General Regulatory Chamber
Information Rights
Heard on: 9 May 2023 Deliberations on 12 May 2023 |
||
B e f o r e :
TRIBUNAL MEMBER PIETER DE WAAL
TRIBUNAL MEMBER SUZANNE COSGRAVE
____________________
NOEL TITHERADGE |
Appellant |
|
- and - |
||
(1) THE INFORMATION COMMISSIONER (2) BRITISH TRANSPORT POLICE |
Respondent |
____________________
For the Appellant: Ms Wisson (Counsel)
For the First Respondent: Mr. Davidson (Counsel)
For the Second Respondent: Mr. Hopkins (Counsel)
Decision: The appeal is dismissed.
____________________
Crown Copyright ©
REASONS
Introduction
Factual background to the appeal
"PC Anderson was on duty on 4 March 2020 at Finsbury Park station when he turned off the body worn video of another officer and intentionally damaged the mobile phone a detained person. On 11 March 2020 PC Anderson was also found to have subjected a detained person to degrading treatment, whereby he filled their shoes with water."
"Incident on 4th March 2020
This piece of footage is 11:29 long.
It opens with the officer filming in an interview room which appears to be in a police station. Officers are dealing with a female and trying to confirm her details. The female does not appear to speak much English so most of the time is spent trying to confirm her name/identity. The primary data subject is the female, who is seen on camera, her name and date of birth is confirmed and ID documents can be seen on camera. The officer tries to radio for a PNC check, but not does not receive a reply and is having trouble doing a check on her mobile device. The female shows officers her mobile phone and unlocks it for them on request. The officers discuss spelling of the name and the phone screen is seen on the footage. The camera is primarily capturing the female, who is sitting on a chair in the corner of the room and appears to be crying. As well as the officer filming, another officer (who I believe to be PC Anderson) is occasionally partially captured and can be heard also questioning the female. PC Anderson can be heard leaving the room at 07:50 on the recording leaving the other officer alone. He states "You alright, you've got your camera on?" Another officer comes in at 09:15 and starts speaking to the officer about identity. They again look at a photo on the female's phone. He asks questions about how long the female has been in the country and she says 10 days. The officer asks "how long have you been doing this on the train? Tissue begging?" but she says she doesn't understand. She states she speaks Italian. Someone in the background can be heard saying "Italian speaker" and another officer who appears to speak Italian enters and leans between the camera and the female and speaks to the female. At 11:15 PC Anderson follows the Italian-speaking officer back into the room. The other officer who had entered leaves and the filming officer says "thank you" to him and laughs. PC Anderson says "Oh, sorry ". The filming officer says " ". The two officers are standing watching the Italian-speaking officer speak to the female. PC Anderson looks over at the filming officer and then moves towards her with his arm out. The coverage then cuts out.
Incident on 13th March 2020
This piece of footage is exactly 1 minute long. The audio starts at 00:30 as is always the case on this system. The scene is outside at night, there are a number of police officers seen and a number of young males. As the audio comes in someone can be heard in the background saying "Do not interfere with my colleague". The filming officer announces "putting my camera on for the purposes of the search". I note that it is mandatory for a BWV camera to be on when conducting a stop search. A young male is in front of the camera and the officer gives her name and number and states that the object of the search is a search for drugs. Another officer can initially be seen behind the male who has been stopped that I believe may be PC Anderson. He moves away to the officer's right. A hand then appears over the screen and the footage ends."
Requests, decision notice and appeal
The request
All body worn video recorded by officers showing PC Tim Anderson turning off body worn video of a fellow officer as recorded here:
https://www.mylondon.news/news/north-london-news/london-police-officer-dismissed-filling-19966126
The response
The Decision Notice
Notice of Appeal
Ground One
The Commissioner proceeded on an incorrect factual basis regarding the scope of the request which was limited by its express terms, namely to the BWV which captured the relevant police officer "turning off [BWV] of a fellow officer". The Commissioner's references to the BWV capturing multiple "incidents" involving multiple "data subjects" are misplaced and infected the Commissioner's application of the balancing test under Article 6(1)(f) UK GDPR.
Ground Two
The Commissioner erred in finding that the relevant data subjects held a "strong and reasonable expectation" that the relevant BWV would not be disclosed in circumstances where:
(i) The relevant "data subjects" are limited to those captured in a temporally limited extract of BWV, namely: (i) the police officers who were the subject of the gross misconduct proceedings and/or directly involved in the incident; and (ii) other individual(s) (if any) shown in the footage (it being understood by the Appellant that other individuals were not necessarily captured in this temporally limited extract of BWV);
(ii) Proceedings for "gross misconduct" are conducted in public both generally and in this particular case, such that allegations regarding the requested BWV footage were made in public (cf, proceedings for "misconduct", which occur in private, such that the data subjects would have a reasonable expectation of non-disclosure); and
(iii) The British Transport Police's Privacy Notice expressly recognises that it "may disclose personal data to a wide variety of recipients in any part of the world" including where required to do so pursuant to legislation or to the media.
Ground Three
The fundamental rights and freedoms of the relevant data subjects are outweighed by the legitimate interests pursued by the appellant and/or the pressing social need for disclosure of such information in circumstances of gross police misconduct, including in the use of BWV, and a fortiori where this leads to dismissal from the force.
The Commissioner's response
Ground 1
17.1. The scope of the request is unclear. There is no suggestion as to when the relevant clip would begin.
17.2. This does not appear to be Mr Titheradge's understanding of the request. In his request for an internal review, he did not object to the British Transport Police's description of the footage.
17.3. Disclosure of the extract is not necessary for the purposes of the legitimate interests which have been met by the public misconduct hearing and the fact of deactivation being in the public domain.
Ground 2
21.1. Whilst police officers do not have a substantial expectation of privacy in respect of the footage, they would not expect disclosure unless it was truly necessary and any benefit outweighed their own privacy rights which they do not in this case.
21.2. The two members of the public are the primary focus of the footage and neither would have an expectation that the footage would be released.
21.3. It would not be practical or appropriate to seek their consent.
21.4. Disclosure of personal data is likely to cause distress to members of the public and officers other than PC Anderson.
The response of the British Transport Police
"8. The footage of Incident 1 is 11 minutes and 29 seconds long and takes place within a police station. It includes police officers questioning an arrested person ("X"), in particular in order to establish and verify her identity. X is visible for much of the footage. She repeatedly states her name and confirms her date of birth. She shows police officers documents on her phone, with her screen visible on the footage. Given X's apparently limited English, another officer appears who is then heard conversing with X in Italian. PC Anderson is briefly visible moving towards the filming officer shortly before the footage stops.
9. The footage of Incident 2 is one minute long. The scene is outdoors at night. The footage shows a number of police officers and a number of young members of the public, one of whom ("Y") is shown prominently on the footage. An officer is heard explaining inter alia that the individuals have been stopped for the purposes of a search for drugs. PC Anderson is again briefly visible moving towards the filming officer shortly before the footage stops."
27.1. Disclosure would be unfair, in that it would contravene the reasonable expectations of the data subjects and would be likely to cause them (or some of them) damage and distress without adequate justification.
27.2. Disclosure would be unlawful in that:
27.2.1. Disclosure to a member of the public otherwise than under FOIA would contravene the privacy rights of X and Y in particular and police officers other than PC Anderson;
27.2.2. No lawful processing condition under Article 6(1) UK GDPR would be met. There is no legitimate interest in the personal data of X and Y. There is limited legitimate interest in the personal date of police officers other than PC Anderson, but such disclosure is unnecessary for and disproportionate to that interest, and the interests of the data subject override the interest in disclosure. There is a legitimate interest in disclosure of the personal data about PC Anderson, but such disclosure is unnecessary for and disproportionate to that interest, which has already been met by the British Transport Police's press release. If footage were to be confined only to PC Anderson turning off the BWV cameras, the footage would be so limited as to be meaningless and would add nothing of substance to the British Transport Police's press release.
27.3. To the extent that footage comprises criminal offence data, the British Transport Police submits that no lawful processing condition from Schedule 1 DPA would be met on the facts of this case.
28.1. The Commissioner correctly notes that (i) the British Transport Police's interpretation of the request was made clear to Mr Titheradge, who did not take issue with that point in his request for internal review, and (ii) the withheld footage cannot realistically be confined to showing only PC Anderson turning off the body worn cameras without thereby being so minimal as to be meaningless.
28.2. As to reasonable expectations of privacy, the Commissioner is correct that neither the fact of a public misconduct hearing nor the terms of the British Transport Police's privacy notice remove or materially weaken those expectations.
28.3. As to the balance of competing interests, the British Transport Police maintains that the Commissioner reached the correct conclusion.
Evidence
"Mr Hopkins said he had nothing to add in closed to what he said in open. Mr Davidson said that, on that basis, there was nothing he wished to add either.
Mr De Waal asked about the relationship between the two incidents referred to in the BTP's press release about PC Anderson's dismissal and the two incidents featured on the withheld BWV footage. Mr Hopkins explained that the first of the incidents referred to in the press release (4 March 2020) relates to Incident 1, ie the longer of the two sets of footage. The second of the incidents in the press release (11 March) did not relate to BWV footage. The footage of Incident 2 was held by the panel that heard the misconduct proceedings against PC Anderson, but not referred to in the press release about PC Anderson's dismissal."
."
Legal framework
Personal data
(1) Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.
(2) Any information to which a request for information relates is also exempt information if –
(a) It constitutes personal data which does not fall within subsection (1), and
(b) either the first, second or the third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act -
(a) would contravene any of the data protection principles...
…
(2) 'Personal data' means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).
(3) 'Identifiable living individual' means a living individual who can be identified, directly or indirectly, in particular by reference to—
(a) an identifier such as a name, an identification number, location data or an online identifier, or
(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
(26) The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a
manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.
i) Whether the data in question "relate to" a living individual and
ii) Whether the individual is identified or identifiable, directly or indirectly, from those data.
Mere mention of the data subject in a document held by a data controller does not necessarily amount to his personal data. Whether it does so in any particular instance depends on where it falls in a continuum of relevance or proximity to the data subject as distinct, say, from transactions or matters in which he may have been involved to a greater or lesser degree. It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised. The second is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated.
It is important to remember that it is not always necessary to consider 'biographical significance' to determine whether data is personal data. In many cases data may be personal data simply because its content is such that it is 'obviously about' an individual. Alternatively, data may be personal data because it is clearly 'linked to' an individual because it is about his activities and is processed for the purpose of determining or influencing the way in which that person is treated. You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him.
(2) Does the data "relate" to an individual in the sense that it is "about" that individual because of its:
(i) "Content" in referring to the identity, characteristics or behaviour of the individual?
(ii) "Purpose" in being used to determine or influence the way in which the individual is treated or evaluated?
(iii) "Result" in being likely to have an impact on the individual's rights and interests, taking into account all the circumstances surrounding the precise case (the WPO test)?
(3) Are any of the 8 questions provided by the TGN are applicable?
These questions are as follows:
(i) Can a living individual be identified from the data or from the data and other information in the possession of, or likely to come into the possession of, the data controller?
(ii) Does the data 'relate to' the identifiable living individual, whether in personal or family life, or business or profession?
(iii) Is the data 'obviously about' a particular individual?
(iv) Is the data 'linked to' an individual so that it provides particular information about that individual?
(v) Is the data used, or is it to be used, to inform or influence actions or decisions affecting an identifiable individual?
(vi) Does the data have any biographical significance in relation to the individual?
(vii) Does the data focus or concentrate on the individual as its central theme rather than on some other person, or some object, transaction or event?
(viii) Does the date impact or have potential impact on an individual, whether in a personal or family or business or professional capacity (the TGN test)?
(4) Does the data "relate" to the individual including whether it includes an expression of opinion about the individual and/or an indication of the intention of the data controller or any other person in respect of that individual. (the DPA section 1(1) test)?
Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of personal data, in particular where the data subject is a child.
1. Is the data controller or a third party pursuing a legitimate interest or interests?
2. Is the processing involved necessary for the purposes of those interests?
3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?
27. ... It is well established in community law that, at least in the context of justification rather than derogation, 'necessary' means 'reasonably' rather than absolutely or strictly necessary .... The proposition advanced by Advocate General Poiares Maduro in Huber is uncontroversial: necessity is well established in community law as part of the proportionality test. A measure which interferes with a right protected by community law must be the least restrictive for the achievement of a legitimate aim. Indeed, in ordinary language we would understand that a measure would not be necessary if the legitimate aim could be achieved by something less. ...
Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.
In Article 10 of the GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—
(a) the alleged commission of offences by the data subject, or
(b) proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.
10 Special categories of personal data and criminal convictions etc data
(1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—
(a) point (b) (employment, social security and social protection);
(b) point (g) (substantial public interest);
(c) point (h) (health and social care);
(d) point (i) (public health);
(e) point (j) (archiving, research and statistics).
(2) The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.
(3) The processing meets the requirement in point (g) of Article 9(2) of the UK GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.
(4) Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.
(5) The processing meets the requirement in Article 10 of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.
Extension of conditions in Part 2 of this Schedule referring to substantial public interest
This condition is met if the processing would meet a condition in Part 2 of this Schedule but for an express requirement for the processing to be necessary for reasons of substantial public interest.
Journalism etc in connection with unlawful acts and dishonesty etc
(1) This condition is met if—
(a) the processing consists of the disclosure of personal data for the special purposes,
(b) it is carried out in connection with a matter described in subparagraph (2),
(c) …
(d) it is carried out with a view to the publication of the personal data by any person, and
(e) the controller reasonably believes that publication of the personal data would be in the public interest.
(2) The matters mentioned in sub-paragraph (1)(b) are any of the following (whether alleged or established)—
(a) the commission of an unlawful act by a person;
(b) dishonesty, malpractice or other seriously improper conduct of a person;
(c) unfitness or incompetence of a person;
d) mismanagement in the administration of a body or association;
(e) a failure in services provided by a body or association.
…
(4) In this paragraph-
…
"the special purposes" means-
(a) the purposes of journalism;
…
The role of the tribunal
Issues
51.4.1. Would disclosure be for the purposes of journalism?
51.4.2. Would disclosure be carried out in connection with the alleged or established commission of an unlawful act by a person?
51.4.3. Would disclosure be carried out with a view to the publication of the personal data by any person?
51.4.4. Does the controller reasonably believe that publication of the personal data would be in the public interest?
51.5.1. Is the data controller or a third party pursuing a legitimate interest or interests?
51.5.2. Is the processing involved necessary for the purposes of those interests?
51.5.3. Are the above interests overridden by the interests or fundamental rights and freedoms of the data subject?
Discussion and conclusions
Scope
https://www.mylondon.news/news/north-london-news/london-police-officer-dismissed-filling-19966126'
"…the footage captured includes two incidents, one where a detained female is being processed and one where a male is being subject to a stop search process. The footage captures images and audio relating to these data subjects, as well as other police officers who are also captured."
61.1. In relation to incident 1: from 11:26-11.29 (when the footage ends) i.e. 3 seconds.
61.2. In relation to incident 2: from the point in 0:56 when PC Anderson's arm is first seen in front of the camera until 1:00 (when the footage ends) i.e. just under 4 seconds.
Personal data
Is all or part of the requested information criminal offence data?
Legitimate interests etc.
Summary of decision
Signed Sophie Buckley
Date: 26 May 2023
Judge of the First-tier Tribunal