not caused the Claimant any loss or damage.

POC §75(c) and (e): the disciplinary investigation

63. The Claimant alleges at paragraph 75(c) that the disciplinary investigation is unfair or in breach of HMRC's policies.
64. The Claimant's core contention is that the Civil Service Code does not apply in the context of employees' private lives or, if it does, that this is unlawful. She submits that the offences for which she was arrested were alleged to have taken place outside the workplace and so it was unlawful for HMRC to investigate them.
65. It is clear that the Civil Service Code is not concerned only with conduct in the workplace. The "core values" are "integrity, honesty, objectivity and impartiality". Under the heading "integrity", the Civil Service Code states:

"You must:

fulfil your duties and obligations responsibly

always act in a way that is professional and that deserves and retains the confidence of all those with whom you have dealings

comply with the law and uphold the administration of justice."

66. The passages from "HR22009 Conduct: private conduct" which I have set out in paragraph 48 above demonstrate that conduct outside the workplace may give rise to disciplinary proceedings.
67. The Claimant's contention that it was unlawful for HMRC to investigate allegations of the commission of criminal offences, where those offences were alleged to have taken place outside the workplace is inconsistent with Cooper v National Crime Agency [2019] EWCA Civ 16 and Laverty v Police Service for Northern Ireland [2015] NICA 75 (which was applied by the Court of Appeal in Cooper).
68. In Cooper, an employee of the Serious Organised Crime Agency was dismissed for his conduct while off-duty in a public house. He was prosecuted on charges of assault and being drunk and disorderly, but his conviction by the magistrates' court was quashed on appeal to the Crown Court. Nevertheless, the Court of Appeal dismissed his appeal, finding that the employer's right "to require high standards of conduct of its employees on and off duty" was made clear in its policies and in the employment contract. Similarly, in Laverty a police officer was lawfully dismissed for behaviour, while off duty, in a manner that was likely to bring discredit upon the PSNI.
69. During the hearing, I drew the Claimant's attention to the example of an employee engaging in a racist tirade on Twitter as a scenario where conduct outside the workplace may well shed light on how the employee would engage, in the course of her employment, with a person from an ethnic minority: see R (Pitt) v General Pharmaceutical Council [2017] EWHC 809 (Admin), (2017) 156 BMLR 222, Singh J at [38]. The Claimant acknowledged that such conduct, even though it takes place outside the workplace, would be of legitimate concern to an employer and may be the subject of disciplinary proceedings. However, she contended that in such a scenario there would be conduct to investigate, whereas she submits the allegations against her are false and there is no evidential basis for them. Similarly, she sought to distinguish Cooper and Laverty on the basis that in those cases the employers had evidence of behaviour warranting dismissal whereas she says there is no such evidence in this case.
70. In my judgment, the Claimant's argument is misconceived. The information provided by the Claimant, and then by Merseyside Police, regarding her arrest was such that HMRC had grounds to commence a disciplinary investigation. No question of assessing whether there is evidence on the basis of which disciplinary charges could be laid arises in this claim because no charges have (at least as yet) been formulated.
71. Moreover, the Claimant acknowledged that her use of a car, hired for work purposes (see paragraph 20 above), gave rise to a workplace issue which HMRC was entitled to investigate (albeit she vehemently denies any wrongdoing on her part, giving an explanation which it is unnecessary to address in this judgment). That is clearly right. The Civil Service Code provides that honesty requires, amongst other matters, that civil servants "use resources only for the authorised public purposes for which they are provided". "HR22004 Conduct: care and use of HMRC property and facilities" provides:

"Before you can use an official vehicle or hire a vehicle for official business purposes you must be recognised as an official driver authorised to drive such a vehicle. You must only use official vehicles for business-related journeys."

72. The particulars pleaded in support of the Claimant's contention that the disciplinary investigation is unfair or in breach of policy are:

"i. The Defendant has not yet communicated to the Claimant any act of misconduct warranting dismissal at common law.

ii. This absence of reason leaves the Claimant unable to mount an appropriate defence.

iii. The arrest allegations automatically triggered a disciplinary investigation in contradiction to ACAS guidance.

iv. The Claimant's first opportunity to provide her version of events was during a formal investigatory interview on 20 December 2018.

v. The purpose of the interview appeared to be either to 'prove' the criminal allegations, or to retrospectively identify workplace misconduct.

vi. The investigation had the potential to prejudice any criminal proceedings."

73. In addition, paragraph 75(e) of the Particulars of Claim states:

"The Claimant felt bullied and harassed into disciplinary procedures, particularly with respect to the arrival of two senior civil servants at her doorstep when she was unwell, telling her that the disciplinary procedures would continue without her if she didn't participate."

74. The Claimant alleges that she is unable to defend herself because no disciplinary charges have been laid against her (subparagraphs (i) and (ii)), but this provides no basis for alleging that the disciplinary proceedings are unfair or in breach of HMRC's policy. The point in the process where disciplinary charges are laid (or the disciplinary proceedings are ended without charges being laid) has not been reached. It is premature for the Claimant to allege that she has not had an opportunity to defend herself.
75. I have addressed the Claimant's submission in respect of subparagraph (iii) in paragraphs 64 to 71 above.
76. Subparagraph (iv) provides no realistic basis for contending that the disciplinary investigation is unfair. The Claimant was invited to provide her version of events during an investigatory interview, in accordance with HMRC's procedure. She was given the opportunity, if she preferred, to answer questions in writing. There was nothing to preclude her from explaining her position earlier, if she had wished to do so.
77. Nor is there any merit in subparagraph (v). The interview on 20 December 2018 was an investigatory interview. The investigators therefore asked questions about the alleged offences as well as regarding the car hire matter.
78. As regards subparagraph (vi), any prejudice to criminal proceedings would be a matter to be considered in the context of any such proceedings. In any event, the alleged prejudice is unparticularised.
79. Nor does the hand-delivery of the letter from Mr Angus dated 12 December 2018 by the person the Claimant had asked to be her keeping in touch manager, Ms Whittaker, together with the HR Director, give rise to any basis for alleging a breach of contract. In order to ensure that the Claimant received the letter, and was aware that she was being invited to attend an investigatory interview or provide a written response, it was reasonable to hand-deliver the letter, not least given that the Claimant had declined to open a letter from Ms Whittaker sent a week earlier.
80. In my judgment, paragraphs 75(c) and (e) fall to be struck out and summarily dismissed on the grounds that the allegations have no realistic prospect of success.

POC §75(d), (f), (g) and (i): the Claimant's grievance

81. The remainder of the Claimant's cause of action in breach of contract concerns the grievance which the Claimant raised and is in the following terms:

"(d) The Defendant failed to appropriately respond to the Claimant's 18 November 2018 concerns about the lawfulness of the Defendant's actions, and her requests to raise a Formal Grievance.

…

(f) The Defendant failed to respond promptly and appropriately to her letters of 18 November 18, 25 January 19, 30 January 19 and 03 March 19 with regard to her complaints about breaches of GDPR/DPA.

(g) The Defendant failed to allow the Claimant to meet in person to discuss her complaints.

…

(i) The Claimant failed to investigate the Claimant's Formal Grievance."

82. The conclusion of Mr Graham, who was appointed to investigate the Claimant's grievance, was that only the grievance she raised regarding keeping in touch arrangements was a matter that could be addressed as a grievance in accordance with HMRC's policies. Subparagraph (i) alleges a failure to investigate the Claimant's formal grievance, however, (a) insofar as the matters raised fell within the grievance procedure, they were investigated and resolved; and (b) the Particulars of Claim do not particularise any basis for challenging the conclusion that the matters raised were outside the scope of the grievance procedure.
83. Contrary to subparagraph (g), Ms Whittaker responded to the only matter which fell within the grievance procedure and invited the Claimant's input on whether she wished to discuss it over the telephone or in another way: see paragraph 36 above. In any event, no breach of contract has been particularised.
84. Equally, the allegations in subparagraphs (d) and (f) regarding the timing and content of correspondence do not particularise any breach of contract.

Conclusion on the breach of contract claim

85. For the reasons I have given, the claim for breach of contract is summarily dismissed pursuant to CPR 24.2 and struck out pursuant to CPR 3.4(2)(a), save to the extent that paragraph 75(b)(vii) and (viii) is not struck out or dismissed, and paragraph 75(h) remains insofar as it is relied on in support of the allegations in paragraph 75(b)(vii) and (viii).

G. POC §74: GDPR/DPA

86. At paragraph 74 of the Particulars of Claim, the Claimant alleges that the processing of her personal data from 16 August 2018 onwards was unlawful under the GDPR and the DPA. She has pleaded 20 allegations of breach in subparagraphs (a) to (t).

Controller or processor

87. The Claimant contended that HMRC is a "processor" not a "controller" of the information regarding her arrest. This contention was based on the terms of the letter from Merseyside Police of 3 September 2018. The Claimant contended that Merseyside Police was the controller of the information and HMRC was a processor.
88. The term "controller" includes a "public authority … which, alone or jointly with others, determines the purposes and means of the processing of personal data", whereas a "processor" "processes personal data on behalf of the controller": Art.4 GDPR.
89. In my judgment, it is plain that HMRC has determined the purposes and means of processing the Claimant's personal data. When instituting the disciplinary proceedings, suspending the Claimant, handling her grievances and responding to her complaint to the ICO and this claim, HMRC, as the Claimant's employer, has processed her personal data on its own behalf, not on behalf of Merseyside Police (or anyone else). This accords with the letter from Merseyside Police which stated: "It is a matter for you to determine what action, if any, is necessary in order to mitigate any risks that are evident to you as a result of this disclosure". The suspension and disciplinary investigation were matters for HMRC, not Merseyside Police.
90. As HMRC acknowledges, it was a controller of the Claimant's personal data regarding her arrest. This accords with HMRC's stated position in the Staff Privacy Notice. I also note that many of the Claimant's allegations of breach of the GDPR are premised on HMRC being a controller of her personal data.

§74(a) POC: criminal offence data

91. The Claimant alleges at paragraph 74(a) of the Particulars of Claim that:

"The failure of the Defendant to acknowledge that the Claimant's arrest information was a special category of personal data (criminal offence data) was in breach of GDPR Art 10 and DPA 2018 [s.] 11(2)."

92. Article 10 of the GDPR provides:

"Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority."

93. Section 11(2) of the DPA provides:

"In Article 10 of the GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to –

(a) the alleged commission of offences by the data subject, or

(b) proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing."

94. The information which the Claimant provided to HMRC, and the further information which Merseyside Police provided on 3 September 2018, regarding her arrest ("the Claimant's arrest information") is personal data relating to the alleged commission of offences by the Claimant, who is the data subject. That is clear from the terms of s.11(2) of the DPA.
95. HMRC, rightly, does not dispute that the Claimant's arrest information is criminal offence data within the meaning of Art.10 and s.11(2).
96. The allegation in paragraph 74(a) of the Particulars of Claim is one of "failure … to acknowledge" that the data is criminal offence data. No particulars are given of when HMRC is alleged to have failed to give this acknowledgment or how such a lack of acknowledgment would itself breach Art.10 or s.11(2).
97. Article 10 of the GDPR prohibits the processing of criminal offence data other than under the control of official authority or as authorised by EU or Member State law (which must provide appropriate safeguards). Provision is also made regarding a register of criminal convictions which is irrelevant to this claim. Article 10 does not create a discrete obligation to "acknowledge" that particular data is criminal offence data. Section 11(2) clarifies the scope of what is covered by Art. 10 of the GDPR and s.10 of the DPA. Again, it does not create a separate obligation to acknowledge that data is criminal offence data.
98. I accept HMRC's contention that this allegation should be struck out and summarily dismissed on the basis it founds no cause of action and it is unparticularised.

POC §74(i): lawful basis for processing for the purposes of suspension and disciplinary proceedings

99. I shall address next the allegation at paragraph 74(i) of the Particulars of Claim as it lies at the heart of the claim that there was no lawful basis for processing for the purposes of suspending the Claimant or instituting disciplinary proceedings. The subparagraph states:

"(i) The use of the Claimant's personal data to suspend her and initiate disciplinary proceedings against her, was in breach of Art 5."

100. Article 5 of the GDPR specifies the principles in accordance with which personal data shall be processed:

i) Article 5(1)(a) provides that personal data shall be "processed lawfully, fairly and in a transparent manner in relation to individuals". In order to meet this lawfulness requirement, the processing must pass through one of the Art. 6 gateways. In addition, to be lawful, processing of criminal offence data must meet the requirements of Art. 10. Although the Claimant's personal data includes special category information within the meaning of Art. 9, she has chosen not to rely on Art. 9 and so I have not addressed that provision. The transparency requirement encompasses the obligations in Articles 13 and 14.

ii) Article 5(1)(b) imposes a purpose limitation: personal data shall be "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes."

iii) Article 5(1)(c) establishes the data minimisation principle: personal data shall be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed".

iv) Article 5(1)(d) concerns accuracy: personal data shall be "accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay".

v) Article 5(1)(e) contains the storage limitation principle: in essence, personal data should be kept for no longer than necessary for the purposes for which they are processed.

vi) Article 5(1)(f), is concerned with security: personal data shall be "processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures". The key provision in respect of security of processing is Art. 32.

101. The focus of this aspect of the Claimant's claim is her allegation that the lawfulness requirement was not met in using her personal data to suspend her and to commence the disciplinary investigation.
102. In order to meet the lawfulness requirement in Art. 5(1)(a) of the GDPR processing must pass through one of the Art. 6 gateways. In addition, to be lawful, processing of criminal offence data must meet the requirements of Art. 10, as supplemented by s.10 of the DPA.
103. Article 6 provides, so far as relevant:

"1. Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

…

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

…

2. Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.

3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

(a) Union law; or

(b) Member State law to which the controller is subject.

…"

104. I have set out Art. 10 of the GDPR in paragraph 92 above. Article 10 is supplemented by s.10 of the DPA which provides:

"… (4) Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

(5) The processing meets the requirements in Article 10 of the GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1."

105. Part 1 of Schedule 1 ("conditions relating to employment, health and research etc") contains (amongst others) the following condition:

"1 Employment, social security and social protection

(1) This condition is met if –

(a) the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection, and

(b) when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule)." (Emphasis added.)

106. Part 2 of Schedule 1 ("substantial public interest conditions") contains (amongst others) the following conditions:

"6 Statutory etc and government purposes

(1) This condition is met if the processing

(a) is necessary for a purpose listed in sub-paragraph (2), and

(b) is necessary for reasons of substantial public interest.

(2) Those purposes are –

(a) the exercise of a function conferred on a person by an enactment or rule of law;

(b) the exercise of a function of the Crown, a Minister of the Crown or a government department.

…

12 Regulatory requirements relating to unlawful acts and dishonesty etc

(1) This condition is met if –

(a) the processing is necessary for the purposes of complying with, or assisting other persons to comply with, a regulatory requirement which involves a person taking steps to establish whether another person has -

(i) committed an unlawful act, or

(ii) been involved in dishonesty, malpractice or other seriously improper conduct,

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing, and

(c) the processing is necessary for reasons of substantial public interest.

(2) In this paragraph –

"act" includes a failure to act;

"regulatory requirement" means –

(a) a requirement imposed by legislation or by a person in exercise of a function conferred by legislation, or

(b) a requirement forming part of generally accepted principles of good practice relating to a type of body or an activity." (Emphasis added.)

107. Part 3 of Schedule 1 ("additional conditions relating to criminal convictions etc") contains (amongst others) the following condition:

"33 Legal claims

This condition is met if the processing –

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights."

108. Part 4 of Schedule 1 ("appropriate policy document and additional safeguards") provides, so far as relevant:

"38 Application of this Part of this Schedule

This Part of this Schedule makes provision about the processing of personal data carried out in reliance on a condition in Part 1, 2 or 3 of this Schedule which requires the controller to have an appropriate policy document in place when the processing is carried out.

39 Requirement to have an appropriate policy document in place

The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38 if the controller has produced a document which –

(a) explains the controller's procedures for securing compliance with the principles in Article 5 of the GDPR (principles relating to processing of personal data) in connection with the processing of personal data in relation on the condition in question, and

(b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the condition, giving an indication of how long such personal data is likely to be retained."

109. I have addressed the Claimant's core contention that HMRC could not lawfully investigate conduct that was alleged to have taken place outside the workplace in paragraphs 64 to 70 above.
110. It follows, in my judgment, that there is no realistic prospect of the Claimant succeeding in her claim that using her personal data for the purposes of disciplinary proceedings (including the decision to suspend her) was unlawful for the purposes of the GDPR:

i) It met the requirements of Art. 6 in that it was necessary for the performance of the employment contract to which the Claimant is a party: see Art. 6(1)(b) (paragraph 103 above); and

ii) It met the requirements of Art. 10 in that:

a) the processing was necessary for the purpose of HMRC exercising rights conferred on it by law (i.e. by the Claimant's contract of employment) in connection with the Claimant's employment by HMRC: see s.10(5) of, and paragraph 1 of Schedule 1 to, the DPA (paragraphs 104 to 105 above); and

b) HMRC had an appropriate policy document in place: see paragraph 105 above and paragraph 115 below.

111. Accordingly, paragraph 74(i) of the Particulars of Claim falls to be struck out and summarily dismissed. It is unnecessary to determine whether the processing also met any of the other grounds relied on by HMRC.

POC §74(b) and (e): appropriate policy document

112. The allegations at subparagraphs (b) and (e) of paragraph 74 of the Particulars of Claim, insofar as they go beyond the allegation that the processing lacked a lawful basis (which I have addressed above), relate to the contention that HMRC did not have an "appropriate policy document" in place. These subparagraphs provide:

"(b) The failure to establish a lawful basis for processing the Claimant's criminal offence data, before processing began was in breach of GDPR Art. 5.

…

(e) The failure to establish the structural policy, security, and communications requirements for the processing of criminal offence data, before processing began was in breach of GDPR Art 5 & 6, 10, and DPA s.10 and Sch 1 Part 4."

113. I have set out the relevant parts of Articles 5, 6 and 10 and s.10 of and Schedule 1 to the DPA above.
114. Insofar as HMRC was processing criminal offence data and the condition relied on to render the processing lawful for the purposes of Art. 10 is paragraph 1 of Schedule 1 to the DPA, HMRC had to have an "appropriate policy document" in place.
115. HMRC had in place, and made available to the Claimant, the Staff Privacy Notice. I have set out the most relevant passages of the Staff Privacy Notice in paragraph 52 above. I note that the ICO did not perceive any deficiencies in the Staff Privacy Notice (see paragraph 38.iv) above) and the Claimant has not drawn attention to any arguable basis for contending that it did not meet the requirements of paragraph 39 of Schedule 1 to the DPA (paragraph 108 above). In my judgment, having regard to the terms and availability of the Staff Privacy Notice, there is no realistic prospect of the Claimant establishing at trial that HMRC failed to comply with the requirement to have in place an appropriate policy document.
116. Subparagraphs (b) and (e) of paragraph 74 of the Particulars of Claim therefore fall to be struck out and summarily dismissed.

POC §74(c): sharing of the Claimant's personal data within HMRC

117. The allegation at paragraph 74(c) of the Particulars of Claim is:

"(c) The sharing of the Claimant's personal data between Darren Warren and Internal Governance (IG), within IG, and throughout HMRC (e.g. HR, Press Office, Permanent Secretaries) was in breach of GDPR Art 5."

118. I have already rejected the contention that there is any realistic prospect of the Claimant establishing that the processing of her personal data for the purposes of the disciplinary investigation breached Art. 5. It follows that the claim that sharing her personal data between Human Resources, Internal Governance (whose role it was to undertake the disciplinary investigation) and Mr Warren (the Claimant's line manager), lacks any merit. No claim that the Claimant's personal data was shared inappropriately within Human Resources or Internal Governance has been particularised.
119. The nature of the offences for which the Claimant was arrested was such that there was a clear business reason to brief HMRC's press office in order to ensure that if the allegations against the Claimant entered the public domain the press office would be ready to respond, if necessary. The need for HMRC's press office to be briefed was heightened by the press interest in a separate claim that the Claimant brought against a different government department. The Claimant's concern regarding the sharing of her personal data with HMRC's press office appears to reflect a view that this was tantamount to disclosing it to the press, whereas that is plainly not the case. The Claimant has not particularised any claim that her personal data has been put in the public domain by HMRC and I have not seen any evidence to support such a contention.
120. The Claimant's complaint that her personal data was shared with the Permanent Secretaries arises from the following correspondence:

i) On 1 May 2019, the Claimant sent an email to the Permanent Secretary to HMRC, Sir Jonathan Thompson, and the Second Permanent Secretary and Deputy Chief Executive of HMRC, Sir Jim Harra. She informed them that she was suspended and facing disciplinary procedures which she believed to be based on unlawful processing of her personal data. She informed them that she had referred her case to the ICO and that if HMRC failed to restrict her processing she would apply to the High Court for an injunction. She stated that she was informing them because "I realise even an erroneous allegation of breaches of Personal Data could seriously impact the organisation's reputation".

ii) Sir Jonathan responded to the Claimant's email on 13 May 2019:

"I have been in contact with Internal Governance (IG) who have advised me that the potential internal disciplinary procedures are associated with an ongoing criminal investigation by Merseyside Police and as such I am unable to comment fully on the circumstances of the case."

121. In circumstances where the Claimant chose to write to the Permanent Secretary and Second Permanent Secretary about the ongoing disciplinary proceedings, there is no sensible basis for the contention that it was unlawful to share the Claimant's personal data with them. In order to respond to the Claimant's correspondence, they necessarily had to make internal inquiries.
122. The contention that the internal sharing of the Claimant's personal data has breached Art. 5 has no realistic prospect of success and so paragraph 74(c) of the Particulars of Claim will be struck out and summarily dismissed.

POC §74(d): letter to the Independent Office for Police Conduct

123. On 3 September 2018, HMRC made a referral of the Claimant's conduct to the IOPC. The Claimant alleges at paragraph 74(d) of the Particulars of Claim that this sharing of her personal data with the IOPC was in breach of Art. 5 of the GDPR. She submits that the disclosure of her personal data to the IOPC did not comply with the requirement of lawfulness in the GDPR.
124. I have addressed the statutory basis for the referral to the IOPC in paragraphs 197 to 216 below. For the reasons that I have given in that section of this judgment, I have found that HMRC was required, under the Revenue and Customs (Complaints and Misconduct) Regulations, to refer the conduct matter to the IOPC.
125. It follows that there is no realistic prospect of the Claimant succeeding in her claim that the sharing of her personal data with the IOPC was unlawful for the purposes of the GDPR:

i) It met the requirements of Art. 6 (see paragraph 103 above) in that:

a) it was necessary for compliance with a legal obligation to which HMRC is subject: see Art. 6(1)(c); and/or

b) it was necessary for the performance of a task carried out in the public interest: see Art.6(1)(e).

ii) And it was necessary for reasons of substantial public interest and necessary in the exercise of a function conferred on HMRC by an enactment, in accordance with s.10(5) of, and paragraph 6 of Schedule 1 to, the DPA (see paragraph 104 above), and so met the requirements of Art. 10.

126. Paragraph 74(d) of the Particulars of Claim falls to be struck out and the claim therein summarily dismissed as it has no realistic prospect of success.

POC §74(f): requirement to provide arrest information

127. Paragraph 74(f) of the Particulars of Claim states:

"The contractual requirement for the Claimant to provide arrest information, and information ancillary to the arrests on 16 and 20 August, in early September 2018 (each to Darren Warren), and 20 December 2018 (to Neil Angus and the second investigator) was in breach of GDPR Art 5 and 7(4), and possibly in breach of DPA 2018 s.184."

128. Article 5 of the GDPR specifies the principles in accordance with which personal data shall be processed: see paragraph 100 above. The Claimant's submissions focus on the lawfulness requirement.
129. I have addressed the contractual obligation by which the Claimant was bound to provide information to HMRC regarding her arrest, and the offences for which she was arrested, in paragraphs 46 to 54 above; and I have addressed the Claimant's core contention that HMRC could not lawfully investigate conduct that was alleged to have taken place outside the workplace in paragraphs 64 to 70 above.
130. It follows that there is no realistic prospect of the Claimant succeeding in her claim that the processing of her personal data by receiving arrest information from her was unlawful for the purposes of the GDPR:

i) It met the requirements of Art. 6 in that it was necessary for the performance of the employment contract to which the Claimant is a party: see Art. 6(1)(b) (paragraph 103 above); and

ii) It met the requirements of Art. 10 in that:

a) the processing was necessary for the purposes of the Claimant performing obligations, and HMRC exercising rights, respectively imposed and conferred on them by law (i.e. by the Claimant's contract of employment) in connection with the Claimant's employment by HMRC: see s.10(5) of, and Part 1 of Schedule 1 to, the DPA (paragraphs 104 to 105 above); and

b) HMRC had an appropriate policy document in place: see paragraphs 105 and 115 above.

131. Article 7 of the GDPR ("conditions for consent") provides:

"1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.

…

4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

132. The Claimant's reliance on Art. 7(4) is misplaced. HMRC's processing of the Claimant's personal data is not based on consent. HMRC has not sought to establish that the processing was lawful pursuant to the consent provision in Art. 6(a) or, in respect of Art. 10, the consent provision contained in paragraph 29 of Schedule 1 to the DPA.
133. Section 184 of the DPA creates a criminal offence, not a civil cause of action. Moreover, it concerns the obtaining of a "relevant record", as defined in Schedule 18 to the DPA, which is of no relevance in this case because the Claimant does not have a "relevant record relating to a conviction or caution": see further paragraphs 178 to 193 below.
134. Accordingly, the claim pleaded in paragraph 74(f) of the Particulars of Claim has no realistic prospect of success and it falls to be struck out and summarily dismissed.

POC §74(g): Staff Privacy Notice

135. The Claimant alleges at paragraph 74(g) of the Particulars of Claim that HMRC breached Art. 12(1) of the GDPR by failing to provide her "with a clear and transparent staff Privacy Statement before, or at the point of the first data collection".
136. For the reasons I have given above, having regard to the terms of the Staff Privacy Notice which was available to the Claimant on the staff intranet prior to 16 August 2018, there is no realistic prospect of the Claimant establishing the alleged breach. This subparagraph, too, falls to be struck out and summarily dismissed.

POC §74(h) and (j)

137. The Claimant makes the following allegations at paragraph 74(h) and (j) of the Particulars of Claim:

"(h) The failure to provide the Claimant with the required information about the use of her personal data provided by her, at the point of each data collection was in breach of GDPR Art 13.

…

(j) The failure to provide the Claimant with detailed information about the access to, and use of her personal data, acquired by the Defendant from Merseyside Police, on at least two occasions, once before the early September telephone call with Darren Warren, and again prior to the 20 December 2018 disciplinary investigation interview, was in breach of GDPR Art 14."

138. Article 13 of the GDPR specifies information to be provided where personal data are collected from the data subject. Article 13(4) provides:

"Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information."

139. Article 14 of the GDPR specifies information to be provided where personal data have not been obtained from the data subject. Article 14(5) provides:

"Paragraphs 1 to 4 shall not apply where and insofar as:

(a) the data subject already has the information;"

140. The Claimant has not particularised any information which HMRC was required to provide pursuant to Articles 13 and 14 which it had not already provided to the Claimant in the Staff Privacy Notice, as well as in HMRC's disciplinary policies and procedures and the data retention policy.
141. The particulars in subparagraphs (h) and (j) have no realistic prospect of success and so they fall to be struck out and summarily dismissed.

POC §74(k): security

142. The Claimant alleges, at paragraph 74(k) of the Particulars of Claim, that HMRC failed "to securely process the Claimant's personal data, particularly with respect to the 04 September 2018 letter from Sean Whellams", in breach of Art. 32 of the GDPR.
143. Article 32 of the GDPR provides:

"1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement technical and organisational measures to ensure a level of security appropriate to the risk...

2. In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed."

144. The letter of 4 September 2018 from Sean Whellams to the Claimant, notifying her of the investigation, was sent by Recorded Delivery, which had the effect that its delivery was tracked, and it needed to be signed for on delivery. It was sent to the Claimant's last recorded address and, before it was sent, the Claimant's line manager contacted her to explain how the correspondence would be sent. The Claimant was not present to sign for it when delivery was first attempted so the letter was held at the Post Office for her to collect, which she did about a week later.
145. In accordance with the disciplinary procedure and policies, HMRC had to send the letter notifying the Claimant of the matters which it was investigating. There is no basis for the contention that the use of the Recorded Delivery service to send this letter failed to provide an appropriate level of security, contrary to Art. 32 of the GDPR. And the Claimant has not particularised any other breach of Art. 32.
146. Nor is there any alleged loss given that sending the letter by Recorded Delivery did not, in fact, result in any accidental loss or inadvertent disclosure of the Claimant's personal data.
147. The claim at paragraph 74(k) of the Particulars of Claim therefore falls to be summarily dismissed and that paragraph is struck out on the ground the claim has no realistic prospect of success.

POC 74(l)-(q): Response to 18 November 2018 letter

148. The Claimant has alleged that HMRC's response to the letter she sent to Mr Whellams on 18 November 2018 breached Articles 12, 13, 15, 18 and 21:

"(l) The failure of the Defendant, upon receipt of the Claimant's 18 November 2018 letter to Sean Whellams attempting to exercise her GDPR Art 15 and Art 21 Right, to facilitate the exercise of these rights, was in breach of GDPR Art 12, Part 2.

(m) The failure of the Defendant to respond to the Claimant's 18 November 2018 letter within one month was in breach of GDPR Art 12, Part 3.

(n) The failure of the Defendant to identify the lawful basis for the processing of the Claimant's personal data in response to her 18 November 2018 letter was in breach of GDPR Art 13.

(o) The failure of the Defendant to provide information on the use of the Claimant's personal data, as requested in her 18 November 2018 letter, was in breach of GDPR Art 15.

(p) The failure of the Defendant to allow the Claimant to object to the processing of her personal data, in her 18 November 2018 letter, was in breach of GDPR Art 21.

(q) The failure of the Defendant to restrict the processing of the Claimant's personal data as requested in her 18 November 2018 letter was in breach of GDPR Art 18."

149. Article 13 of the GDPR provides for certain information to be provided where personal data are collected from the data subject, save that Art. 13(4) provides that Art. 13(1), (2) and (3) shall not apply where and insofar as the data subject already has the information. For the reasons I have given in paragraphs 138 and 140 above, the Staff Privacy Notice and HMRC's procedures and policies clearly met the requirements of Art. 13 and so paragraph 74(n) also falls to be struck out and summarily dismissed.
150. Article 15 of the GDPR provides the data subject with a right, upon request,

"to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing;

…

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, ...

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determinate that period;

…"

151. Article 18(1) of the GDPR provides:

"1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

(c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;

(d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject."

152. Article 21(1) of the GDPR provides:

"1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which overrides the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims."

153. Article 12(1) of the GDPR requires the controller to facilitate the exercise of the rights under Articles 15 to 22. In accordance with Art. 12(3), where a data subject makes a subject access request pursuant to Art. 15, or a request to restrict processing pursuant to Art. 18 or objects to processing pursuant to Art. 21, the controller must provide information on the action taken in response within one month of receipt of the request (subject to the provision in Art. 12(3) for an extension).
154. The primary request in the Claimant's letter of 18 November 2018 to Mr Whellams was for the suspension and the disciplinary investigation "to be halted". The Claimant's reference to the GDPR is in the following terms:

"I also believe the investigation as proposed may breach General Data Protection Regulations (GDPR), and as a result, I would like you to cease distributing highly sensitive personal information about me via email or any other means, either to me or to anyone else. I would also like you to please record:

1. Why this information was committed to writing in the first place, and by whom;

2. With whom this information has been shared, in writing, or by any other means and why;

3. What instructions were provided to each and every recipient regarding the use of this information,

4. With whom any recipients have further shared this information, either in writing or by any other means, and why, and

5. Details about how each and every recipient has stored this information, and how long they intend to keep it and why."

155. HMRC contends that the Claimant's letter of 18 November 2018 "was not a subject access request (Art 15) or notice of objection (Art 21)", or a request to restrict processing (Art 18).
156. Although the Claimant asked HMRC to cease distributing "highly personal information" (which is a form of processing), she did not state that she was making a request pursuant to Art. 18 of the GDPR or, more importantly, specify any of the grounds (a) to (d) on the basis of which she sought to restrict the processing of her personal data. In particular, she did not allege in her letter that the processing was unlawful or that the personal data was inaccurate.
157. Nor did the Claimant state that she was making a request pursuant to Art. 21 or, more importantly, refer to any "grounds relating to … her particular situation" why she objected to any processing by HMRC based on Art. 6(1)(e) or (f). Moreover, insofar as HMRC was processing the Claimant's personal data for the purposes of the disciplinary investigation, it was doing so pursuant to Art. 6(1)(b) (not Art.6(1)(e) or (f) which are the relevant bases for the purposes of an objection pursuant to Art.21). Article 6(1)(e) provides an additional basis for the disclosure to the IOPC which was made on 3 September 2018, but such disclosure was not ongoing, and it was, in any event, lawful pursuant to Art. 6(1)(c) (giving no basis for objection pursuant to Art.21). (The Claimant has made clear in these proceedings that she does not challenge the subsequent disclosures made to Merseyside Policy.)
158. In my judgment, paragraphs 74 (p) and (q) have no realistic prospect of success because the Claimant did not even arguably invoke any right pursuant to Art. 18 or Art. 21 of the GDPR.
159. As regards Art. 15, the Claimant did not make - and does not contend that she made - a subject access request (i.e. she was not seeking access to her personal data). But the information that may be requested pursuant to Art. 15 goes beyond the personal data which is held. Although the Claimant did not expressly refer to Art. 15 of the GDPR, it is reasonably arguable that her requests 1 to 5 (see paragraph 154 above) were for information falling within Art. 15(1)(a), (c) and (d).
160. As detailed in paragraph 29 above, Mr Whellams provided a substantive response on 7 January 2019. Accordingly, HMRC has complied with Art. 15 and paragraphs 74(l) and (o) also have no realistic prospect of success.
161. Given my conclusion that it is reasonably arguable that the Claimant invoked Art. 15, and given that timing of Mr Whellams' response does not appear to have complied with the primary time limit in Art. 12(3) (and there is no evidence before me that an extension was sought), paragraph 74(m) of the Particulars of Claim does not fall to be struck out or summarily dismissed.

POC 74(r)-(t): Other correspondence

162. The final allegations of breach of the GDPR, pleaded at paragraph 74(r) to (t) of the Particulars of Claim are:

(r) There were further breaches of the GDPR/DPA with respect to the Claimant's 25 January 2019 letter to Neil Angus, attempting to exercise her GDPR Art 15 and Art 21 Rights, including, but not limited to (l) to (q) above.

(s) There were further breaches of GDPR/DPA with respect to the Claimant's 30 January 2019 letter to Sean Whellams, attempting to exercise her GDPR Art 15 and Art 21 Rights, including, but not limited to (l) to (q) above.

(t) There were further breaches of GDPR/DPA with respect to the Claimant's 03 March 2019 letter to Jane Whittaker, attempting to exercise her GDPR Art 15 and Art 21 Rights, including, but not limited to (l) to (q) above."

163. In the letters referred to in the subparagraphs, the Claimant alleged that there was no lawful basis for processing her personal data and she sought to stop the investigation. In response to the first of these letters, on 25 January 2019 Mr Angus suspended the investigation until he received advice confirming that continuing the investigation accorded with the GDPR.
164. The investigation, and processing for the purpose of the investigation, had already been suspended when the Claimant wrote to Mr Whellams on 30 January 2019 and to Ms Whittaker on 3 March 2019. The investigation, and processing of the Claimant's personal data for the purpose of the investigation, only resumed when Mr Angus wrote to the Claimant on 24 April 2019, following the receipt of legal advice.
165. For the reasons I have given above, the Claimant's contention that HMRC did not have a lawful basis for processing her personal for the purpose of disciplinary proceedings, and for the referral to the IOPC, has no realistic prospect of success.
166. The Claimant has no basis for contending that HMRC should have restricted processing her personal data (pursuant to Art 18). The only ground she raised was that the processing was unlawful, whereas I have found that HMRC clearly had a lawful basis for processing her personal data.
167. Equally, the Claimant has no basis for contending that HMRC should have acceded to her objection pursuant to Art. 21. The Claimant had no right to object in circumstances where the processing was lawful pursuant to Art. 6(1)(b) and (c).

Conclusion on the data protection claim

168. The data protection claim pleaded at paragraph 74 of the Particulars of Claim falls to be struck out pursuant to CPR 3.4(2)(a) and summarily dismissed pursuant to CPR 24.2, save to the extent that the allegation of breach of the time limit in paragraph 74(m) of the Particulars of Claim stands.

H. POC §77: Human Rights Act 1998 and European Convention on Human Rights

169. The Claimant alleges breaches of Articles 3, 6, 8 and 10 of the European Convention on Human Rights (ECHR), and of Art. 14 taken together with each of those Articles. These allegations are pleaded in paragraph 77 of the Particulars of Claim.
170. I agree with HMRC's submission that the Claimant's reliance on Art. 3 of the ECHR, which provides that "No one shall be subjected to torture or to inhuman or degrading treatment or punishment", is misconceived. The particulars pleaded by the Claimant at (a) to (j) of paragraph 77 of the Particulars of Claim do not come close to reaching the threshold of treatment that arguably breaches Art. 3.
171. Article 6(1) of the ECHR provides:

"In the determination of his civil rights and obligations or of any criminal charge against him, everyone is entitled to a fair and public hearing within a reasonable time by an independent and impartial tribunal established by law."

172. Insofar as the Claimant contends that the fairness of any potential criminal proceedings has been breached, the claim is misconceived. The fairness of any criminal proceedings is a matter that could only be determined in the context of those proceedings. The alleged possibility that HMRC's actions may render potential criminal proceedings unfair provides no basis for bringing an Art. 6 claim against HMRC.
173. Reliance on Art. 6 to challenge HMRC's internal disciplinary investigation is also misplaced. Any disciplinary sanction which HMRC might impose at the close of the investigation and any disciplinary hearing would not amount to a determination of any civil right.
174. The claim based on Art. 8 of the ECHR also has no realistic prospect of success:

i) The Claimant challenges the requirement to provide information regarding her arrest, alleging that this requirement breached her right to privacy in Art. 8 or alternatively was a breach of her common law right to confidence or a misuse of private information: POC §77(k). I have found that this requirement accorded with the Claimant's contract, HMRC's policies and procedures, and there is no realistic prospect of the Claimant establishing that it did not comply with the requirements of the GDPR and the DPA. In these circumstances, there is no sensible basis on which it could be contended that the requirement breached Art. 8. Nor has the Claimant put forward any basis for alleging that requiring her to provide such information amount to a breach of confidence or a misuse of private information.

ii) In circumstances where the Claimant does not challenge Merseyside Police's provision of information regarding her arrest to the HMRC, it cannot sensibly be contended that HMRC breached the Claimant's Art. 8 rights (or acted in breach of confidence or committed a misuse of private information) by "accessing" the very information which Merseyside Police lawfully provided to it (POC §77(l)).

iii) I have addressed the Claimant's allegations regarding the sharing of her personal data in the context of her data protection claim and regarding the institution of a disciplinary investigation based on her personal data. In circumstances where the disciplinary investigation and such sharing clearly met the requirements of the data protection legislation, the claim at paragraph 77(m) and (n) has no realistic prospect of success.

iv) As regards paragraph 77(o) and (p), the Claimant was invited to attend a disciplinary investigation. It was open to her to choose not to attend if she wished. She was given the option of providing any responses to Mr Angus's questions in writing if she preferred to do so. The Claimant was informed in the letter of 12 December 2018 by which she was invited to attend the interview that "In line with Internal Governance normal procedures, the interview will be digitally recorded to provide an accurate record of all that is said. The transcript of interview, which will form part of my overall investigation report, will be made available to you". It was reiterated at the outset of the interview that it would be recorded and transcribed. The contention that recording and transcribing the interview, or sharing it within the context of the disciplinary investigation, breached the Claimant's Art. 8 rights or constituted a breach of confidence or misuse of private information has no foundation.

v) The Claimant had a responsibility, in accordance with HMRC's policies and procedures, to inform HMRC while she was suspended of any change to her contact details and of any change of address. The claim that these requirements breached the Claimant's Art. 8 right to privacy or constituted a breach of confidence or misuse of private information has no realistic prospect of success.

175. The Claimant's reliance on Art. 10 of the ECHR is also misconceived. The confidentiality of the disciplinary proceedings was in the Claimant's interests. The Claimant was not prohibited from communicating with her colleagues. She could exercise her right to freedom of expression and inform her colleagues of the reason for her absence, but her claim is premised on the fact that she did not wish this information to be shared at all. The fact that she has not been able to undertake training or take up development opportunities does not provide an arguable basis for contending HMRC has breached her Art. 10 rights.
176. Finally, the Claimant contends that she has been subjected to discriminatory treatment "compared with other staff about whom allegations are known, but which are of a less prejudicial nature" (POC §77(x)). This discriminatory treatment is alleged to be "enhanced by virtue of her gender" (POC §77(y)). The allegation of breach of Art. 14 is wholly unparticularised.

Conclusion in respect of HRA claim/misuse of private information/breach of confidence

177. The claims pleaded at paragraph 77 of the Particulars of Claim have no realistic prospect of success and so fall to be struck out in their entirety pursuant to CPR 3.4(2)(a) and summarily dismissed pursuant to CPR 24.2.

I. POC §73: "Rehabilitation of Offenders Act 1974 etc"

178. The Particulars of Claim allege at paragraph 73(a) and (b) that the obligation imposed on the Claimant by her employment contract

i) to disclose to HMRC that she had been arrested by Merseyside Police on 15 August 2018; and

ii) to disclose to HMRC "arrest information, and information ancillary to the arrest" (i.e. the requirement to provide information to HMRC on 15 August 2018, 17 August 2018, at the disciplinary interview on 20 December 2018 and in follow up questions provided in writing, regarding the basis for and circumstances of the arrest),

was in breach of s.4(3)(a) and s.9 of the Rehabilitation of Offenders Act 1974 ("the ROA").

179. The Particulars of Claim also allege at paragraph 73(e) and (f) that:

i) The use of the arrest information and information ancillary thereto to suspend the Claimant and subject her to disciplinary proceedings was a breach of s.4(3)(b) of the ROA; and

ii) The disclosure of "specified information pertaining to the official record of the Claimant, by the Defendant to any other person may be in breach" of s.9 of the ROA.

180. Section 4(3)(a) provides:

"Subject to the provisions of any order made under subsection (4) below,

(a) any obligation imposed on any person by any rule of law or by the provisions of any agreement or arrangement to disclose any matters to any other person shall not extend to requiring him to disclose a spent conviction or any circumstances ancillary to a spent conviction (whether the conviction is his own or another's);…" (emphasis added)

181. Section 4(5) on which the Claimant also relies provides:

"For the purposes of this section and section 7 below any of the following are circumstances ancillary to a conviction, that is to say

(a) the offence or offences which were the subject of that conviction;

(b) the conduct constituting that offence or those offences; and

(c) any process or proceedings preliminary to that conviction, any sentence imposed in respect of that conviction, any proceedings (whether by way of appeal or otherwise) for reviewing that conviction or any such sentence, and anything done in pursuance of or undergone in compliance with any such sentence." (emphasis added)

182. Section 9 of the Rehabilitation of Offenders Act 1974 provides:

"(1) In this section—

"official record" means a record kept for the purposes of its functions by any court, police force, Government department, local or other public authority in Great Britain, or a record kept, in Great Britain or elsewhere, for the purposes of any of Her Majesty's forces, being in either case a record containing information about persons convicted of offences; and

"specified information" means information imputing that a named or-otherwise identifiable rehabilitated living person has committed or been charged with or prosecuted for or convicted of or sentenced for any offence which is the subject of a spent conviction.

(2) Subject to the provisions of any order made under subsection (5) below, any person who, in the course of his official duties, has or at any time has had custody of or access to any official record or the information contained therein, shall be guilty of an offence if, knowing or having reasonable cause to suspect that any specified information he has obtained in the course of those duties is specified information, he discloses it, otherwise than in the course of those duties, to another person." (emphasis added)

183. HMRC draws attention to s.1(1) of the ROA which provides:

"Subject to subsections (2), (5) and (6) below, where an individual has been convicted, whether before or after the commencement of this Act, of any offence or offences, and the following conditions are satisfied, that is to say—

(a) he did not have imposed on him in respect of that conviction a sentence which is excluded from rehabilitation under this Act; and

(b) he has not had imposed on him in respect of a subsequent conviction during the rehabilitation period applicable to the first-mentioned conviction in accordance with section 6 below a sentence which is excluded from rehabilitation under this Act;

then, after the end of the rehabilitation period so applicable (including, where appropriate, any extension under section 6(4) below of the period originally applicable to the first-mentioned conviction) or, where that rehabilitation period ended before the commencement of this Act, after the commencement of this Act, that individual shall for the purposes of this Act be treated as a rehabilitated person in respect of the first-mentioned conviction and that conviction shall for those purposes be treated as spent." (emphasis added)

184. It is clear that a "rehabilitated person" is a person who has been convicted of an offence, where a specified period of time ("the rehabilitation period") has passed since that person was convicted of that offence: s.1(1). Subject to the specified conditions being satisfied, once the rehabilitation period has ended, the conviction is "spent", and the convicted person becomes a "rehabilitated person": s.1(1). Section 5(2) makes clear that the rehabilitation period is determined by reference to the length of the sentence imposed for the offence and the age of the offender at the date of the conviction, and it begins with the date of the conviction for that offence.
185. The Claimant has never been convicted of any offence. Indeed, she has never even been charged with an offence. She has no convictions and so, plainly, she has no "spent" convictions. She is not a "rehabilitated person" within the meaning of s.1. In requiring her to disclose that she had been arrested, and the reasons for and circumstances surrounding her arrest, HMRC has not required the Claimant to disclose a "spent conviction".
186. Nevertheless, the Claimant contends that the information regarding her arrest which she was required to disclose constitutes "ancillary" information within the meaning of s.4(3)(a) and 4(5) and an "official record" or "specified information" within the meaning of s.9. She submits that I should find that this is so, applying a purposive approach in accordance with which information regarding an arrest should not be less well protected when it has not led to a conviction than when it has resulted in a conviction. Alternatively, she submits that I should apply the interpretative obligation in s.3 of the Human Rights Act 1998 to reach the same result. In this regard she relies on the presumption of innocence in Art. 6 of the ECHR and the privacy rights in Art. 8 of the ECHR.
187. The difficulty with this argument is that s.4 makes clear that it is concerned with "circumstances ancillary to a spent conviction" (my emphasis). An arrest or police investigation which has not led to a conviction is not ancillary to a conviction; it has no connection with any conviction. If a person has not been convicted and sentenced, there is no date of conviction or sentence from which the rehabilitation period could be determined. It is equally clear that an "official record", as defined in s.9, is a record containing information about persons convicted of offences and "specified information" is information related to a rehabilitated person's spent conviction.
188. Nor is there any basis for the contention that, in order to avoid breaching any Convention rights, the Rehabilitation of Offenders Act 1974 must be extended to cover information regarding arrests or alleged offences which are not ancillary to any conviction. It is wholly unarguable that there has been any breach of the Claimant's Art. 6 right to be presumed innocent. She has not been charged with any offence. The fact that a police investigation and, separately, a disciplinary investigation are ongoing does not arguably breach the presumption of innocence. As regards Art. 8, there is a legal framework which restricts the disclosure and use of such information, including in the HRA, the GDPR and through causes of action such as defamation. In any event, the construction for which Dr Hopkins contends is not a "possible" interpretation applying s.3 of the HRA. It would require wholesale re-writing of the Act.
189. The Particulars of Claim also allege at paragraph 73(c) and (d):

i) The requirement for the Claimant to disclose information about and ancillary to her arrest "without a Disclosure and Barring Service (DBS) certificate was in breach of the Police Act 1997 s.115"; and

ii) "The Defendant may be in breach of the Police Act 1997 s.120 if it is not a Registered Person for the purposes of that section".

190. Section 115 of the Police Act 1997 (which bore the heading "Enhanced criminal record certificates") was repealed by paragraph 1 of Schedule 17(2) to the Serious Organised Crime and Police Act 2005, with effect from 1 April 2008 pursuant to the Serious Organised Crime and Police Act 2005 (Commencement No.12) Order SI 2008/697.
191. Section 120(1) of the Police Act 1997 appears in Part V, headed "Certificates of Criminal Records etc", which is concerned with requests made to the Disclosure and Barring Service ("DBS"). Section 120(1) provides:

"For the purposes of this Part a registered person is a person who is listed in a register to be maintained by DBS for the purposes of this Part."

192. The Particulars of Claim do not provide any explanation as to why it is said that, if HMRC is not a registered person within the meaning of s.120(1) of the Police Act 1997, it "may" be in breach of that provision. Section 120(1) does no more than define the term "registered person". There is no allegation in the Particulars of Claim that any request was made by HMRC of the DBS in breach of any provision of the Police Act 1997.
193. In my judgment, HMRC is right that the cause of action pleaded at paragraph 73 of the Particulars of Claim is misconceived and it has no realistic prospect of success. It falls to be struck out pursuant to CPR 3.4(2)(a) and summarily dismissed pursuant to CPR 24.2.

J. POC §76: "Negligence/Health and Safety etc"

194. Paragraph 76 of the Particulars of Claim contains allegations of breach of s.1 of the Health and Safety at Work Act 1974, breach of the "Health and Safety Regulations", breach of the Protection from Harassment Act 1997 and negligence.
195. In response to paragraph 38 of the Defendant's skeleton argument which contended that paragraph 76 of the Particulars of Claim is "unparticularised and embarrassing", the Claimant's skeleton argument stated, "Dr Hopkins has offered to withdraw this aspect from her claim".
196. At the hearing, Dr Hopkins confirmed that she withdraws paragraph 76 of the Particulars of Claim. Accordingly, as the claims for breach of the Health and Safety at Work legislation, the Protection from Harassment Act 1997 and for negligence have been withdrawn it is unnecessary for me to address HMRC's application to strike out and/or obtain summary judgment in respect of those causes of action.

K. POC §69: "Commissioners for Revenue and Customs Act 2005 (CRCA) etc"

197. Paragraph 69 of the Particulars of Claim (a mis-numbered paragraph appearing on p.22 of the POC) begins:

"The Claimant submits that:

(a) The passing of her personal information to the Independent Office of Police Conduct (IOPC) between 16 August 2019 and 04 September 2019 by Internal Governance was in breach of s.19 and 22 of the CRCA (wrongful disclosure).

198. Section 19 of the CRCA provides, so far as relevant:

"(1) A person commits an offence if he contravenes section 18(1) or (2A) or 20(9) by disclosing revenue and customs information relating to a person whose identity—

(a) is specified in the disclosure, or

(b) can be deduced from it.

(2) In subsection (1) "revenue and customs information relating to a person" means information about, acquired as a result of, or held in connection with the exercise of a function of the Revenue and Customs (within the meaning given by section 18(4)(c)) in respect of the person; but it does not include information about internal administrative arrangements of Her Majesty's Revenue and Customs (whether relating to Commissioners, officers or others)."

199. Section 19 of the CRCA creates a criminal offence. It does not create a civil claim for breach of statutory duty. No arguable civil claim against HMRC can be advanced based on an alleged breach of s.19 of the CRCA.
200. Section 22 of the CRCA provides:

"(1) Nothing in sections 17 to 21 authorises the making of a disclosure which –

(a) contravenes the data protection legislation, or

(b) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(2) In this section, "the data protection legislation" has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act)."

201. Again, no arguable civil claim can be based on s.22 of the CRCA. The cause of action, if there has been a breach of the data protection legislation, is to be found in that legislation.
202. Paragraph 69 of the Particulars of Claim continues:

"Furthermore, under s.28 and 29 of the CRCA, and the Revenue and Customs (Complaints and Misconduct) Regulations 2010, the Claimants submits that:

(b) The Claimant was not subject to a Complaint under s.9, nor a Conduct Matter under s.23. She submits that her case was also not a Conduct Matter under s.24, and therefore no referral to the IOPC was required.

(c) Furthermore, the Regulations state that Conduct Matters under s.23 and 24 (Recordable Conduct Matters) do not need to be recorded/referred to the IOPC if they are already being dealt with by criminal or other proceedings.

(d) Additionally, s.13 obliges that information must not be disclosed unless authorised by the Regulations, or by law."

203. Section 28 of the CRCA (which bears the heading "Complaints and misconduct: England and Wales") gives the Treasury power to make regulations conferring functions on the Director General of the Independent Office for Police Conduct in relation to the Commissioners for Her Majesty's Revenue and Customs and officers of Revenue and Customs.
204. Section 29(3) of the CRCA provides:

"Where the Director General of the Independent Office for Police Conduct or a person acting on the Director General's behalf obtains information from the Commissioners or an officer of Revenue and Customs, …in the course of exercising a function by virtue of section 28 –

(a) the Director General or person shall comply with any restriction on disclosure imposed by regulations under that section (and those regulations may, in particular, prohibit disclosure generally or only in specified circumstances or only without the consent of the Commissioners), and

(b) the Director General or person may not use the information for any purpose other than the exercise of the function by virtue of that section."

205. The Revenue and Customs (Complaints and Misconduct) Regulations (SI 2010/1813) ("the 2010 Regulations") were made pursuant to ss.28 and 29(3) of the CRCA.
206. It is common ground that the Claimant was not the subject of a "complaint" within the meaning of reg.9(1) of the 2010 Regulations. Equally, although reg.23 is referred to in the Particulars of Claim, no reliance is placed by HMRC on that provision: again, it is common ground that it is inapplicable.
207. HMRC contends that the referral to the IOPC which it made on 3 September 2018 was made because a conduct matter under reg.24 had come to its attention on being informed by the Claimant of her arrest, and on being supplied by Merseyside Police on 3 September 2018, pursuant to the common law disclosure procedure, with information as to the four serious offences for which the Claimant was arrested.
208. HMRC submits that it was required to refer this matter to the IOPC pursuant to reg. 30 which provides so far as relevant:

"(1) It shall be the duty of the appropriate authority to refer a recordable conduct matter to the Director General (whether or not the case falls within regulation 23), if—

…

(b) that matter is of a description specified in paragraph (2); or

…

(2) Any matter which relates to conduct falling within the following descriptions is specified for the purposes of paragraph (1)(b)—

…

(b) a serious sexual offence, as defined in guidance issued by the Director General;

…

(f) conduct which is alleged to have taken place in the same incident as one in which conduct within sub-paragraphs (a) to (e) is alleged.

…

(4) The obligation on the appropriate authority under paragraph (1)(a) or (b) to refer a recordable conduct matter in respect of a person for whom it is the appropriate authority arises only if it is satisfied that the matter is one in respect of which there is an indication that the person may have—

(a) committed a criminal offence, or

(b) behaved in a manner which would justify the bringing of disciplinary proceedings and that such behaviour (if it had taken place) would be likely to lead to the termination of that person's office or employment." (emphasis added)

209. Regulation 24 provides:

"(1) Where—

(a) a conduct matter comes (otherwise than as mentioned in regulation 23 (conduct matters arising in civil proceedings)) to the attention of the appropriate authority in relation to that matter, and

(b) it appears to the appropriate authority that the conduct involved in that matter falls within paragraph (2),

it shall be the duty of the appropriate authority to record that matter.

(2) Conduct falls within this paragraph if (assuming it to have taken place)—

(a) it appears to have resulted in the death of any person or in serious injury to any person;

(b) a member of the public has been adversely affected by it; or

(c) it is of a description specified in paragraph (3).

(3) The following descriptions of conduct are specified for the purposes of paragraph (2)—

…

(b) a serious sexual offence, as defined in guidance issued by the Director General;

…

(f) conduct whose gravity or other exceptional circumstances make it appropriate to record the matter in which the conduct is involved; or

(g) conduct which is alleged to have taken place in the same incident as one in which conduct within sub-paragraphs (a) to (e) is alleged.

(4) Where the appropriate authority records any matter under this regulation it—

(a) shall first determine whether the matter is one which it is required to refer to the Director General under regulation 30 (reference of conduct matters to the Director General) or is one which it would be appropriate to so refer, and

(b) if it is not required so to refer the matter and does not do so, may deal with the matter in such other manner (if any) as it may determine.

(5) Nothing in paragraph (1) shall require the appropriate authority to record any conduct matter if it is satisfied that the matter has been, or is already being, dealt with by means of criminal or disciplinary proceedings against the person to whose conduct the matter relates.

(6) If it appears to the Director General —

(a) that any matter that has come to the Director General's attention is a recordable conduct matter, but

(b) that that matter has not been recorded by the appropriate authority,

the Director General may direct the appropriate authority to record that matter; and it shall be the duty of that authority to comply with the direction." (emphasis added)

210. The term "conduct matter" is defined in reg.9(2) which provides:

"2) In these Regulations "conduct matter" means (subject to the following provisions of this regulation, and regulation 19(3)) any matter which is not and has not been the subject of a complaint but in the case of which there is an indication (whether from the circumstances or otherwise) that a Commissioner or an officer may have—

(a) committed a criminal offence, or

(b) behaved in a manner which would justify the bringing of disciplinary proceedings."

211. When the Claimant informed her employer that she had been arrested on suspicion of a serious sexual offence (as defined in the guidance), a conduct matter falling within reg.24(1), (2) and (3) came to the attention of HMRC as the appropriate authority. Moreover, in the light of the letter from Merseyside Police to HMRC of 3 September 2018, there can be no dispute that a "conduct matter" had come to the HMRC's attention.
212. The issue that the Claimant raises is whether it was a "recordable conduct matter". The Claimant contends that:

i) the effect of reg.24(5) is that HMRC was not required to record the matter because it was already being dealt with by means of criminal proceedings against her;^[1]

ii) if HMRC was not required to record the matter, she contends there was no lawful basis for doing so; and

iii) if it was not a "recordable conduct matter", then there was no duty on HMRC to refer it to the IOPC pursuant to reg. 30.

213. The term "recordable conduct matter" means (see reg.1(1)):

"(a) a conduct matter that is required to be recorded by the appropriate authority under regulation 23 (conduct matters arising in civil proceedings) or 24 (recording etc. of conduct matters in other cases), or has been so recorded; or …"

214. In my judgment, HMRC was required to record the matter pursuant to reg. 24. A criminal investigation had begun, but when the referral to the IOPC was made the matter was not already being dealt with by "criminal proceedings". In my judgment, the term "proceedings", in the context of reg. 24(5), refers to court proceedings. A mere arrest does not constitute the commencement of criminal proceedings. It was a recordable conduct matter which HMRC was obliged to refer to the IOPC in accordance with reg. 30.
215. I consider that this aspect of the Claimant's case is bound to fail, in any event, because a recordable conduct matter includes not only a conduct matter that HMRC was required to record pursuant to reg. 24, but also one which it has so recorded. The regulations authorised HMRC to record the conduct matter, even if criminal or disciplinary proceedings had commenced. Reg. 24(5) did not preclude HMRC from doing so. It is not disputed that this conduct matter was in fact recorded by HMRC and so for this additional reason it follows that it is a recordable conduct matter which HMRC was required to refer to the IOPC.
216. In my judgment, the cause of action pleaded at paragraph 69 of the Particulars of Claim has no realistic prospect of success and it falls to be struck out pursuant to CPR 34.(2)(a) and summarily dismissed pursuant to CPR 24.2.

L. POC §78: Misfeasance in Public Office

217. Paragraph 78 of the Particulars of Claim provides:

"The Claimant submits that the repeated failure of the Defendant to respond lawfully to requests made under GDPR/DPA amounts to Misfeasance in Public Office. HMRC, as a registered Data Controller with the Information Commissioner's Office (ICO) is required to comply with GDR/DPA at all times."

218. In Three Rivers District Council v Governor and Company of the Bank of England (No.3) [2003] 2 AC 1, the House of Lords identified the ingredients of the tort of misfeasance in public office as follows:

i) The defendant must be a public officer.

ii) The defendant must have exercised power as a public officer.

iii) The defendant must have acted with malice or in bad faith, either with the intention of injuring the claimant or, being aware of the risk of such injury, without an honest belief that his conduct was lawful.

iv) That conduct must have caused the claimant material injury or damage of a sort foreseen by the defendant.

219. An allegation of misfeasance in public office is a serious matter. The Claimant's pleading does not identify who is alleged to have committed misfeasance or address any of the essential elements of the tort. In these circumstances, this cause of action must be struck out. In my judgment, this is not a case where any defects in the Claimant's pleading of this cause of action can be remedied by amendment. In particular, the allegations of "misconduct in public office" (a criminal offence) made by the Claimant in her skeleton argument against a (now retired) HMRC official, Mr Neil Angus, do not come close to meeting the requisite standard for pleading an allegation of malice or bad faith.
220. This cause of action also falls to be struck out pursuant to CPR 3.4(2)(a) and summarily dismissed pursuant to CPR 24.2.

M. POC §§79-80: Defamation/Malicious Falsehood/Negligence

221. Paragraphs 79-80 of the Particulars of Claim state:

"79. The Claimant submits that the tone and content of the publications (emails, letters etc.) by the Defendant regarding her case impute that the plaintiff has committed or been charged with the offences alleged and are therefore defamatory/malicious falsehoods.

80. She further submits that the Defendant is in negligent breach of its duty of care to her with respect to the publications which impute the above."

222. As I have noted above, at the hearing the Claimant confirmed that she withdraws her claim in negligence. Accordingly, paragraph 80 of the Particulars of Claim falls away and it is unnecessary to address the application to strike out or for summary judgment in respect of that paragraph.
223. The defamation and malicious falsehood claims are wholly unparticularised. In respect of the defamation claim, the Claimant has not identified (as required by the practice direction applicable to defamation claims issued prior to 1 October 2019 (53xPD) the publication (or publications) that is (or are) the subject of her claim or the natural and ordinary meaning(s) of any such publication(s) (or any innuendo meaning(s) on which she relies). In respect of the malicious falsehood claim, the Claimant has again failed to identify the statement (or statements) she relies on or to whom it was published. Nor has she pleaded falsity or malice.
224. Accordingly, I consider that both causes of action should be struck out pursuant to CPR 3.4(2)(a) and summarily dismissed pursuant to CPR 24.2. In view of the complete failure to comply with the pre-action protocol or the practice direction, the defamation claim also falls to be struck out pursuant to CPR 3.4(2)(c).

N. Conclusion

225. The Claimant has withdrawn the causes of action in negligence and pursuant to health and safety legislation and the Protection from Harassment Act 1997, pleaded at paragraphs 76 and 80 of the Particulars of Claim.
226. HMRC has succeeded on its application (i) to strike out the claim pursuant to CPR 3.4(2)(a) on the ground that the Particulars of Claim disclose no reasonable grounds for bringing the claim and (ii) for summary judgment pursuant CPR 24.2 on the ground that the Claimant has no real prospect of succeeding on the claim and there is no other compelling reason why the issues should be disposed of at a trial, save to the extent that the following are not struck out or summarily dismissed:

i) paragraph 75(b)(vii) and (viii) and 75(h) of the Particulars of Claim; and

ii) paragraph 74(m) of the Particulars of Claim.

227. In addition, the defamation claim is struck out pursuant to CPR 3.4(2)(c).

Note 1   She does not rely on the disciplinary proceedings because they had not yet been instituted and, in any event, she submits that the matter should not be the subject of disciplinary proceedings.    [Back]