Scottish Court of Session Decisions

You are here: BAILII >> Databases >> Scottish Court of Session Decisions >> PETITION OF THE GENERAL TEACHING COUNCIL FOR SCOTLAND AGAINST THE CHIEF CONSTABLE OF THE POLICE SERVICE OF SCOTLAND [2021] ScotCS CSOH_110 (26 October 2021)
URL: http://www.bailii.org/scot/cases/ScotCS/2021/2021_CSOH_110.html
Cite as: 2021 SLT 1512, [2021] CSOH 110, [2021] ScotCS CSOH_110, 2021 GWD 35-470

[New search] [Printable PDF version] [Help]

OUTER HOUSE, COURT OF SESSION

[2021] CSOH 110

P312/21

OPINION OF LORD UIST

In the petition of

THE GENERAL TEACHING COUNCIL FOR SCOTLAND

Petitioner

against

THE CHIEF CONSTABLE OF THE POLICE SERVICE OF SCOTLAND

Respondent

Petitioner: Lindsay QC; Anderson Strathern LLP

Respondent: van der Westhuizen QC; Ledingham Chalmers LLP

26 October 2021

Introduction

[1]

There are before me seven separate petitions in each of which the petitioner is The

General Teaching Council for Scotland ("GTCS") and the respondent is The Chief Constable

of the Police Service of Scotland ("Police Scotland"). In each petition the petitioner sought

disclosure of certain material from the respondent. Orders for disclosure have been made

without opposition from the respondent and the petitioner now seeks an award of expenses

against the respondent in each petition. The respondent opposed any award of expenses

and at a hearing on expenses I heard full submissions on behalf of both the petitioner and

the respondent.

The background

[2]

The petitioner is the regulatory body for teaching in Scotland and is a body corporate

first established under section 1 of the Teaching Council (Scotland) Act 1965 and continued

under Article 4 of the Public Services Reform (General Teaching Council for Scotland) Order

2011 ("the 2011 Order"). The Police Service of Scotland, which is known as and operates

under the name "Police Scotland", was established as a constabulary under section 6 of the

Police and Fire Reform (Scotland) Act 2012 ("the 2012 Act"). By virtue of section 17(1)

and (2)(a) and (b) of that Act the Chief Constable has direction and control of Police Scotland

and is responsible for its day to day administration.

The relevant statutory provisions

[3]

Articles 4, 5, 6, 7, 8, 9, 15 and 18 of the 2011 Order provide as follows:

"4.- (1) There is to continue to be a body corporate known as the General Teaching

Council for Scotland (`the GTCS').

5. The GTCS's principal aims are

(a)

to contribute to improving the quality of teaching and learning; and

(b)

to maintain and improve teachers' professional standards.

6. The GTCS's general functions are

(a)

to keep the register;

(c)

to investigate the fitness to teach of individuals who are, or who are

seeking to be, registered.

7. The GTCS must have regard to the interests of the public when performing its

functions.

8. The GTCS must perform its functions in a way which

(a)

is proportionate, accountable, transparent and consistent;

(b)

is targeted only where action is needed;

(c)

encourages equal opportunities and in particular the observance of

the requirements of the law for the time being relating to equal opportunities;

and

(d)

is consistent with any other principle which appears to it to represent

best regulatory practice.

9.(1) The GTCS may do anything which appears to it to be appropriate for the

purposes of, or in connection with, the performance of its functions.

15. (1)

The GTCS must make and publish rules (`the GTCS rules')

(a)

setting out the procedure for inclusion in the register;

(b)

setting out registration criteria; and

(c)

otherwise governing the operation of the register.

(3)

The GTCS rules may, in particular, make provision about

(a)

the form and keeping of the register;

(b)

the making of entries in the register and alterations to those entries;

(g)

removing individuals from the register;

(h)

restricting and cancelling entries in the register;

(i)

circumstances in which registration may lapse; and

(l)

such other matters relating to registration as the GTCS thinks fit.

18.-(1) The GTCS

(b)

may investigate any registered teacher's fitness to teach where it

becomes aware of circumstances which it considers justify such an

investigation.

(2)

The GTCS must

(b)

remove from the register any registered teacher whom it subsequently

considers to be unfit to teach.

(3)

An individual is `unfit to teach' for the purposes of this Order if the GTCS

considers that the individual's conduct or professional competence falls significantly

short of the standards expected of a registered teacher (and `fitness to teach' is to be

construed accordingly).

(4)

Schedule 4 makes further provision regarding individuals' fitness to teach."

[4]

Paragraph 2 of Schedule 4 to the 2011 Order provides as follows:

"2. (1)

The GTCS may hold proceedings in respect of-

(a)

An investigation of an individual's fitness to teach;

(b)

a review carried out in pursuance of paragraph 1(2)(b).

(2)

The GTCS Rules must set out the procedure, the standard of proof and the

rules of evidence which are to apply to such proceedings.

(3)

The GTCS Rules may specify any exceptional circumstances in which such

proceedings are not to be held in public (for example, proceedings relating to

individuals whose entry in the register is provisional).

(4)

The GTCS may administer oaths or affirmations for the purposes of such

proceedings.

(5)

The Court of Session may, on an application by any party to such

proceedings-

(a)

order any person to attend proceedings in order to give oral evidence;

(b)

order any person to disclose documents or other evidence to the

GTCS;

(c)

authorise the taking of evidence from any person or the examination

of any documents or other evidence held by any person.

(6)

But the Court of Session may not order a person to give any evidence, or to

disclose anything, which the person would be entitled to refuse to give or disclose in

an action in that court."

In accordance with Article 15 of the 2011 Order the GTCS made on 14 June 2017 the General

Teaching Council for Scotland Fitness to Teach Rules 2017 approved and signed by the Lord

President ("the Rules").

[5]

Section 32 of the 2012 Act provides as follows:

"32. Policing principles

The policing principles are

(a)

that the main purpose of policing is to improve the safety and well-being of

persons, localities and communities in Scotland, and

(b)

that the Police Service, working in collaboration with others where

appropriate, should seek to achieve that main purpose by policing in a way which

(i)

is accessible to, and engaged with, local communities, and

(ii)

promotes measures to prevent crime, harm and disorder."

[6]

The Law Enforcement Privacy Notice of Police Scotland provides:

"In certain circumstances we will share information which was initially for a law

enforcement purpose with selected third parties for non law enforcement purposes:

Insurance companies (for example, where information was initially

gathered at the scene of a road traffic collision and is subsequently shared to

allow the company to identify other drivers for the purposes of an insurance

claim).

Criminal Injuries Compensation Authority.

Schools and other educational establishments.

Other regulatory bodies, such as the General Medical Council

(GMC)."

[7]

Section 31 of the Data Protection Act 2018 ("the 2018 Act") defines "the law

enforcement purposes" as being "the purposes of the prevention, investigation, detection or

prosecution of criminal offences or the execution of criminal penalties, including the

safeguarding against the prevention of threats to public security".

[8]

Section 36 of the 2018 Act provides:

"(1)

The second data protection principle is that (a) the law enforcement

purpose for which personal data is collected on any occasion must be specified,

explicit and legitimate, and (b) personal data so collected must not be processed in a

manner that is incompatible with the purpose for which it was collected.

(2)

Paragraph (b) of the second data protection principle is subject to subsections

(3) and (4).

(3)

Personal data collected for a law enforcement purpose may be processed for

any other law enforcement purpose (whether by the controller that collected the data

or by another controller) provided that

(a)

the controller is authorised by law to process that data for the other

purpose, and

(b)

the processing is necessary and proportionate to that other purpose.

(4)

Personal data collected for any of the law enforcement purposes may not be

processed for a purpose that is not a law enforcement purpose unless the processing

is authorised by law."

The dispute

[9]

The respondent's position on what is required in order to comply with the statutory

requirement of being "authorised by law" under section 36(4) of the 2018 Act is set out in

answer 1 to each petition as follows:

"The respondent is not permitted or obliged to disclose the information sought by

the petitioner without an order of the court. The respondent accordingly does not

oppose the granting of the substantive orders being sought by the petitioner, and

will comply with those orders if the court grants them, but opposes the granting of

expenses against him ..."

[10]

In an email dated 20 December 2019 the Information Commissioner's Office (ICO)

provided the following advice to Police Scotland:

"Personal data collected for any of the law enforcement purposes may not be

processed for a purpose that is not a law enforcement purpose unless the processing

is authorised by law. In operational terms this means that personal information

obtained and processed in the course of a criminal investigation will be for at least

one of the law enforcement purposes i.e. the apprehension and prosecution of

offenders. That information cannot be used for anything other than a law

enforcement purpose which means that Police Scotland is subject to a statutory bar

from using (including sharing) such information for any other purpose unless

specifically authorised to do so by law. This would require either an order of the

court or a specific statutory obligation to provide the information. The fact that

another body has a statutory power to request such information would not constitute

an obligation on the part of Police Scotland to provide the same. If, as you intimate,

a Regulator is requesting such information in order to pursue a fitness to practice

(sic) or misconduct investigation, Police Scotland would be breaching the

requirements of the 2018 Act if it acceded to such a request as per section 36(4)."

On the other hand, in its statutory code of practice issued under section 121 of the 2018 Act

the ICO stated that "authorised by law" might be "for example, statute, common law, royal

prerogative or statutory code".

[11]

In response to one of the requests from the petitioner Police Scotland sent the

following reply on 30 November 2020:

"I refer to your recent request for information which has been considered in terms of

the Data Protection Act 2018. The information you seek is gathered for the purposes

of law enforcement in terms of the Law Enforcement EU Directive 2016, transposed

into UK legislation via Part 3 of the Data Protection Act 2018. Section 36(4) of the

2018 Act states that in relation to complying with the second data protection

principle personal data collected for any of the law enforcement purposes may not be

processed for a purpose that is not a law enforcement purpose unless the processing is

authorised by law. This means that personal information obtained for law

enforcement purposes cannot be used for anything other than a law enforcement

purpose which precludes Police Scotland from using (including sharing) such

information for any other purpose unless specifically authorised to do so by law.

This would require either an order of the court or a specific statutory obligation to

provide the information. I therefore refuse to provide you with the information

sought as a restriction exists to the processing of same."

The decided cases

[12]

Three leading cases dealt with the confidentiality of information held by the police.

The first was Woolgar v Chief Constable of Sussex Police and UKCC [2000] 1 WLR 25, where the

Court of Appeal held that the public interest in ensuring the free flow of information to the

police for the purposes of criminal proceedings which required that information given in

confidence would not be used for some collateral purpose had to be balanced against a

countervailing public interest in protecting public health and safety which entitled the police

to disclose to a regulatory body operating in that field confidential information which the

police reasonably believed was relevant to an inquiry being conducted by that body on the

basis that confidentiality would otherwise be maintained. Kennedy LJ set out the plaintiff's

submission at p36 as follows:

"Essentially Mr Wadswoth's submission was and is that when the plaintiff answered

questions when interviewed by the police she did so in the reasonable belief that

what she said would go no further unless it was used by the police for the purposes

of criminal proceedings. The caution administered to her so indicated, and in order

to safeguard the free flow of information to the police it is essential that those who

give information should be able to have confidence that what they say will not be

used for some collateral purpose."

His lordship rejected that submission in the following terms:

"However, in my judgment, where a regulatory body, such as the UKCC, operating

in the field of public health and safety, seeks access to confidential material in the

possession of the police, being material which the police are reasonably persuaded is

of some relevance to the subject matter of an inquiry being conducted by the

regulatory body, then a countervailing public interest is shown to exist which, as in

this case, entitles the police to release the material to the regulatory body on the basis

that, save in so far as it may be used by the regulatory body for the purposes of its

own inquiry, the confidentiality which already attaches to the material is maintained.

As Mr Horan said in his skeleton argument:

`A properly and efficiently regulated nursing profession is necessary in the

interest of the medical welfare of the country, to keep the public safe, and to

protect the rights and freedoms of those vulnerable individuals in need of

nursing care. A necessary part of such regulation is the ensuring of the free

flow of the best available information to those charged by statute with the

responsibility to regulate.'

Putting the matter in Convention terms Lord Lester submitted, and I would accept,

that disclosure is `necessary in a democratic society in the interests of ... public safety

or ... for the protection of health or morals, or for the protection of the rights and

freedoms of others.'

Even if there is no request from the regulatory body, it seems to me that if the police

come into possession of confidential information which, in their reasonable view, in

the interests of public health or safety, should be considered by a professional or

regulatory body, then the police are free to pass that information to the regulatory

body for its consideration."

[13]

In General Dental Council v Savery and Others [2011] EWHC 3011 (Admin) Sales J, as

he then was, made clear that it was not necessary to obtain a court order in order to share

personal data with a regulatory body for the purposes of professional misconduct or

improper practice proceedings. He stated as follows at para 62:

"I do not think it is possible to read the lead judgment of Thorpe LJ in the Court of

Appeal as indicating that a ruling of a court is required before there can be disclosure

of patient records (without the consent of the patients concerned) for the purposes of

investigation by official regulatory bodies of allegations of professional misconduct

or improper practice, such as what is in issue in the present case. If that had been the

intention of Thorpe LJ it would have been necessary for him to embark upon detailed

consideration of MS v Sweden and Woolgar to explain why they were wrong or

should be distinguished, but there is nothing dealing with these matters in his

judgment. On the contrary, he affirmed the condition imposed by Munby J which

made it clear that the intervention of the court was not required in a case where it

was proposed to disclose or make use of patient records for the purposes of

professional misconduct or improper practice proceedings by appropriate regulatory

bodies. As I read the judgment, Thorpe LJ's observations at [25] [26] were directed

to meeting the contention of the health authority that it could disclose or make use of

the patient records for any other purposes which it might choose. It was only if the

health authority wished to make such wider disclosure or use of patient records (i.e.

beyond disclosure and use for the purposes of professional misconduct or improper

practice proceedings), where there was not already in place a clear regime which

provided suitable protection for the patients' interests in confidentiality, that the

decision of a court would be required as a safeguard."

[14]

In C v The Chief Constable of the Police Service of Scotland [2020] CSIH 61 a group of

police officers, against whom misconduct proceedings had been brought, petitioned for

judicial review seeking declarator that the use of messages sent among them via the

WhatsApp messaging system for the purpose of bringing the disciplinary proceedings in

respect of non-criminal behaviour on their part was unlawful and amounted to a

contravention of Article 8 of the European Convention on Human Rights (ECHR). The

messages had been discovered by a detective constable during an investigation into sexual

offences in which the petitioners were not persons of interest. The Inner House held that

there was a clear and accessible legal basis for the disclosure by Police Scotland as there was

a very clear, specific public interest in the maintenance of a properly regulated police force

and its importance to the retention of public confidence and the proper discharge of police

duties.

[15]

The Lord Justice Clerk stated as follows at paras [107] and [108]:

"[107] The Lord Ordinary drew from these observations the conclusion that there

was a clear and accessible basis upon which the police could disclose to regulatory

bodies information which they recovered in the course of criminal investigations. He

added ... `It seems to me that this must be the position in a case such as the present

one where the police are referring the information recovered to their own internal

disciplinary body. There is a public interest in having a a properly regulated police

force in order to protect the public and thus it is lawful that information recovered in

criminal proceedings by the police can be passed to its own disciplinary body for

that strictly limited purpose (and there is no suggestion in the present case that it will

be used for any other purpose).'

[108] In my view the Lord ordinary was correct in reaching this conclusion. The

discretion to use the material is limited by the nature of the public interest which the

disclosure is to meet. I should not be taken as suggesting that any amorphous or

vague public interest may be sufficient to provide the clear and accessible basis

necessary. On the contrary, in the present case it seems to me that there is a very

clear, specific public interest in the maintenance of a properly regulated police force

and its importance to the retention of public confidence and the proper discharge of

police duties."

[16]

At para [109] the Lord Justice Clerk added:

"In addition, it is in my view an interest which falls within general policing

purposes, such that the fact that the police would be entitled to forward the

information would be accessible to the reclaimers and the consequences of doing so

foreseeable. Senior counsel for the reclaimers submitted that the encapsulation of

policing purposes could be found in p1081, para 9 of R (on the application of Catt) per

Lord Sumption: `police purposes' ... are defined ... as protecting life and property,

preserving order, preventing crime, bringing offenders to justice and performing any

legal duty or responsibility of the police. He accepted that if disclosure were for such

a purpose then such a measure would be capable of being in accordance with law. In

my view senior counsel for the reclaimers, in suggesting that the use for which the

material was intended in this case fell outwith the definition of `police purposes'

viewed the matter through too narrow a prism. The definition which he himself

submitted includes references to any legal duty or responsibility of the police. That

in my view is wide enough to include the responsibility of maintaining police

discipline in order that all wider policing purposes may properly be carried out."

[17]

Two cases in the sheriff court also dealt with the matter. The first was Scottish Social

Services Council v Livingstone (Unreported, Dunfermline Sheriff Court, 4 April 2019), which

was decided by Sheriff McSherry. That was a summary application under section 1(1) of the

Administration of Justice (Scotland) Act 1972 for recovery of certain documents and

information held by Police Scotland. The orders for production sought were granted

unopposed and the sheriff then had to decide the question of expenses. He made no finding

of expenses in favour of the pursuer and found the pursuer liable to the defender in the

expenses of the hearing on expenses. He took the view that the pursuer was not vindicating

its rights as, unlike the General Medical Council (GMC) under section 35A of the Medical

Act 1983, it had no statutory power of requiring disclosure from anyone. He considered that

the police were not under a duty to make disclosure to the pursuer: if they were, the

summary application would not have been necessary. He also took the view (which I do not

understand) that both parties were public bodies and the defender should not be liable for

expenses in every application as this would be a considerable burden on the public purse

which was saved by the costs of only one public body being incurred in making the

summary application, undefended by the other.

[18]

The second case was The General Medical Council v Iain Livingston, Chief Constable of

the Police Service of Scotland (Unreported, Hamilton Sheriff Court, 30 August 2019) in which

the pursuer in a summary application under section 35A(6A) of the Medical Act 1983 sought

production of information in the hands of the defender. The pursuer has power under

section 35A in connection with its investigative function to require "any other person who

in his opinion is able to supply information or produce any document which appears

relevant to the discharge of any such function, to supply such information or produce such a

document ..." In connection with its investigations into a registrant the pursuer applied to

the defender under section 35A for information held by the defender in connection with an

earlier criminal investigation carried out by Police Scotland into alleged criminal conduct by

the registrant. The defender refused to produce the required information, as a result of

which the pursuer required to bring the summary application in the sheriff court. That

application was opposed by the defender only in relation to the question of expenses.

Sheriff H K Small summarised the pursuer's position on expenses as follows:

"[11] The pursuer's position ... can be... summarised in the following manner.

Firstly, having regard to the general rule that expenses should follow success, the

expenses should be borne by the party or parties who caused the expense. In

relation to the defender, the pursuer successfully obtained an order for recovery of

documents. The need for court proceedings had been necessitated by the defender's

decision, after initial informal approaches, followed by the statutory request in terms

of section 35A of the 1983 Act, to withhold the information. Had the defender

decided to deliver the documents in response to these requests court proceedings

would not have been required.

[13]

Secondly, it was the pursuer's position that the proceedings had been

necessitated as a result of the defender's wrongful decision to withhold the

information requested. It was clear from the English cases of Savery and Woolgar that

it was for the defender to consider the request and to balance it against competing

duties under Data Protection, GDPR, Article 8 of the European Convention and the

common law. That initial decision, per Woolgar, was for the holder of the

information to make, not the courts. Although the defender had indicated in

correspondence that that the reason for deciding not to produce was that the

information was `provided for a policing purpose and in the full expectation of

complete confidence. If witnesses were aware that their statement may be given to

other agencies then they may not be so willing to provide a full and frank statement

to the police' (per letter from Police Scotland to the pursuer dated 5 November 2018),

no clear and reasoned decision could be ascertained from the defender's submissions

to this court. This was not a case where the defender could argue that he was

performing a statutory function and, in the absence of malice or bad faith, should not

be liable in expenses. English courts have penalised police authorities who have

unreasonably refused to produce information ... Although not binding on this court,

in a recent unreported case at Dunfermline the sheriff expressed a view that any

party holding information and refusing to accede to a demand under section 35A

would be liable for the expenses of any action subsequently raised, unless contrary to

Data Protection, GDPR, Article 8 or the common law."

[19]

Sheriff Small summarised the submission for the defender as follows:

"[16] It was accepted on behalf of the defender that when dealing with requests for

information, including formal requests under section 35A of the 1983 Act, there were

a number of matters for the defender to consider. These were summarised in the

case of Woolgar. It was her submission that Woolgar, being an English case, was

persuasive only. It was persuasive authority for the proposition that in deciding

whether or not to accede to the request the holder of the information had to consider

competing duties under Data Protection, GDPR, Article 8 and the common law; he

should balance public interest against an individual's right to privacy; he should, if

persuaded to release information, give prior indication to those likely to be affected,

per the recommendations in Woolgar; and that in all such situations the holder of the

information was the primary decision make and was not required to produce the

information in every case. Accordingly, she submitted that the decision of the

defender to withhold the information and await the summary application `ensured

that the defender complied with his obligations under GDPR, Article 8, common law

and data protection'.

[17]

It was further submitted that, in any event, the court's power to award

expenses was discretionary. As this was not a case involving two private litigants,

the ordinary rules of expenses following success should not apply. The defender, in

the exercise of his public and statutory obligations, had carried out a balancing act

and reached a decision which was absent of (sic) malice or bad faith. Accordingly, he

should not be found liable in expenses."

[20]

In reaching his decision the sheriff stated:

"[20] There is no doubt on the information before me that the requirement for these

proceedings was brought about entirely as a result of the defender's decision to

withhold the information properly requested by the pursuer as part of the pursuer's

=legitimate statutory function and in the proper exercise of the pursuer's statutory

powers. Had the defender complied with the request there would have been no

need for an application to the court ...

[21]

Having reached that view, the next matter to determine is whether or not, in

the exercise of the court's discretion, any liability in expenses arises out of the

defender's decision. It was generally agreed in submissions to me that the case of

Woolgar gives the appropriate guidance to the holders of information in respect of

which a valid request for disclosure is made. The defender appears to recognise that

the decision in response to the initial request is his to make. Further, the relevant

factors which bear upon the defender's decision do not appear to be in dispute. They

are Data Protection, GDPR, Article 8, and the common law. While the defender

claims to have considered these factors, and based his decision upon such a

consideration, I find myself quite unable on examination of all the information

placed before the court to determine how the defender's decision was arrived at. The

reason for withholding information, as set out in the letter dated 5 November 2018, is

not a valid reason. As a statement of the law the content of that letter is incorrect.

Ms Fraser for the defender quite rightly did not rely on that letter, but submitted that

following receipt of the statutory request in terms of section 35A of the 1983 Act the

defender, aware of the need to make a decision, and that the decision was his to

make, per Woolgar, correctly chose to withhold the requested information. I might

have considered that to be a proper approach had I been able to determine how the

defender went about making the decision. However, no cogent reason has been

advanced in the course of this application. Rather, the defender appears to have

abdicated the decision making process to the court.

[22]

The defender having been vested with the power to make the appropriate

decision, and having failed to make any proper and reasonably based decision,

thereby necessitating these proceedings, I can see no reason why the defender should

not be found liable in expenses. The defender submits that, in the absence of malice

or bad faith in the exercise of the statutory obligations the authorities suggest that he

should not be found liable in expenses. This is not one of these cases. The decision

to be made was not one falling exclusively within the statutory functions and duties

of the police. The defender was simply `any other person' holding information

which the pursuer could require in terms of the statutory powers under section 35A

of the 1983 Act. Sheriff McSherry at Dunfermline in the recent unreported case to

which I was referred quite clearly opined that, unless valid reasons for refusal of

disclosure existed, anyone refusing disclosure required by the pursuer in exercise of

his rights under section 35A would be liable in the expenses of an action. Ms Fraser

submitted that this was an incorrect statement of the law. I disagree.

Sheriff McSherry also recognised that the police, when they hold such information,

have `an unenviable balancing act to carry out'. Accordingly, it was for the defender

to reach a justifiable decision on the request, having regard to the various competing

interests and the law. Standing the apparent lack of any reasoned view reached by

the defender, I agree with Sheriff McSherry that the defender, by refusing disclosure,

becomes liable in expenses."

Submission for the petitioner

[21]

The broad proposition advanced on behalf of the petitioner was that, as it had

enjoyed complete success in having the prayer of the petition granted without the need for

an oral hearing, the normal rule of expenses following success should be followed as there

were no circumstances that would justify departing from it. The respondent had refused to

provide the requested information to the petitioner on a voluntary basis and required the

petitioner to proceed with the petition which was not opposed by the respondent, on an

erroneous basis that misunderstood the applicable law, despite the correct legal position

being explained by the petitioner prior to the commencement of these proceedings. The

petitioner therefore incurred the unnecessary expense of having to proceed with the

petitions to recover the requested documentation, which could and should have been

disclosed by the respondent to the petitioner on a voluntary basis without the need to first

obtain an order from the court. As the respondent required the petitioner to incur the

expense of proceeding with unnecessary petitions to obtain court orders that were not

required he should be liable for the petitioner's expenses in doing so. The respondent's

erroneous understanding of the law was that he was not permitted to share personal

information obtained and processed in the course of a criminal investigation for anything

other than a law enforcement purpose unless specifically authorised to do so by law, which

would require either an order of the court or a specific statutory obligation to provide the

information, and that he would breach section 36(4) of the 2018 Act if he acceded to a

request from a regulatory body, such as the petitioner, for him to provide information for

the purpose of pursuing fitness to practise or misconduct investigations. That was an

incorrect understanding of the parties' rights and obligations because the petitioner had a

statutory power to require the disclosure of information, the respondent was under a duty

to disclose that information to the petitioner without a court order, the processing of the

information was authorised by law and the respondent was permitted, and in the

circumstances obliged, to disclose the documents sought by the petitioner without an order

from the court. None of the three legal regimes engaged (the common law, the 2018 Act and

the GDPR and the Human Rights Act 1998) required a court order ordaining disclosure.

Rather, all three of these legal regimes authorised and promoted disclosure on public safety

grounds. In particular, section 36(4) of the 2018 Act did not require a court order to be

pronounced before the requested information could be disclosed to the petitioner: C v The

Chief Constable of the Police Service of Scotland 2020 SLT 1021. Accordingly, the requested

information ought to have been voluntarily disclosed by the respondent to the petitioner

without the need for a court order. For these reasons the petitions were unnecessary and the

respondent should be liable for the petitioner's expenses incurred in connection with them.

Submission for the respondent

[22]

On behalf of the respondent it was submitted that his ability to share information

obtained during criminal investigations was governed by Part 3 (Law Enforcement

Processing) of the 2018 Act, which implemented the Law Enforcement Directive (Directive

(EU) 2016/680) and made provision for the processing of personal data by competent

authorities for law enforcement purposes, particularly sections 31 and 36(4). Section 116(A1)

of the 2018 Act provides that the Information Commissioner is responsible for monitoring

the application of Part 3 of the Act in order to protect the fundamental rights and freedoms

of individuals in relation to processing by a competent authority, including the respondent,

for any of the law enforcement purposes. Section 157(2)(a) of the 2018 Act provides that in

relation to an infringement of a provision of Part 3 of the Act the maximum amount of the

penalty that may be imposed by a penalty notice in relation to a failure to comply with

section 36 is the higher maximum amount, which in terms of section 157(5) is £17,500,000.

[23]

When individuals provided information to the respondent during a criminal

investigation they did not necessarily know that the information would be provided to

another body for a different purpose. The respondent regularly received requests from

regulatory bodies for information obtained during criminal inquiries to enable those bodies

to carry out their functions in relation to assessing their members' suitability to practise. The

information sought generally comprised sensitive personal data, such as statements of

victims of sexual assault, standard prosecution reports and interview transcripts. In light of

the two sheriff court decisions referred to above there was increased pressure on the

respondent from regulatory bodies for the disclosure of sensitive personal data, primarily

focused on cases in which there had been no criminal proceedings or there had been verdicts

of acquittal. The respondent therefore contacted the Information Commissioner's Office in

December 2019 in relation to his approach and received the reply dated 20 December 2019

set out in para [10] above.

[24]

The petitioner had no statutory power to require the disclosure of information from

the respondent or from anyone else. However, it could rely on para 2(5)(b) of Schedule 4 to

the 2011 Order which provides that the Court of Session may order any person to disclose

documents or other evidence to the petitioner on an application by any party to proceedings

held by the petitioner in respect of an investigation of an individual's fitness to teach. That

was what the petitioner had done in these seven cases. Given the sensitive nature of the

information sought and the restrictions imposed by the 2018 Act on the disclosure of the

relevant information the respondent was not permitted or obliged to provide that

information to the petitioner without a court order. If he was permitted to disclose the

information sought, he was not under a duty to do so without a court order, the formality of

which ensured that interested persons who might wish to object to that information being

disclosed to the petitioner were given a fair opportunity to do so. Even if the respondent

was permitted to disclose the information sought without a court order, given the clear

indication from the ICO that he was not permitted to do so, and the potentially significant

penalty that could be imposed by the ICO for a breach of Part 3 of the 2018 Act, it was

reasonable for the respondent to require a court order first. No oral hearing was required

because the respondent did not oppose the granting of the substantive orders sought by the

petitioner, undertook to comply with those orders if the court granted them, and entered

appearance in the petition proceedings solely for the purpose of opposing any adverse

award of expenses. Both parties were publicly funded.

[25]

Although the general rule was that expenses follow success the court had a broad

discretion in relation to expenses. In considering whether or not to award expenses against

the respondent it was neither necessary nor appropriate for a determination to be made on

whether or not the respondent was in fact authorised to disclose the information requested

without a court order. The petitioner had no statutory right to require the petitioner to

provide information to it. The petitioner did not seek declarator that a court order was

unnecessary in order for the information to be disclosed, nor did it seek judicial review of

the respondent's refusal to hand over the information without a court order. The

respondent did not oppose the petitions and lodged answers only to protect his position in

relation to expenses if necessary. The court therefore did not determine the issue when

granting the orders and it was not the reason why it granted them. The petitioner could not

now seek to have the issue determined indirectly in the context of a motion for expenses. It

was accepted that an award of expenses was a matter for the discretion of the court and that

the general rule was that expenses followed success but it was disputed that the general rule

applied in this case where the petitioner was clearly not vindicating a right (Howitt v W

Alexander & Sons Ltd 1948 SC 154, Lord President Cooper at p157). Although the general

rule might apply in the context of contested proceedings where there have been opposing

arguments made and one party has succeeded and the other has failed the same could not

be said in proceedings such as these in which the respondent expressly did not oppose the

orders sought and lodged answers only to preserve his position in relation to expenses. The

general rule therefore did not apply in the circumstances of these cases. The issue of

whether or not the respondent was permitted to provide the petitioner with the information

sought without a court order was irrelevant to the determination of expenses, as were his

reasons for not providing the information without a court order. Even if the respondent was

authorised to disclose personal data without a court order having a court order provided an

important safety net that ensured that persons whose rights were to be protected had an

opportunity to object to the sharing of their personal data which they would not necessarily

have, or have to the same extent, if the data were to be provided without a court order. The

respondent had adopted a reasoned and measured approach and should not be penalised in

expenses simply for seeking to ensure that the rights of third parties were protected and that

he did not fall foul of Part 3 of the 2018 Act in circumstances where there was clearly

uncertainty about its correct interpretation and where he had received unequivocal advice

from the ICO.

[26]

All three leading cases referred to by the petitioner could be distinguished from the

present cases and none provided clear authority that the respondent was authorised to

provide personal data for law enforcement purposes to the petitioner without a court order.

This was still a grey area, particularly in the context of requests from regulatory bodies such

as the petitioner which had no statutory authority to require documents from the

respondent or anyone else, but who were otherwise permitted to make an application for an

order by the court. Woolgar was decided before Part 3 of the 2018 Act came into effect. The

information sought related to the person whose conduct was under investigation, not

personal data about third party victims or witnesses that had been gathered for law

enforcement purposes. Unlike the petitioner, the body seeking the information was the

United Kingdom Central Council for Nursing Midwifery and Health Visiting and was a

regulatory body operating in the field of public health and safety. Savery was also decided

before Part 3 of the 2018 Act came into effect. The issue for determination was whether the

General Dental Council was entitled to pass patient records onto its investigating committee

and practice committee. The information was therefore being shared with a competent

authority concerned with law enforcement and was not the type that would be protected

under Part 3 of the 2018 Act. C was decided after Part 3 of the 2018 Act came into effect and

referred to Woolgar, but the information being sought was not personal data, which is what

is protected by Part 3 of the 2018 Act. This was made clear in para [144]. That case was

therefore not clear authority for Police Scotland to provide personal data collected for law

enforcement purposes to the petitioner without a court order. The two sheriff court cases

were decided before Police Scotland approached the ICO for advice. In the SCCC case

Sheriff McSherry was of the view that in order to find Police Scotland liable in expenses the

court was in effect being asked to review the decision of Police Scotland and make a

judgment on it. He considered that the question of whether Police Scotland was correct that

it could not hand over the documents voluntarily, and whether it was reasonable in

responding to the requests to do so, were matters for judicial review and for the court to

determine in a debate concerning liability for the expenses of raising the action in the first

place.

[27]

The ICO advice did not contradict its Code of Practice, which was of general

application. Furthermore, it was apparent from ongoing discussions among the relevant

public bodies and the ICO that the advice contained in the letter of 20 December 2019

continued to apply.

[28]

Although awards of expenses could be made against public bodies in contested

actions in which the opposing party is seeking to vindicate a right that was not the case here.

In any event, the approach of Police Scotland to requiring a court order before providing the

information sought was reasonable in all the circumstances. It was not appropriate that

Police Scotland, as a public body, be punished in relation to expenses where it was

concerned to protect third parties in relation to disclosure of their personal data and where

the ICO has advised that they cannot disclose such data without a court order.

[29]

A further consideration relevant to the exercise of the court's discretion and which

further weighed against the granting of expenses against Police Scotland in this case was the

effort and expense incurred by them in effecting service and engaging with interested

parties whose personal data were being sought by the petitioner. In this regard the

respondent did not oppose any of the orders sought, knowing that they included orders

ordaining him to intimate the petitions on persons whose rights under article 8 of the ECHR

would be infringed if their personal information were provided to the petitioner without

their having an opportunity to be heard. In particular, between 4 December 2020 and

17 June 2021 intimation letters were sent by Police Scotland to 22 interested parties. In

addition, there were various telephone and email exchanges between their agents and

interested parties who were seeking more information. This had all been done at the

expense of Police Scotland and were expenses that the petitioner would otherwise have had

to bear.

[30]

In all the circumstances the most appropriate order would be for the court to refuse

the petitioner's motion that the respondent be found liable in expenses and to find no

expenses due to or by either party.

Discussion

[31]

The normal rule is that expenses follow success. In these petitions the petitioner has

been successful in that it has obtained the granting of the prayers of the petitions without the

need for any hearing. The bringing of the petitions was necessary because the respondent

refused to provide the petitioner with the information requested and therefore required the

petitioner to bring these petitions in order to obtain court orders against the respondent for

the required information to be disclosed. The submission advanced by the respondent is

that he had no power to disclose the information voluntarily as he was prevented from

doing so by section 36(4) of the 2018 Act and he should therefore not be found liable in

expenses. In my opinion it is essential (contrary to the submission advanced on behalf of the

respondent), with a view to determining the question of expenses, to decide first whether

the respondent was authorised to disclose the information without a court order.

[32]

In my opinion the position adopted by the respondent, as well as the advice

provided to him by the ICO, was clearly wrong in law. Section 36(4) of the 2018 Act

provides that any of the data provided for the law enforcement purposes may not be

processed for a purpose that is not a law enforcement purpose unless the processing is

authorised by law. Assuming for present purposes (as the contrary was not argued) that the

purpose for which the petitioner sought disclosure was not a law enforcement purpose, the

question which arises is whether disclosure was authorised by law. In my opinion it plainly

was, and it was therefore not necessary for the respondent to insist upon a court order

before disclosing the material requested. The cases of Woolgar, Savery and C are authority

for the proposition that the common law and section 32 of the 2012 Act permit the disclosure

by the respondent to the petitioner of the requested material without the necessity of a court

order on public safety grounds. This was made clear by Kennedy LJ in Woolgar and Sales J

in Savery in the passages quoted above, which seem to have been either ignored or

misunderstood by the respondent and the ICO. Indeed, Kennedy LJ stated that the police

may even be under a duty to pass confidential information to a professional or regulatory

body without being requested to do so if, in their reasonable view, it should be considered in

the interests of public health or safety by that body. Sales J affirmed a previous judicial

statement that the intervention of the court was not required in a case where it was

proposed to make use of patient records for the purposes of professional conduct or

improper practice proceedings by appropriate regulatory bodies. The same principle

applies to the information held by the police in these cases. I do not accept the submission

for the respondent that the three cases can be distinguished as they did not relate to the data

of witnesses or victims: all that matters is that the information contains personal data. It

follows that the respondent, who did not otherwise oppose the disclosure of the requested

information, could (and should) have lawfully disclosed the requested information to the

petitioner. There was no lack of clarity in the law: it was perfectly clear. The cases of

Woolgar and Savery stated the common law which applied both before and after the

enactment of the 2018 Act. It follows that I disagree with the decision of Sheriff McSherry

not to award expenses and I agree with the reasoning and decision of Sheriff Small in

awarding expenses. In the case dealt with by Sheriff Small the position adopted by the

respondent was inexplicable and indefensible as the petitioner had a clear statutory right to

the information which the respondent refused to provide. The respondent in the cases

before me wrongfully forced the petitioner to incur the unnecessary expense of bringing

these petitions and must therefore be found liable in expenses.

[33]

I do not accept the submission for the respondent that the petitioner was not seeking

to vindicate a right in bringing the petitions. In my opinion it clearly was: it was seeking to

vindicate its right to receive the information held by the respondent. Nor do I think that the

fact that the respondent did not oppose the granting of the petitions is anything to the point.

The respondent, by his refusal to provide the information sought, put the petitioner to the

needless expense of having to bring the petitions in the first place. The petitioner was a

body operating in the field of public safety as it is responsible for ensuring that people who

are a danger to children are not permitted to remain on the register and so not permitted to

continue to teach. The fact that both parties are public bodies is an irrelevant consideration

when determining the question of expenses. So also is the fact that the respondent acted on

advice from the ICO as he must take responsibility for his own decisions.

[34]

The question of a possible infringement of Article 8 of the ECHR if personal

information of certain persons is provided by the respondent to the petitioner without their

having the opportunity to be heard arises. This is a procedural issue which has been dealt

with by the court on 16 April 2021 ordaining the respondent to intimate the petitions to

those persons whose rights under Article 8 of the ECHR would be infringed if their personal

information were provided to the petitioner without their having an opportunity to be

heard. The expense of intimation was an unavoidable one for the respondent as the holder

of the data and does not affect the general question of expenses.

Decision

[35]

For the reasons given above I shall find the respondent liable to the petitioner in the

expenses of each petition. I trust that this decision will bring an end to the erroneous

practice of the respondent automatically refusing to disclose relevant information to

professional or regulatory bodies without a court order.